Privacy.

Who we are.

UNCARD is run by [legal entity name] in [location]. The contact address is not set: [contact email]. The bracketed address is not a working request channel. See the Terms for making and giving.

What we keep.

We store accounts, conversations, supplied facts and exclusions, drafts, edits, versions and ordinary AI requests and responses so an uncard can be made and repaired. Model, instruction-version, token, time, result and cost records help us diagnose failures and improve the service. These records can contain personal details. Staff may read them for those purposes; exclusions are still visible to necessary processing.

• Account email, chosen display name, sign-in method, age confirmation and any birthday you provide for eligibility. Making requires 13 or older; accounts are unavailable under 13, so a parent or guardian holds the account for a younger child.
• Secure sign-in tokens in an essential cookie, renewed on visits for up to 400 days under the existing session policy. You can sign out on this device or everywhere. This browser may remember the last sign-in method and email; its preference can be cleared.
• Former invitation email and a private team note, plus access and pause records.
• Your supplied facts, exclusions, drafts, versions and exact ordinary AI requests and answers. Do not provide sensitive details.
• Control and accounting identifiers, counts, times, errors, model usage and available costs. Historical access records contain account, uncard, build, call and configuration identifiers and counts, rather than recipient content.

An operational export is designed to copy service records to separate storage for analysis. Omitting explicit profile email/name/private-note/PIN fields does not remove personal details inside birthday content or AI payloads. Restricted hidden evaluation content is excluded. The export’s live operation and deletion coverage need verification before being described as running.

Measurement and advertising.

Optional measurement and advertising remain disabled pending approval and operational checks. Measurement helps understand the service. Advertising measures campaigns and reaches potential senders; it does not place ads inside an uncard. Reject optional turns both off. Do not sell or share my information turns advertising off without turning measurement on or renewing its timestamp. Global Privacy Control also keeps advertising off. A failed or conflicting save is not consent, and optional processing pauses until the choice is confirmed.

Measurement properties use bounded identifiers, categories, counts and times rather than birthday words, names, email, raw IP address, raw user agent or full page/referrer addresses. Errors use codes. These restrictions do not mean the separate operational content and AI records are anonymous.

Experiments, when approved, can record which permitted version was shown with measurement. Arrival categories can describe a search engine, campaign or uncard link without retaining the referring address or search words.

Google Analytics would be limited to approved uncard.app pages after a measurement choice. It must exclude uncards, /mine and /admin, full addresses, account details and birthday contents. Page names and allowed campaign categories are separate from content records. [Google settings, cookies, location/browser data and terms: owner and counsel to confirm before activation.]

Opening an uncard.

A recipient needs no account. No third-party script or advertisement runs inside an uncard. Existing daily totals count opens, finishes and moments without a visitor identifier, and count link-preview requests separately by app. Optional recipient measurement remains disabled. Any later approval would need to explain bounded event types, coarse device/browser/location categories, session and edition identifiers, permitted browser or account identifiers, and retention. No optional collection or advertising is permitted for kid-mode uncards. Broader recipient interaction and timing coverage has not been verified.

The server decides access, kid mode and geography. IP address and browser information may be read briefly to derive coarse categories without storing the raw values in recipient measurements. A refusal does not block playback or authorise new collection.

Service providers.

• Lovable hosts the app, and Lovable Cloud, built on Supabase, holds the database. [Storage locations and international transfers: owner and counsel to confirm.]
• The Lovable AI gateway and its model providers process supplied words and generated answers. [Enabled model providers and their data terms: owner and counsel to confirm.]
• Cloudflare provides the delivery infrastructure for uncard.gifts and is the intended host for a separate operational export. Its deployed storage and export arrangements still need verification.
• Google processes sign-in when you choose Google. Emailed sign-in links also use an email delivery service. [Email provider and terms: owner to confirm.]
• Apple sign-in and passkeys require updated provider and credential disclosures before later activation; they are not described here as enabled.

Necessary staff and providers may read birthday content to run, repair and improve the service. [Provider processing restrictions, locations and terms: counsel to confirm.]

Possible advertising providers.

Meta, Google Ads and TikTok are possible future advertising providers and remain disabled. If approved, permitted events could include event/page categories, relevant purchase value, platform matching identifiers and a retry identifier. With an advertising choice, IP address and browser information may be forwarded for matching without being stored by Uncard. Uncard addresses, titles, names and words must be excluded. Recipient and sender processing have separate controls. Withdrawal stops future admission and does not remove records already received by a provider. [Provider terms, retention, transfers, matching requirements and legal classification: counsel to confirm.]

Retention.

Drafts, versions, conversations and ordinary AI records have no automatic expiry by default; they remain until deletion or an applicable exception. A closed hosting link is not deletion. The intended retention target for raw measurements is 13 months, with daily totals potentially kept longer. Separate operational copies may contain the same personal content as the original records. [Deployed retention, backup replacement and legal exceptions: owner and counsel to confirm.]

Choices and requests.

Optional measurement and advertising remain disabled pending approval and operational checks. Measurement helps understand the service. Advertising measures campaigns and reaches potential senders; it does not place ads inside an uncard. Reject optional turns both off. Do not sell or share my information turns advertising off without turning measurement on or renewing its timestamp. Global Privacy Control also keeps advertising off. A failed or conflicting save is not consent, and optional processing pauses until the choice is confirmed.

Access, export, correction, deletion and removal requests are intended to be handled by the team through [contact email]. That address is not set, so this is not a working request channel or a self-service export promise. Account deletion is owner-operated. It removes linked drafts, uncards, AI records, claims, saves, test-window identifiers, uploaded files and the sign-in record under the applicable deletion procedure. Another giver’s uncard remains when a recipient deletes their account. Separate exported copies must also be erased; deployment and restoration procedures need verification. A minimal account-ID/date/count record prevents a backup restore bringing deleted information back. Older backups retain data until replaced. [Rights, legal basis, response period, backup schedules and payment/security retention exceptions: counsel and owner to confirm.]

Preference storage.

The essential uc_consent preference cookie can remember a refusal in this browser for 12 calendar months. Where account preference storage is available, a confirmed signed-in refusal is saved to the account too. A browser refusal can reduce an account’s permissions; it cannot give permission on behalf of an account. Reads do not renew the choice. Consent and any later optional visitor cookie use Secure, HttpOnly and SameSite=Lax settings and are separate on each host.

An optional uc_vid browser identifier would last at most 13 calendar months only where a permitted measurement choice and the server’s checks allow it. This feature remains disabled. uncard.gifts has no sign-in and does not inherit the uncard.app account choice. Expiry or cookie deletion may require another choice; neither blocks opening an uncard.

Children.

Whoever makes an uncard may supply a child’s details for a birthday. Those details are necessarily processed to make and repair it and may be in operational and AI records. They must not be reused for advertising. Kid-mode uncards are excluded from customer gallery listings, even with guardian permission. Broader child-data reuse and account safeguards remain launch review items. Making requires 13 or older; no account is available under 13, so a parent or guardian holds the account for a younger child. Eligible recipients aged 13–17 can claim and save under the recipient account rules.

Prices and hosting.

Future prices are CA$5.99 for one uncard, CA$9.99 a month for two uncards per paid month, and CA$2.99 for a subscriber extra. Unused included uncards roll over only while subscribed. Links are free during launch. [Taxes, refund rules and payment terms: counsel and owner to confirm before checkout opens.]

Three months of hosting from giving. It also stays live while an eligible giver, or a recipient who has claimed and saved it, has an active subscription. An eligible subscription can belong to the giver or a recipient who has claimed and saved the uncard. Cancelling at the end of a paid period keeps that period. An eligible late payment has three days of grace for hosting only; it does not provide new uncards, purchases or rollover eligibility. Closing a link does not delete its records.

Changes.

We update this page and its date when practices change. [How material changes will be communicated: owner and counsel to confirm.]