1. Data from people who make gifts or buy

Account data: your email address; your name, if your Google or Apple account shares it; your language; your sign-in history, including the time and IP address of sign-ins; and, if you sign in with Google or Apple, the identifier and basic profile details (such as your name and a link to your profile picture) that they share.

Gift content: the names, title, message, photos and captions, music you choose or upload, voice messages, video clips, song links, dates, places and other details you add, plus the gift's settings; a password is stored only as a secure hash. Photos are resized and re-encoded on your device before upload, which removes their metadata, such as where they were taken. Video and audio files are uploaded as they are, so any metadata they contain stays in them.

Drafts: while you edit, your draft is kept in your browser's storage on your device and, if you're signed in, saved to your account, where photos upload as soon as you add them.

Purchase data: what you bought, when, the amount and currency, the payment status, the link that brought you to us (such as one of our posts, a creator's personal link or the button at the end of a gift), and Stripe's identifiers for the transaction. Stripe collects your payment details and email address; your card details go straight to Stripe and we never receive them. What we send Stripe with a checkout names what you're buying, your language, that link, the ID of your account with us and whether you asked for the checkout reminder, never a gift, a name or a note. If you accepted cookies in our banner, it also carries Meta's and TikTok's identifiers for your ad click and your browser, and your browser's user agent, so the purchase can be reported to them (section 7). We record the box you ticked at checkout (the sentence itself), asking for your purchase to be unlocked, or Ethos for Two to start, straight away, and when: it's how we show what you asked for (Terms, section 9). If you arrived through a creator's personal link, the creator's code is recorded with the purchase. If you make a free reply, we record that its link has been used, and for which gift, so that each link gives one free reply. For a gift card, we keep its code, the name and note you add for the recipient, and when and by which account it was redeemed. If you bought in our Etsy shop and type the order number, our servers ask Etsy about that order (whether it's paid, cancelled or refunded, and what it's for) and keep the order number, the item and its price; we receive no payment details and nothing of your Etsy account. We ask Etsy again each day for 100 days whether the order was refunded.

Ethos for Two: whether it's monthly, yearly or a pass; when it started, the period paid for and when it ends; whether it renews and whether a payment is outstanding; its invite code and, once the other person joins, which account joined; and a record of each payment. For a subscription, Stripe keeps a customer record for you (your name and email address, your billing address or country, and the card you pay with, which only Stripe sees) with the subscription's status and invoices, and we keep Stripe's identifiers for the customer and the subscription. For a membership bought in our iPhone app, we keep Apple's transaction identifiers, which reach us through RevenueCat.

Searches and helpers: when you search for a song, our servers send your search words to Apple's iTunes Search; when you paste a song link, they ask YouTube or Spotify for its title and cover. If you use “Help me write it”, what you type into it, with the occasion and the names on the gift, is sent to Anthropic to write the drafts; we don't store it.

Emails we send, and how to stop each one. Sign-in links and codes, and a welcome email when your account is made: only when you sign in or sign up. Receipts: one for each purchase, with a gift card's code or the Ethos for Two invite link when you buy one (for an Ethos for Two subscription, the welcome email is the confirmation); they are part of the purchase and can't be switched off.

Gift notifications, to the person who made the gift: when it is published or scheduled, when it is opened for the first time, when a scheduled gift opens, and when a reaction arrives. Deleting the gift stops them; to stop them for a gift you keep, reply to one of them or write to us.

Ethos for Two, to the person who pays: a welcome email with your plan and the invite link, which confirms your membership; for a yearly membership, an email a week before each renewal; an email if a payment doesn't go through or your bank asks you to confirm it; and one when the membership has ended (never after a refund or a withdrawal). These are service emails, part of the contract. For a one-year pass: the welcome email and one email 14 days before it ends, with the date and how to carry on; it comes once for each pass year, and to stop it, reply to it or write to us.

Reminders: if you ask us to remind you of a date, we store the name you give, the occasion, the day and month, your language, the gift's template and the year we last emailed you, linked to your account, and email you nine days before the date each year. For monthly reminders, we store the name you give, the day you got together, your language, and which monthly dates we asked you about, you said yes to and reminded you of; nothing is ever sent to the person you name. Each reminder email suggests one template for the occasion, and never includes anything from a gift you made. You can remove a reminder, or stop the monthly ones, from your account page or with the link in each email.

Date reminders: while you have Ethos for Two, a saved date with a day set sends you and your partner an email the day before, each in your own language, with its stops and notes. You can turn it off for each date in My dates, or with the link in the email.

The checkout reminder: only if you ask for it and then leave without paying, we send you one email with a link back to that checkout. You ask by ticking the box on Stripe's checkout page agreeing to hear from us, where Stripe shows one. It is never ticked for you, and you can pay without ticking it. It is one email, not a series: at most one to an address in any week, however many checkouts are left unpaid, and none if you've paid since. It has an unsubscribe link (your mail app may also show its own unsubscribe button); if you use it, we keep a one-way hash of your address (not the address itself) on a list we check before sending it, and ticking the box again on a later checkout doesn't take you off it.

Offers inside our emails: a receipt for single templates, three templates or “Make it special” may say what “Everything” would now cost you, and the emails about a first opening or a reaction may suggest a template for your next gift. If your address is on the unsubscribe list, we leave these out; to be added without a checkout reminder, reply to any of our emails or write to us. Apart from these, and the one launch email to people on the Ethos for Two waitlist (section 6), we send no other emails and no newsletters.

2. Data about people who open a gift

When a gift is opened, we record a pseudonymous visitor code, the type of device (iPhone or iPad, Android, computer or other), the time, and how much of the gift was watched, so the sender can see it arrived. The code is a one-way hash of your IP address and browser details together with the gift and the date; we don't store your IP address with it. Your browser keeps a note for 24 hours so that reloading doesn't count as a new open.

If you send a reaction, the emoji, note and voice message you choose to send are stored and shown to the sender, who also receives the emoji and the note by email. If you also tick the box agreeing that Ethos may show the reaction on its site without your name, we record that you did and when. We may then show its emoji and note on our site (never your voice message, your name or anything from the gift), only after we have read and approved it, not before seven days after you sent it, and never if the sender has asked us not to (the email telling them about it has a link to say so). To take it back, write to us with the gift's link. If a gift has a password, your browser keeps it, encrypted, in a cookie for up to a year so you don't have to type it again. We don't ask recipients for their name, and ask for an email address only if you want to keep the gift (below).

Keeping a gift: if you tap “Keep this gift” and give us your email address, we first send one email asking you to confirm it, which names nobody; nothing else is sent until you do, and if you haven't within seven days, we delete it. Once you confirm, we email you the gift's link and, if you ticked them, a reminder nine days before the sender's birthday, your anniversary or Valentine's Day, each year. These emails may name the sender by the first name the gift shows. We store your address and a one-way hash of it (to limit how many confirmations an address can be sent), the gift it's for, your language, the sentence you agreed to, when we asked and when you confirmed, and for each reminder the sender's first name as the gift shows it, the occasion, the day and month and the year we last emailed you. Apart from that first name and the gift's link, they include nothing from the gift; each reminder suggests one template. Every email has a link to unsubscribe, which deletes your address and reminders at once; the confirmation email also has a link to never be emailed about a kept gift again, which puts a one-way hash of the address on our unsubscribe list.

Some templates ask to use your microphone (for example to “blow out” candles) or your phone's motion sensors. That input is analysed on your device only; it isn't recorded or sent to us. If a gift includes a song from Apple Music or a song link, your browser loads the song's cover directly from Apple, YouTube or Spotify, which receive your IP address; an Apple Music preview is loaded from Apple only if you tap to hear it, and tapping a link opens that service under its own privacy policy.

3. Dates, maps, plans, trips and long distance

The Dates pages, plans and long-distance tools work without an account. To show places near you we need a location: a town you type, which our servers look up with Photon (run by komoot); the rough, city-level location our hosting provider works out from your connection, which we use only to open the map on your city and don't store; or, only if you press “Near me” and your browser agrees, your device's position. Your browser rounds a position to a grid of about a hundred metres before anything is sent to our servers. We don't store positions or link them to you, although, like any request, they can appear briefly in our host's technical logs. A search made with “Near me” is never written into the page's address. Your browser remembers the last area you searched, on your device only.

The map is drawn from OpenFreeMap: your browser downloads map tiles directly from tiles.openfreemap.org, which therefore receives your IP address, as any website you visit does. Photographs of places load directly from Wikimedia's servers, which also receive your IP address. To find places and show a place's details, the forecast or a town's name, our servers ask OpenFreeMap, Nominatim (run by the OpenStreetMap Foundation), public Overpass servers, Open-Meteo, Photon and Wikimedia (Wikipedia, Wikidata and Commons) and, where we have turned them on, Tripadvisor and Google for their ratings. Those requests carry only rounded coordinates, a place's name or the text you searched for, never your name, your IP address or anything about your device.

A plan you build is kept in your browser's local storage and is sent to us only if you save it to your account. When you share it, the plan travels inside the link itself, in the part after the “#”, which browsers don't send to servers: whoever has the link can read the plan, and we can't. Treat the link like the invitation it is. Links you follow from a place (directions, photos and reviews, Tripadvisor, Google, Yelp, a venue's website) open other services under their own privacy policies.

Saved dates and trips: if you save a date or a trip, we store it with your account: its title, the day, the places with their names and positions, the times, the notes and names you typed, and who last changed it and when. We keep it until you delete it or your account. While you share Ethos for Two, your partner can read and change your saved dates and trips and sees your name, and you see theirs; that stops as soon as you no longer share it.

Partner links: buttons to search flights, tickets or car hire go through Travelpayouts' redirect (tpm.lv) to the partner's site, such as Aviasales, Tiqets or Auto Europe. Only when you tap one does your browser go to them: they then receive your IP address and what any website receives, and the partner sets its own cookies, on its own site, to credit the booking to us. We don't load their scripts or set any cookie for them on our site, and what you search for or book there is between you and them, under their privacy policies.

4. Reviews

If you post a review, we store the place (its OpenStreetMap ID, name and position), your stars, cost, occasion and text, the language and the dates, linked to your account. Reviews are public: anyone can read them, with your first name (from your profile, for example from Google) or “Somebody”. Reviews are shown without any account ID, so nobody else can tell which reviews came from the same account, and we never show your email address. You can edit or delete a review at any time, and deleting your account deletes your reviews.

5. Games

Two-phone games use a room: a live channel on Supabase's realtime service, named after the room code. The names you enter, who is in the room, and the moves and drawings pass through Supabase's servers to the other phone in real time; they are not stored in our database, and the room disappears when both players leave. The names you enter are shown to the other player and remembered on your device for next time, and a random player ID is kept in your browser tab. In Memory, the photos you pick stay in your browser and are never uploaded. One-phone games run entirely on your device.

6. The waitlist and the creator programme

If you joined the waitlist for Ethos for Two, we store your email address, your language and when you joined. We use it only to send you one email when it launches. You can ask to be removed at any time by writing to support@secuora.xyz.

If you join our creator programme, we store your name, your contact details, your code (the part of your personal link that names you), your commission rate, the payout details you give us (such as a bank account or a payment service), the commissions we've paid you, and the sales made through your link: how many, their amounts, refunds and dates. We use them to run the programme, to pay you and for our accounts. We show you totals only, never who bought.

If you arrive through a creator's personal link and buy, the creator's code is recorded with your purchase so that we can pay their commission. Nothing is stored on your device for this: only the open tab remembers the link, and forgets it when it is closed or reloaded. The creator never learns who you are.

7. Analytics, error reports and logs

On every page, including gift pages, we use Vercel Web Analytics and Speed Insights to count visits and measure how fast pages load. They don't use cookies. They record things such as the page, the referring site, the approximate country, and the type of browser, device and operating system. Before anything is sent, gift links are shortened to “/g/[shortId]” and query strings are removed, except the ones that say where a visit came from (“ref” and “utm_”).

We also count a few named steps in the same cookieless analytics: opening the editor, seeing the publish screen, tapping to pay, completing a purchase, seeing an offer for a free template's extras or a game pack, ticking the box to add every template, tapping a partner link, saving a reminder, saving a date or a trip, seeing Ethos for Two offered where a saved date needs it, opening a whole date in Maps, starting a reply, tapping “Keep this gift” and asking for its link, moving through or skipping the “How it works” tour, and tapping a button on a city page. These events carry no personal data: at most a template, a product or plan, a game or pack, a partner, a maps app, a city page, a tour step, where a button sat, how many reminders were asked for, and yes-or-no facts such as whether you were signed in or a member, never who you are, a gift, a saved date or what's in them. A creator's link is counted the same way, by its code in the page address.

Microsoft Clarity (heatmaps and session recordings) runs only if you accept cookies in our banner, and never on gift pages, checkout, the dashboard or the account page. It records how you use our other pages, including the editor: clicks, taps, scrolling, mouse movements and what appears on screen. In the editor, what you type and upload is masked in these recordings, so the gift you're writing isn't captured. It uses cookies and is told not to use advertising storage. You can withdraw your consent at any time with “Stop cookies” in the footer: we then stop Clarity and delete its cookies.

The Meta pixel (Meta Platforms Ireland, for our ads on Facebook and Instagram) and the TikTok pixel (TikTok Technology Limited, Ireland, for our ads on TikTok) also run only if you accept cookies in our banner. They never run on gift pages, checkout, the dashboard or the account page, nor on sign-in or any page whose address opens something: a gift card code, a For Two invite, a shared plan or trip, your saved dates. On our other pages they tell Meta and TikTok which page you're on (its address, the page you came from and your browser's details), which template you look at or open in the editor and whether it's free or premium, when you see a price, when you tap to pay, and when you buy: the amount, the currency and what you bought. We use this to see which of our ads lead to purchases and to show our ads again to people who opened a gift and didn't buy it; Meta and TikTok use it to show our ads to people likely to be interested, and can link it to your account with them if you have one. They set their own cookies (section 12). We switch off their automatic collection (taps, form fields and page details) where they let us, and stop them sending anything from the pages above.

When you buy after accepting, our server also reports that purchase to Meta (its Conversions API) and TikTok (its Events API), so it still counts once if your browser didn't report it: the amount, the currency and what you bought, your email address as a one-way hash (SHA-256) and, to Meta, your country the same way, their identifiers for your ad click and your browser, and your browser's user agent. Never your name, your address, a gift or anything in it. If you didn't accept, no purchase of yours is reported. You can withdraw your consent at any time with “Stop cookies” in the footer: we then stop the pixels, delete their cookies, and report none of your later purchases.

If something breaks in your browser, the page reports the error to our own server: the error message and a code, the page path (with no query string, and with gift links shortened), the template and your browser's user agent. It goes into our hosting logs and nowhere else.

Like any website, our host logs technical details of each request, such as IP address, browser, the address requested and the time, to run and secure the Service. To prevent abuse, we also count requests from each IP address (or, for the writing helper, each account) for up to an hour.

8. Why we use data, and our legal bases

To provide what you ask for (accounts and sign-in; creating, hosting and delivering gifts; passing reactions and view statistics to senders; purchases, Ethos for Two and gift cards; saved dates, and sharing them with your partner; service emails; reminders you ask for; reviews; game rooms; the writing helper; the Dates features; and, if you're a creator, running the programme and paying you): performance of our contract with you (Art. 6(1)(b) GDPR). Where we have no contract with you, for example when you open a gift someone sent you, our legitimate interest, and the sender's, in delivering the gift and its reactions (Art. 6(1)(f)).

To keep the Service secure and working, prevent fraud and abuse, keep reviews genuine, enforce our terms, fix errors, measure use with cookieless analytics, mention related offers in the service emails we send you anyway, and establish or defend legal claims: our legitimate interests (Art. 6(1)(f)). You can object to this (section 13).

Microsoft Clarity, the Meta and TikTok pixels and the purchase reports to them, the waitlist and checkout reminder emails, the emails about a gift you keep, and showing your reaction on our site: your consent (Art. 6(1)(a)), given in our cookie banner, on the waitlist form, with the box on Stripe's checkout page, on the page “Keep this gift” opens (and confirmed by email), or with the box when you send a reaction. You can withdraw it at any time (for emails, with the unsubscribe link; for a reaction, by writing to us); withdrawing doesn't affect what happened before.

To meet legal obligations, such as accounting and tax rules (which is why purchase records and creators' payouts are kept) and consumer law (which is why we keep the record of your request to unlock a purchase straight away), and to handle reports and orders under the Digital Services Act: Art. 6(1)(c).

9. Who we share data with

Service providers that process data for us under data-processing agreements: Vercel (hosting, content delivery, logs, cookieless analytics and the approximate location of your connection); Supabase (database, sign-in, file storage and game rooms; our project is hosted in the EU, in Ireland); Stripe (payments and subscriptions); Resend (sending our emails); RevenueCat (purchases made in our iPhone app); Microsoft (Clarity, only with your consent); and Anthropic (the writing helper, only when you use it).

Companies that act as independent controllers under their own privacy policies: Stripe, for its own fraud-prevention and legal duties; Apple, for purchases and subscriptions made in our iPhone app, which it sells and bills; Etsy, for purchases made in our Etsy shop, which it sells and bills; Google or Apple, if you sign in with them; Travelpayouts and the travel partners it links to, only when you tap a partner link; and the map, data and media services named in sections 1 to 3, which receive your IP address when your browser loads something directly from them (map tiles, photographs, song previews and covers). Our servers send them no personal data.

Meta Platforms Ireland (Facebook and Instagram) and TikTok Technology Limited (Ireland), only if you accept cookies in our banner: the pixels and the purchase reports described in section 7. For collecting that data and sending it to them, each of them and we are joint controllers; what they do with it afterwards is under their own privacy policies, and requests about that go to them.

We don't sell or rent personal data, and we use it for advertising only as section 7 describes: the Meta and TikTok pixels and purchase reports, with your consent. Creators see how many sales were made through their link and their value, never who bought. We disclose data to authorities only where the law requires it. If the Service or our company passes to a new owner, your data may go with it, under this policy.

10. Transfers outside the EEA

Some of these providers are based in the United States or may access data from outside the European Economic Area. Where they do, the transfer is covered by the EU–US Data Privacy Framework, for providers certified under it, or by the European Commission's Standard Contractual Clauses. You can ask us for details.

11. How long we keep data

Your account: until you delete it. Drafts saved to your account: deleted automatically after 7 days without edits. Uploaded files that no gift uses: deleted after 24 hours; once a gift has been opened, older versions of its files that it no longer uses are deleted too.

Published and scheduled gifts, their files, view records and reactions: until you delete the gift or your account. Deleting removes the files from storage and the records from our database straight away; copies in routine backups expire within 30 days.

Reviews, and saved dates and trips: until you delete them or your account. Waitlist: until we've sent the launch email (then deleted within three months), until you ask us to remove you, or at most 24 months after you joined if it hasn't launched. Reminders: until you remove them or delete your account. A kept gift: an address never confirmed, seven days; a confirmed one, with its reminders, until you unsubscribe or the gift is deleted. The unsubscribe list: the hash of your address, for as long as we send the checkout reminder, offers inside our emails or emails about kept gifts.

Purchases: accounting and tax law require us to keep a record of every sale (generally for five years in Latvia, and up to ten years for VAT records). When you delete your account, your purchases stay in our database for that long, but no longer linked to you: what was bought, when, the amount, the creator's code if there was one, the record of your request to unlock it straight away, a gift card's details and Stripe's identifiers. Ethos for Two's records (its plan, its dates and a record of each payment) are kept the same way, and so is the customer record Stripe keeps for a subscription, which is then deleted. Creator programme: for as long as you take part, then for as long as accounting and tax law requires for the commissions we paid.

Logs and security: rate-limit counters, up to 1 hour; hosting logs and error reports, up to 30 days; sign-in and security records, up to 12 months. Microsoft keeps Clarity data for the periods it sets, currently up to 13 months; Meta and TikTok keep what the pixels and the purchase reports send them for the periods their own policies set. Data stored in your browser (section 12) stays until it expires or you clear it.

12. Cookies and similar technologies

Necessary cookies, which don't need consent: the sign-in cookies set by Supabase (sb-…-auth-token), which keep you signed in until you sign out or the session ends; auth_next, which remembers where to take you after signing in (10 minutes); ETHOS_LOCALE, which remembers your language (1 year); and ethos_gift_…, which remembers, encrypted, a gift password you entered (1 year, only on that gift's page).

Browser storage on your device that makes features work: your cookie choice (ethos-consent); editor drafts and their media; your last Dates search area, your plan, which saved date it's linked to, and the airport you last searched flights from; game names and a player ID; a 24-hour note of gifts you've opened; and short-lived notes when you reply to a gift you received, start a gift from a trip, sign in to save a plan (so it saves itself once you're back), or come back from paying (so the purchase is counted once, and, if you accepted cookies, kept in that tab until the ad pixels report it). None of this is sent to us by itself.

Analytics and advertising cookies, only with your consent: Microsoft Clarity's cookies (_clck and _clsk) and a session-storage entry; the Meta pixel's _fbp (90 days) and, when you arrive from one of our ads, _fbc (90 days); and the TikTok pixel's _ttp and _tt_enable_cookie (13 months), its session cookies (ttcsid…) and, when you arrive from one of our ads, ttclid. When you arrive from one of our ads, we also keep which ad it was in your browser's storage (ethos-ref, 7 days), so a purchase you come back to make is still counted to that ad; saying no, or stopping cookies later, removes it. If you tick the box to pay with Apple Pay or Google Pay on the pay sheet, Stripe's payment script loads on our page and sets the cookies Stripe needs to take the payment safely and stop fraud (__stripe_mid, 1 year; __stripe_sid, 30 minutes); they come with the payment you asked for, so they don't wait for the cookie question. Stripe's checkout pages, Google's or Apple's sign-in pages and the travel partners' sites you reach through a partner link set their own cookies on their own sites. You can change your choice at any time with “Allow cookies” or “Stop cookies” in the footer.

13. Your rights

You have the right to access your data and get a copy, to have it corrected or erased, to restrict its use, to data portability, to object to processing based on our legitimate interests, and to withdraw consent at any time. Your account page lets you download your data (account, gifts, purchases, unlocks, Ethos for Two, saved dates and trips, gift cards you bought, reminders, views, reactions, reviews and waitlist sign-up, as a JSON file) and delete your account, and your reminders page lists and removes your reminders; for anything else, write to support@secuora.xyz.

We answer within one month, or within three months for complex requests, in which case we'll tell you why. It's free, and we may ask you to confirm your identity first. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

You can complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv) or to the supervisory authority where you live or work. We'd welcome the chance to help first.

Recipients who want a reaction or view record removed can write to us with the gift link; we'll remove it and tell the sender it was withdrawn. If a gift or review contains information about you that you want taken down, you can also report it as section 13 of our Terms of Service explains.

14. Children

The Service isn't directed at children. You must be at least 16 to create an account, post a review or buy, and we don't knowingly collect data from younger children; if we learn that an account belongs to someone under 16, we delete it. Photos and names of children may appear in gifts made by their family: the sender is responsible for having the right to share them, should include only what the gift needs, and should leave out anything that could identify or locate a child to strangers, such as a school or an address. Remember that anyone with the link can open a gift.

15. Security

Data is encrypted in transit and at rest. Uploaded files live in private storage and are served through signed links that expire, and gift passwords are stored only as secure hashes. Access to production systems is limited to people who need it and protected with multi-factor authentication. No system is perfectly secure: if a breach puts your data at risk, we'll act at once and inform you and the authorities as the law requires.

16. Changes and contact

We'll post updates here and email account holders about material changes. Contact: SIA "MIGLAI", "Reķu sala 4", Upesciems, Garkalnes pagasts, Ropažu novads, LV-2137, Latvia, support@secuora.xyz.