1. Data we collect from senders

Account data: your email address, your name if you give it, your chosen language, sign-in tokens, and — if you sign in with Google or Apple — the identifier and basic profile those providers share.

Gift content: the names, messages, photos, audio, video, captions, dates and settings you add to a gift. Photos are resized and re-encoded on your device before upload; we don't keep the originals or their metadata (EXIF, location).

Purchase data: what you bought, when, the amount and currency, and Stripe's identifiers for the transaction. Your card details go directly to Stripe; we never receive them.

Technical and usage data: IP address, browser and device type, pages visited and actions taken, error reports. Product analytics are collected only with your consent (see Cookies).

2. Data we collect from recipients

When a gift is opened we record an anonymous identifier (a one-way hash that isn't linked to your name or exact IP address), the device type, the time and how far the gift was watched, so the sender can see it was received. If you send a reaction, the emoji, text or voice recording you submit is stored and shown to the sender only. We don't ask recipients for their name or email.

3. Why we process it and on what legal basis

To provide the Service — creating and hosting gifts, delivering them to recipients, showing reactions and statistics to senders, processing purchases: performance of a contract (Art. 6(1)(b) GDPR).

To keep the Service secure, prevent abuse, and enforce our terms: our legitimate interests (Art. 6(1)(f)).

To send transactional email — sign-in links, receipts, 'your gift was opened', 'you received a reaction', scheduled-gift reminders: performance of a contract. You can switch notification emails off in your account.

Product analytics and any marketing email: your consent (Art. 6(1)(a)), which you can withdraw at any time.

To meet legal obligations such as accounting and tax rules: Art. 6(1)(c).

4. Who we share data with

We use service providers who process data on our behalf under data-processing agreements: Supabase (database, authentication and file storage), Vercel (hosting and delivery), Stripe (payments), Resend (transactional email), PostHog (product analytics, only with consent), Sentry (error monitoring) and Anthropic (the optional 'help me write it' feature — only the facts you type into that dialog are sent, and only when you use it). Some providers process data in the United States; transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We don't sell personal data. We disclose data to authorities only where the law requires it.

5. How long we keep it

Gifts and their content stay until you delete them or your account. Deleted accounts and gifts are removed within 30 days, then from backups within a further 30 days. View statistics are kept for as long as the gift exists. Purchase records are kept for the period Latvian accounting law requires (currently five years). Sign-in logs and security data are kept for up to 12 months.

6. Your rights

You can access, correct, export (in a portable format) or delete your data, restrict or object to certain processing, and withdraw consent, from your account page or by emailing us. We answer within one month. You can also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv) or the supervisory authority where you live.

Recipients who want a reaction or view record removed can write to us with the gift link; we'll remove it and tell the sender it was withdrawn.

7. Cookies and similar technologies

Strictly necessary cookies keep you signed in, remember your language and protect against abuse; they don't need consent. Analytics cookies (PostHog) are set only after you accept them in the cookie banner, and you can change your mind from the footer at any time. We don't use advertising cookies.

8. Children

The Service isn't directed at children under 16, and we don't knowingly collect their data. Photos of children may appear in gifts made by adults; the sender is responsible for having the right to share them.

9. Security

Data is encrypted in transit and at rest. Uploaded files live in private storage and are served through short-lived signed links. Access to production systems is limited to people who need it and protected with multi-factor authentication.

10. Changes and contact

We'll post updates here and email account holders about material changes. Contact: SIA "MIGLAI", "Reķu sala 4", Upesciems, Garkalnes pagasts, Ropažu novads, LV-2137, Latvia, hello@tryethos.io.