Privacy

What we collect

Only what a gift needs in order to exist, and what the law requires us to keep about a payment.

• Your email address, which you verify. It is how you find your gifts again, and it is the only thing we use as a way to reach you.
• Your name, if you subscribe to the annual plan — so the welcome email is addressed to somebody.
• What you put in a gift: the message, the recipient's name, the photographs, the voice recording, the hint.
• A record of your purchases and, if you subscribe, of your subscription: the identifiers Stripe gives them and the date your paid year ends. Your card is held by Stripe, never by us.
• The dates a gift was created and first opened, which is what lets you see whether it arrived.

What we do not collect

There are no accounts and no passwords. There is no advertising network, no profile built about you, and nothing here that follows you to another site. We do not sell or rent anything on this page to anybody, and there is no arrangement under which we could. The one measurement we do is described below: it is confined to the pages that advertise the product, and it cannot tell one visitor from another.

Card numbers never reach us. Payment happens on Stripe's own checkout page, and what comes back to us is that a payment succeeded.

Cookies, and what we count

The cookies this site sets are the ones it cannot do without: which language you are reading in, whether you are signed in to your own area, and whether a gift you were sent has already been unlocked in this browser. That is the whole list. None of them is used to follow you, none is shared, and there is no third party setting cookies of its own on any page of ours.

We do count visits to the pages that advertise the product — the home page and the four pages about particular occasions — using Vercel Web Analytics, the company that already runs the site for us, so no new party sees anything. It sets no cookie and stores nothing on your device. It records that a page was viewed, from roughly which country, which browser and which link you followed, and it counts a visitor by a hash of the request that is thrown away within a day. There is nothing in it that could be turned back into you, which is why there is no banner here asking your permission for it: we did not have anything to ask about.

• It runs on those five pages alone. Not on a gift somebody sent you, not in your own area, not on this page — those are not counted at all. We also record that somebody began writing a gift, that somebody went on to pay, and which of the five pages they started from, because that is how we tell whether a page is any use. That same page name is attached to the payment record. What you write is never part of any of it.
• That confinement is what keeps the private link private: the address of a gift is the gift, so it is never handed to anything that counts visits, ours or anybody else's.
• Stripe sets its own cookies on its checkout page while you are paying. That page is theirs, not ours, and it is covered by Stripe’s privacy policy.

Photographs, voice and your message

These are the private part, and they are stored privately: in storage that is not publicly readable, reachable only through short-lived credentials issued for one gift at a time. An address alone is never the protection.

We do not use what you write, photograph or record to train anything, and no person at our end reads it in the ordinary course of running the service. We would only look at a specific gift if you asked us to in order to help you, or if we were legally compelled to.

The secret

If you lock a gift, we do not store the word you chose. We store a one-way representation of it that can confirm a correct answer and cannot be turned back into the answer.

This has a consequence worth being plain about: we cannot recover it, tell it to you, or tell it to the person you sent it to. If it is forgotten, the content behind it stays closed. While a gift is locked, the message, photographs and recording are never sent to the browser at all — only the hint you chose to give.

The private link

A gift is addressed by a long random token. It is not numbered, not guessable, and not listed anywhere; we do not publish it and we ask search engines not to index these pages.

It is still a link. Anyone who has it can open the gift, so treat it the way you would treat the gift itself — send it to the person and to nobody else.

Who else is involved

Four companies process data on our behalf in order for the service to function. They act on our instructions and for no purpose of their own.

• Stripe — payment. They receive your email address and the amount, and handle your card details directly. We never see them.
• Supabase — the database and the private storage where your gift lives.
• Resend — email delivery. They receive the address we send to and the contents of that email.
• Vercel — hosting, which necessarily processes requests to the site.

How long we keep it

A gift is meant to last, so we keep it until you delete it. We do not expire your gifts, and we do not delete an account for being quiet.

Records of payments are kept for as long as tax and accounting rules require, which is separate from your gifts and outlives their deletion.

Sign-in links expire in minutes and work once. Sign-in sessions expire on their own.

Deleting things

Deleting a single gift is immediate and final. It takes the message, the photographs and the recording with it, and the private link stops working for everyone who has it.

Deleting your whole account is scheduled rather than instant. You confirm it explicitly, we sign you out, and 30 days later it is carried out and cannot be undone. During that window nothing is destroyed: your gifts keep working and the people you sent them to are never caught up in your second thoughts. Sign in again at any point before the date and you can cancel it.

After the window, your gifts, their media, their links and your plan are gone. An annual plan stops renewing as soon as you ask to close the account and is cancelled when the account is deleted; what you paid for it is not refunded, and neither is Lifetime access.

Your rights

If you are in the EU, the UK, or somewhere with comparable law, you have the right to see what we hold about you, correct it, have it deleted, take a copy of it, and object to how we use it. Most of that you can do yourself from your dashboard. For anything else, write to contact@alittlesomething.io from the address you bought with and we will answer within 30 days.

We rely on your consent for the contents of a gift — you chose to put it there — and on the necessity of performing the purchase you made for everything else. You can withdraw consent by deleting the gift.

If you think we have handled your data badly, we would rather hear it directly, but you are entitled to complain to your national data protection authority instead.

Children

This is a paid product for adults, and it is not directed at children. We do not knowingly collect anything from a child under 13. If you believe a child has sent us something, write to us and we will remove it.

Changes, and how to reach us

If this policy changes in substance, the date at the top changes with it, and we will email you before a change that affects data we already hold.

Questions, requests and complaints: contact@alittlesomething.io.