Privacy

What we collect

Only what a gift needs in order to exist, and what the law requires us to keep about a payment.

• Your email address, which you verify. It is how you find your gifts again, and it is the only thing we use as a way to reach you.
• Your name, if you buy Lifetime access — so the welcome email is addressed to somebody.
• What you put in a gift: the message, the recipient's name, the photographs, the voice recording, the hint.
• A record of your purchase, and the identifier Stripe gives it.
• The dates a gift was created and first opened, which is what lets you see whether it arrived.

What we do not collect

There are no accounts and no passwords. There is no analytics script, no advertising network, no third-party tracker, and no profile built about you. We do not sell or rent anything on this page to anybody, and there is no arrangement under which we could.

Card numbers never reach us. Payment happens on Stripe's own checkout page, and what comes back to us is that a payment succeeded.

Photographs, voice and your message

These are the private part, and they are stored privately: in storage that is not publicly readable, reachable only through short-lived credentials issued for one gift at a time. An address alone is never the protection.

We do not use what you write, photograph or record to train anything, and no person at our end reads it in the ordinary course of running the service. We would only look at a specific gift if you asked us to in order to help you, or if we were legally compelled to.

The secret

If you lock a gift, we do not store the word you chose. We store a one-way representation of it that can confirm a correct answer and cannot be turned back into the answer.

This has a consequence worth being plain about: we cannot recover it, tell it to you, or tell it to the person you sent it to. If it is forgotten, the content behind it stays closed. While a gift is locked, the message, photographs and recording are never sent to the browser at all — only the hint you chose to give.

The private link

A gift is addressed by a long random token. It is not numbered, not guessable, and not listed anywhere; we do not publish it and we ask search engines not to index these pages.

It is still a link. Anyone who has it can open the gift, so treat it the way you would treat the gift itself — send it to the person and to nobody else.

Who else is involved

Four companies process data on our behalf in order for the service to function. They act on our instructions and for no purpose of their own.

• Stripe — payment. They receive your email address and the amount, and handle your card details directly. We never see them.
• Supabase — the database and the private storage where your gift lives.
• Resend — email delivery. They receive the address we send to and the contents of that email.
• Vercel — hosting, which necessarily processes requests to the site.

How long we keep it

A gift is meant to last, so we keep it until you delete it. We do not expire your gifts, and we do not delete an account for being quiet.

Records of payments are kept for as long as tax and accounting rules require, which is separate from your gifts and outlives their deletion.

Sign-in links expire in minutes and work once. Sign-in sessions expire on their own.

Deleting things

Deleting a single gift is immediate and final. It takes the message, the photographs and the recording with it, and the private link stops working for everyone who has it.

Deleting your whole account is scheduled rather than instant. You confirm it explicitly, we sign you out, and 30 days later it is carried out and cannot be undone. During that window nothing is destroyed: your gifts keep working and the people you sent them to are never caught up in your second thoughts. Sign in again at any point before the date and you can cancel it.

After the window, your gifts, their media, their links and — if you had it — your Lifetime access are gone. Lifetime access is not refunded, and buying it again would be a new purchase.

Your rights

If you are in the EU, the UK, or somewhere with comparable law, you have the right to see what we hold about you, correct it, have it deleted, take a copy of it, and object to how we use it. Most of that you can do yourself from your dashboard. For anything else, write to contact@alittlesomething.io from the address you bought with and we will answer within 30 days.

We rely on your consent for the contents of a gift — you chose to put it there — and on the necessity of performing the purchase you made for everything else. You can withdraw consent by deleting the gift.

If you think we have handled your data badly, we would rather hear it directly, but you are entitled to complain to your national data protection authority instead.

Children

This is a paid product for adults, and it is not directed at children. We do not knowingly collect anything from a child under 13. If you believe a child has sent us something, write to us and we will remove it.

Changes, and how to reach us

If this policy changes in substance, the date at the top changes with it, and we will email you before a change that affects data we already hold.

Questions, requests and complaints: contact@alittlesomething.io.