What we collect and why.

Details to confirm.

This guide is not yet in effect. Optional measurement and advertising remain off. Preparing these words does not change what is collected. Read it with the Privacy notice and Terms.

Making and opening.

Future prices are CA$5.99 for one uncard, CA$9.99 a month for two uncards per paid month, and CA$2.99 for a subscriber extra. Unused included uncards roll over only while subscribed. Links are free during launch. [Taxes, refund rules and payment terms: counsel and owner to confirm before checkout opens.]

Three months of hosting from giving. It also stays live while an eligible giver, or a recipient who has claimed and saved it, has an active subscription. An eligible subscription can belong to the giver or a recipient who has claimed and saved the uncard. Cancelling at the end of a paid period keeps that period. An eligible late payment has three days of grace for hosting only; it does not provide new uncards, purchases or rollover eligibility. Closing a link does not delete its records.

We store accounts, conversations, supplied facts and exclusions, drafts, edits, versions and ordinary AI requests and responses so an uncard can be made and repaired. Model, instruction-version, token, time, result and cost records help us diagnose failures and improve the service. These records can contain personal details. Staff may read them for those purposes; exclusions are still visible to necessary processing.

A recipient needs no account. No third-party script or advertisement runs inside an uncard. Existing daily totals count opens, finishes and moments without a visitor identifier, and count link-preview requests separately by app. Optional recipient measurement remains disabled. Any later approval would need to explain bounded event types, coarse device/browser/location categories, session and edition identifiers, permitted browser or account identifiers, and retention. No optional collection or advertising is permitted for kid-mode uncards. Broader recipient interaction and timing coverage has not been verified.

Your choices.

Measurement properties use bounded identifiers, categories, counts and times rather than birthday words, names, email, raw IP address, raw user agent or full page/referrer addresses. Errors use codes. These restrictions do not mean the separate operational content and AI records are anonymous.

An optional uc_vid browser identifier would last at most 13 calendar months only where a permitted measurement choice and the server’s checks allow it. This feature remains disabled. uncard.gifts has no sign-in and does not inherit the uncard.app account choice. Expiry or cookie deletion may require another choice; neither blocks opening an uncard.

Optional measurement and advertising remain disabled pending approval and operational checks. Measurement helps understand the service. Advertising measures campaigns and reaches potential senders; it does not place ads inside an uncard. Reject optional turns both off. Do not sell or share my information turns advertising off without turning measurement on or renewing its timestamp. Global Privacy Control also keeps advertising off. A failed or conflicting save is not consent, and optional processing pauses until the choice is confirmed.

The essential uc_consent preference cookie can remember a refusal in this browser for 12 calendar months. Where account preference storage is available, a confirmed signed-in refusal is saved to the account too. A browser refusal can reduce an account’s permissions; it cannot give permission on behalf of an account. Reads do not renew the choice. Consent and any later optional visitor cookie use Secure, HttpOnly and SameSite=Lax settings and are separate on each host.

Privacy choices in the site footer reopens controls. A successful browser-only refusal says “Your choice is saved in this browser.” Account storage is confirmed separately. Nothing optional is switched on here, so there is nothing to choose while the service is closed.

After separate approval, the proposed regional policy requires a choice first in the EU/EEA, UK, Switzerland and Quebec; elsewhere it proposes a notice with opt-out. Unknown geography denies optional processing. [Any pre-choice processing: counsel to decide before activation.]

Who could receive information.

Cloudflare provides the delivery infrastructure for uncard.gifts and is the intended host for a separate operational export. Its deployed storage and export arrangements still need verification.

Meta, Google Ads and TikTok are possible future advertising providers and remain disabled. If approved, permitted events could include event/page categories, relevant purchase value, platform matching identifiers and a retry identifier. With an advertising choice, IP address and browser information may be forwarded for matching without being stored by Uncard. Uncard addresses, titles, names and words must be excluded. Recipient and sender processing have separate controls. Withdrawal stops future admission and does not remove records already received by a provider. [Provider terms, retention, transfers, matching requirements and legal classification: counsel to confirm.]

Google Analytics would be limited to approved uncard.app pages after a measurement choice. It must exclude uncards, /mine and /admin, full addresses, account details and birthday contents. Page names and allowed campaign categories are separate from content records. [Google settings, cookies, location/browser data and terms: owner and counsel to confirm before activation.]

What remains.

An operational export is designed to copy service records to separate storage for analysis. Omitting explicit profile email/name/private-note/PIN fields does not remove personal details inside birthday content or AI payloads. Restricted hidden evaluation content is excluded. The export’s live operation and deletion coverage need verification before being described as running.

Drafts, versions, conversations and ordinary AI records have no automatic expiry by default; they remain until deletion or an applicable exception. A closed hosting link is not deletion. The intended retention target for raw measurements is 13 months, with daily totals potentially kept longer. Separate operational copies may contain the same personal content as the original records. [Deployed retention, backup replacement and legal exceptions: owner and counsel to confirm.]

Requests and deletion.

Access, export, correction, deletion and removal requests are intended to be handled by the team through [contact email]. That address is not set, so this is not a working request channel or a self-service export promise. Account deletion is owner-operated. It removes linked drafts, uncards, AI records, claims, saves, test-window identifiers, uploaded files and the sign-in record under the applicable deletion procedure. Another giver’s uncard remains when a recipient deletes their account. Separate exported copies must also be erased; deployment and restoration procedures need verification. A minimal account-ID/date/count record prevents a backup restore bringing deleted information back. Older backups retain data until replaced. [Rights, legal basis, response period, backup schedules and payment/security retention exceptions: counsel and owner to confirm.]