Privacy Policy

Our Approach

Celebrateful is built with privacy in mind. We only collect the minimum information needed to provide the service.

• We never sell your personal data.
• No account or login required to use the service.
• Celebrations are private — only accessible with the correct passcode.
• Gift card details are encrypted end-to-end. Not even we can see them.

1. Information We Collect

Information You Provide:

• Sender Name: The name you enter when creating a celebration. This is displayed to the recipient.
• Celebration Content: Cheer cards, notes, and surprise treats you add to a celebration.
• Gift Card Details: If you add a gift card, the code and PIN are encrypted using the recipient's passcode and a server secret. We cannot decrypt or access this data.

Information We Collect Automatically:

• Basic Analytics: We may collect anonymous usage data like page views and feature usage to improve the service.
• Device Information: Browser type, device type, and operating system for compatibility purposes.

Information We Do NOT Collect:

• Email addresses (unless you contact us)
• Phone numbers
• Contacts or address books
• Location data
• Payment information (we don't process payments currently)

2. How We Use Your Information

• To Provide the Service: Store and deliver your celebrations to recipients via shareable links.
• To Secure the Service: Verify passcodes, rate-limit access attempts, and prevent abuse.
• To Improve the Service: Understand how features are used so we can make them better.

3. How We Protect Your Information

• Passcodes: Hashed with SHA-256 and a unique salt. We never store passcodes in plain text.
• Gift Card Data: Encrypted with AES-256-GCM using the recipient's passcode as part of the key. Only the recipient can decrypt it.
• Sender Keys: Separately hashed and salted. The sender's tracking link uses a different secret than the recipient's passcode.
• Share Links: Expire after 30 days. Failed passcode attempts are rate-limited with lockout after 5 attempts.

4. Data Sharing

We do not sell your data. We may share information with:

• Infrastructure Providers: We use Supabase for database hosting and Netlify for web hosting.
• Legal Authorities: If required by law or to protect the rights, property, or safety of Celebrateful or others.

5. Data Retention

Celebrations and share links expire after 30 days. After expiry, the data may be retained for a short period for backup purposes before being permanently deleted.

6. Children

Celebrateful is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, please contact us.

7. Your Rights

Since we don't collect accounts or personal identifiers, there's minimal personal data to manage. However, you can:

• Request deletion of a specific celebration by contacting us with the share link.
• Ask us any questions about your data.

8. Future Changes

As Celebrateful evolves, we may introduce features like user accounts, email login, or notifications. If we do, we will update this policy and notify users before collecting any new types of data.

9. Contact Us

If you have questions about this policy, email us at:

📧 amar@celebrateful.com