Privacy

Last updated: 2026-10-03.

About this policy. We are a small product operated from Rajkot, Gujarat, India. This page is best-effort plain-language disclosure of what we collect and how we use it; it has not yet been reviewed by counsel. We will update it as we engage formal review and as the law evolves.

We keep what we need to run the service and nothing else. This page lists the user-identifying data we store, the cookies we set, what control you have over your data, and how to reach us with questions or complaints.

1. Roles under Indian law

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data you give us; you are the Data Principal. By signing in — either by clicking a magic link we email you, by entering a password you've set on your account, or by choosing "Continue with Google" — you give us consent to process your personal data for the purposes described below. Usage analytics is a separate choice: it runs only if you pick "Allow analytics", and you can change that at any time (see Your analytics choice).

2. What we collect

3. Cookies

Most of our cookies are strictly necessary for the service to work. Analytics cookies are optional: they are set only if you choose "Allow analytics", and never on the card pages your recipients open.

Strictly necessary

.AspNetCore.Identity.Application

Keeps you signed in. HTTP-only, Secure, SameSite=Strict. Expires 30 days after your last visit.

card_session

Prevents the same recipient from inflating a card's open count by reloading. A random value with nothing about you in it. HTTP-only, Secure, SameSite=Lax. Expires 24 hours after the first card you open.

.AspNetCore.Antiforgery.*

Protects our forms against cross-site request forgery. HTTP-only; deleted when you close your browser.

.AspNetCore.Mvc.CookieTempDataProvider

Carries a one-time message (such as "Saved") from one page to the next. HTTP-only; deleted as soon as it has been read.

.AspNetCore.Correlation.* and .AspNetCore.Identity.External

Set only while you "Continue with Google", to complete that sign-in securely. HTTP-only; removed when the sign-in finishes.

Your preference

ch_analytics

Remembers whether you chose "Allow analytics" or "No thanks", so we don't ask again. It holds only that choice. Expires after 180 days.

Analytics (optional, only after "Allow analytics")

_ga and _ga_<id>

Set by Google Analytics on this site to recognise a returning browser with a random identifier. Expire about 13 months after your last visit.

4. Third parties & cross-border transfers

The service integrates with a minimum number of third-party processors:

• Resend (operated by Resend Inc., USA) — production email delivery (magic-link emails, share emails) when Email:Provider is set to Resend. The data we send: recipient email, subject, message body. Email delivery is governed by Resend's data-processing agreement; this involves a transfer of your email address and message contents to servers in the United States.
• Mailgun (operated by Sinch / Mailgun Technologies Inc., USA — or by Sinch Email Germany GmbH if the EU region is selected) — alternative transactional email provider, active only when Email:Provider is set to Mailgun. The data we send is identical to the Resend block above (recipient email, subject, message body). Governed by Mailgun's data-processing agreement.
• MailKit / SMTP — the FR-001a fallback when the primary provider (Resend or Mailgun) hard-fails on a send. Also used as the only provider in development against a local MailHog instance. The destination SMTP server is operator-configured at deploy time.
• Google LLC (USA) — identity provider when you choose "Continue with Google". You authenticate with Google directly; we receive only the claims listed under §2 (Google account claims). For sign-in we share no data to Google. Use of Google as an identity provider is governed by Google's Privacy Policy.
• Google Analytics (Google LLC, USA) — usage analytics, only if you choose "Allow analytics". The data sent: the address of the page you're on with private parts removed (never a card's share link, a sign-in token, an email address or what you type into search), the page title, the referring site's domain or campaign tag, and the actions listed under §2 (Usage analytics). Your browser also reveals its device type, language and IP address to Google, which uses the IP address to estimate an approximate location; Google states that Google Analytics does not log or store IP addresses. Google signals and ad personalisation are switched off, and we never send your name, email or account id. Governed by Google's Privacy Policy and how Google uses information from sites that use its services. This involves a transfer of that usage data to Google's servers, including in the United States.
• Razorpay (Razorpay Software Private Limited, India) — payment processing when you buy a plan. We send the plan, its price, and your email address and first name to pre-fill the checkout; you enter your payment details directly with Razorpay, and we receive only the order and payment references and whether the payment succeeded. Governed by Razorpay's Privacy Policy.

We use Google Analytics only if you allow it (see Your analytics choice). We do not use ad networks. We do not route requests through a CDN or edge proxy that gets to inspect request bodies. Cross-border transfers under the DPDP Act are limited to what is necessary for service delivery, plus analytics data when you allow it.

5. Children

The service is not directed at children. Per the DPDP Act, processing personal data of a Data Principal under 18 requires verifiable consent from a parent or lawful guardian. If you are under 18, please do not use the service without your parent or guardian's express consent. If we discover an account was created by a child without the required consent, we will delete it.

6. Retention

7. Your rights as a Data Principal

The DPDP Act gives you several rights over your personal data; we respect each one:

• Access. Your dashboard shows everything we have on file: your active and revoked cards, open counts, your account state. For a JSON-format export, contact the Grievance Officer below.
• Correction. Change your email or display name from your account settings.
• Erasure. Delete your entire account from your account settings. This synchronously removes your cards, your photos, and your account row.
• Nomination. Per DPDP §13, you may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. To register a nomination, email the Grievance Officer below.
• Withdraw consent. You may withdraw your consent at any time by deleting your account. Note: this will end your access to the service and remove your data, since processing your data is what makes the service function for you. You may also remove your password or disconnect your Google account at any time from your account settings; magic-link sign-in remains available. Analytics consent is separate and just as easy to withdraw: choose "Turn analytics off" under Your analytics choice (also linked as "Cookie settings" in the footer and "Privacy & cookies" in the dashboard menu).
• Grievance. If you believe we are mishandling your data, raise a grievance with the Grievance Officer below before approaching the Data Protection Board of India.

8. Grievance Officer

Per the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act:

• Grievance Officer: Hardik Viradiya
• Email: [grievance officer email — to be added before public launch]
• Operating from: Rajkot, Gujarat, India
• Response time: within 30 days of receipt of a written grievance

9. Data breaches

If we become aware of a personal-data breach affecting you, we will notify you and the Data Protection Board of India in accordance with the DPDP Act timelines, with the information available to us at the time and follow-up details as the investigation progresses.

10. Changes to this policy

We update the last-updated stamp at the top whenever this page changes. Material changes are emailed to your sign-in email so you know to re-read.