Draft policy pending owner and legal review. Not yet in effect.
DRAFT — not legal advice — requires owner and legal review before publication.
Placeholders in [OWNER: …] must be completed. Sections marked "if enabled" apply only if that market is turned on. Research basis: docs/compliance/COMPLIANCE_RESEARCH.md.
Privacy Policy
Last updated: [OWNER: date]
"Our Year Together" ("we", "us") is operated by [OWNER: legal business name], [OWNER: business address], [OWNER: province/state, country].
Privacy contact / person in charge of the protection of personal information: [OWNER: name or title], [OWNER: privacy email], [OWNER: mailing address].
1. What this service does
You (the buyer, 18 or older) answer up to 15 questions and may add photos to create a personalized keepsake for your partner. You can preview it for free. If you pay, we unlock the full keepsake, a downloadable PDF, a QR code, a downloadable backup file, and a private gift link we host for a limited time.
We do not use artificial intelligence, we do not sell your information, and we never use your answers or photos for marketing or to train any model.
2. Information we collect
| Category | Examples | Where it comes from | Why |
|---|---|---|---|
| Your keepsake content | Your answers, names or nicknames you type, dates, and photos you upload (which may show you, your partner or others) | You | To build, show, publish and back up your keepsake |
| Account information | Email address; if you choose Google or Apple sign-in [OWNER: only if enabled], the name/email that provider shares | You / sign-in provider | To sign you in, save your keepsake to one account, and send service emails |
| Order information | Stripe customer, checkout session and payment IDs; amount; currency; tax; payment status; country (and province/state if needed for tax) from Stripe | Stripe | To confirm payment, unlock access, handle refunds and keep tax and accounting records |
| Gift link information | Link status (active, revoked, expired), publication date, expiry date | Generated by us | To run and expire the hosted gift link |
| Reports | Content of a "Report this gift" form and any email address the reporter gives | The person reporting | To review and act on reports |
| Support messages | What you write to us | You | To answer you |
| Technical data | IP address, browser type, timestamps, error logs | Your device, our providers | Security, abuse prevention, troubleshooting |
We do not receive or store card numbers. Payments are processed by Stripe on its own hosted page.
About your partner and others in photos: your keepsake may contain information about your partner or other people. Please only include content you have the right to share and that they would reasonably expect you to share in a private gift.
Sensitive content: a romantic keepsake can reveal personal details about a relationship. Only include what you are comfortable sharing with anyone who has the gift link. [OWNER/LAWYER: decide whether to collect explicit consent for sensitive information at upload — see research §4 item 11]
3. How your information moves through the service
- Before you sign in, your draft (answers and photos) stays only in your browser (IndexedDB). We do not receive it.
- When you sign in by email, the sign-in link may open in a different browser. So, just before we send the link, we copy your draft temporarily to our private storage so it can be claimed after sign-in. It is protected by a random single-use code that we store only in hashed form. Unclaimed staged drafts are deleted after [OWNER: confirm — proposed 24 hours].
- After you sign in, your draft is saved to your account so you can continue on any device.
- After you pay and publish, a copy of your keepsake is stored as a published version that anyone with the gift link can view until the link expires or you revoke it.
4. Why we use your information (and legal basis where required)
- To provide the service you asked for (create, save, preview, sell, deliver, host and back up your keepsake) — necessary for our contract with you.
- To send service emails (sign-in codes, receipt, publication confirmation, hosting-expiry reminders 14 and 3 days before expiry) — necessary for the contract. These are not marketing. [OWNER: if marketing emails are ever added, they require separate opt-in consent and an unsubscribe link]
- To keep accounting and tax records — legal obligation.
- To keep the service secure, prevent abuse and handle reports — our legitimate interests / legal obligations.
5. Who we share it with (service providers)
We use these providers only to run the service. They process data on our instructions.
| Provider | Role | Data | Location |
|---|---|---|---|
| Vercel Inc. (hosting, Pro plan) | Website hosting and server functions | Requests, IP, logs | [OWNER: region(s)] |
| Supabase | Sign-in and database (account, orders, keepsake records) | Email, account ID, order records, keepsake text [OWNER: confirm what is stored in DB vs. R2] | [OWNER: chosen Supabase region] |
| Cloudflare R2 | Private file storage | Photos, staged drafts, published snapshots, PDFs/backups | [OWNER: R2 location/jurisdiction setting] |
| Stripe | Payments and (if enabled) tax calculation | Name, email, billing address/country, payment details (held by Stripe) | Stripe's locations [OWNER: link Stripe privacy policy] |
| Resend [OWNER: confirm] | Transactional email | Email address, email content | [OWNER: region] |
| Google / Apple [OWNER: only if enabled] | Optional sign-in | Account identifier, email | Provider's locations |
We do not use analytics, advertising pixels or session recording. [OWNER: if an ad pixel is later added to the landing page only, update this policy and COOKIES_AND_STORAGE.md first and obtain consent where required.]
We may disclose information if required by law, to protect people from harm, or as part of a sale or reorganization of the business (with notice to you).
Who can see your keepsake: anyone who has the active gift link. The link is not listed in search engines (we ask them not to index it), but it is not password-protected. You can revoke or replace the link at any time; only one link is active at a time.
6. International transfers
Our providers may store or process information outside your province or country, including in the United States [OWNER: confirm per provider]. Information stored abroad may be accessible to authorities there under local law. We use contractual protections with our providers [OWNER: confirm DPAs/SCCs signed].
- Quebec residents (if enabled): we complete a privacy impact assessment before communicating your information outside Québec, and transfers are covered by written agreements. [OWNER: complete PIA before enabling Quebec]
- EU/UK residents (if enabled): transfers rely on [OWNER/LAWYER: EU-US Data Privacy Framework / Standard Contractual Clauses / UK IDTA or Addendum].
7. How long we keep it
| Data | Retention |
|---|---|
| Guest draft in your browser | Until you clear it or your browser deletes it (we cannot see or delete it) |
| Temporarily staged draft (unclaimed) | [OWNER: proposed 24 hours] |
| Unpaid signed-in draft | [OWNER: not decided] |
| Paid keepsake and photos after gift link expires | [OWNER: not decided] — hosting expiry does not by itself delete your data |
| Account after expiry (to allow recovery/re-download) | [OWNER: not decided] |
| Permanent deletion after a deletion request | Within [OWNER: not decided], except backups which roll off within [OWNER: not decided] |
| Order, payment and tax records | [OWNER/ACCOUNTANT: as required by tax law, e.g. CRA record-keeping period] |
| Reports and moderation records | [OWNER: not decided] |
| Security logs | [OWNER: not decided] |
Copies you or others downloaded (PDF, backup file, screenshots) are outside our control and are not deleted by us.
8. Your rights
Depending on where you live, you may ask to access, correct, delete, export (portability), or withdraw consent for your information, and you may complain to a regulator. See DELETION_AND_PRIVACY_REQUESTS.md for how. We respond within [OWNER: target] and no later than the legal deadline (e.g., 30 days under PIPEDA and Quebec law, one month under GDPR, extendable where the law allows).
Regulators: Office of the Privacy Commissioner of Canada (priv.gc.ca); provincial commissioners (e.g., Alberta OIPC, BC OIPC); Quebec Commission d'accès à l'information (if enabled); your EU supervisory authority or the UK ICO (if enabled).
Quebec (if enabled)
- Person in charge of the protection of personal information: [OWNER: title and contact — must be published].
- We do not use technology that identifies, locates or profiles you. If we ever do, it will be off by default and you will be told how to turn it on.
- You may request de-indexing or cessation of dissemination where the law allows, and portability in a structured, commonly used format.
EU / UK (if enabled)
- Controller: [OWNER: legal business name]. EU representative: [OWNER: name, address — required under GDPR Art. 27 unless exempt]. UK representative: [OWNER: name, address].
- Legal bases: contract (service), legal obligation (tax), legitimate interests (security, abuse handling). [LAWYER: Art. 9 analysis for content revealing sex life/sexual orientation]
- You may object to processing based on legitimate interests and lodge a complaint with your supervisory authority.
9. Security
We use encryption in transit, private (non-public) storage for photos, access controls, hashed single-use tokens, and revocable links. No system is perfectly secure. If a breach affects you and creates a real risk of significant harm, we will notify you as required by law (see INCIDENT_RESPONSE.md).
10. Age
This service is for people 18 and older. We do not knowingly collect information from children. Do not upload content depicting minors in any sexual or inappropriate way (see Terms).
11. Changes
We will post updates here and, for material changes, notify account holders by email before they take effect.
12. Contact
[OWNER: privacy email] · [OWNER: mailing address]