Skip to content
Happy BirthdayLodu

Privacy policy

Last updated 20 August 2026.

What we collect

  • From the person booking: your name, email address, an optional phone number, and the message you write.
  • The uploaded photo, stored in Supabase Storage.
  • Payment details you send us: the UPI reference number your payment app gave you, and the screenshot you upload as proof. The screenshot is stored privately, is never published, and is only ever opened by us to check the payment against our bank statement. We never see your UPI PIN, your bank login or your card details — the transfer happens entirely inside your own payment app.
  • Your IP address, recorded against the consent you gave and used for rate limiting and abuse investigation.

Why we collect it

To display your card, to email you about your booking, to take payment, to review content for abuse, and to respond if someone reports it. We do not sell any of this, and we do not run third-party advertising trackers.

Photos of other people

You are uploading someone else's face, so this matters: if you are in a photo on this site and you did not agree to it, tell us and we will remove it. Use the report button on the card, or email us. We do not require you to prove who you are before taking something down.

How long we keep things

  • Photos are deleted from storage as soon as a card is rejected or removed.
  • Otherwise, photos and clips are deleted automatically 24 hours after the card's day ends. Nobody has to ask.
  • The card itself — the name, the message and the day it ran — stays on the wall of fame without its pictures, until you ask us to delete that too.
  • Payment records are retained as long as tax law requires.
  • Rate-limit records are short-lived and expire automatically.

Who processes your data

  • Supabase: database and image storage.
  • Cloudflare R2: media and payment screenshot storage.
  • Resend: transactional email.
  • Vercel: hosting and edge delivery.

Your rights

to get a copy of what we hold about you, correct it, or have it deleted. We respond within 30 days, usually much sooner.

Cookies

We set exactly two, and only for administrators signing into the moderation panel: a session cookie and a CSRF token. Regular visitors get no tracking cookies at all.