dearyou (“we”), run by its proprietor as set out in our Terms, is the data fiduciary for personal data processed through dearyou, under the Digital Personal Data Protection Act, 2023.
If you make gifts (buyers)
- Your Google account details: name, email address and profile picture, when you sign in. We don't get your Google password.
- Your confirmations: that you're 18 or older and accept our Terms and this policy, with the date.
- What you put in your gifts: text, photos, any song or voice note, theme choices and the page name. Before we store a photo we re-encode it and remove its hidden metadata, including GPS location.
- Orders: the amount, any promo code, and Razorpay's order and payment references. Razorpay handles your card, UPI or bank details; we never see or store them.
- Sign-in sessions: a secure cookie that keeps you signed in, and the device details our sign-in system records with it.
If you open a gift (recipients)
- We don't ask who you are. We count how many times a gift is opened and when it was first and last opened, and show that to the person who made it. We don't record your IP address, location or device for this.
- If a gift is password-locked, a correct password sets a cookie on your device so you don't have to type it again for 30 days. To stop people guessing, we count attempts using a scrambled, one-way code made from your IP address, and delete it after 15 minutes.
If you report a page
We keep your email address, the page and what you told us, so we can act on it and reply. Report records are kept for at least 180 days after we act, as the IT Rules 2021 require.
Why we use it
- To run your account, build, publish and host your gifts, and send your receipt and service emails.
- To take payments and handle refunds.
- To keep dearyou safe: stopping abuse, handling reports, and meeting legal duties.
We don't sell personal data, show ads, or use advertising or tracking cookies.
Who we share it with
Only the service providers that run dearyou for us, under contract, and only what each needs:
- Google (sign-in), Vercel (hosting), MongoDB Atlas (database), Cloudflare R2 (photo and audio storage),
- Razorpay (payments) and Resend (email).
Some of them store data outside India. We also share data when the law requires it, for example with a court or government authority.
Your gift is visible to anyone who has its link (and its password, if it's locked). Gift pages are hidden from search engines.
How long we keep it
- Drafts you haven't touched for 90 days are deleted, with an email reminder 7 days before.
- Published gifts stay until you delete your account or ask us to remove them.
- Photos and audio you remove from a gift are deleted from storage.
- Order and payment records are kept as long as tax and accounting law requires, even after your account is deleted.
- Records of content removed after a report are kept for at least 180 days.
Your rights
You can ask us to:
- tell you what personal data we hold about you,
- correct it,
- delete your account, your gifts and your photos (we'll keep only what the law requires), or
- nominate someone to act for you if you die or can't act yourself.
You can delete your account yourself at any time from Settings. For anything else, email support@dearyou.page from the address you sign in with; we'll reply within 30 days. Deleting your account withdraws your consent; it doesn't affect what we did before.
Security
Photos and audio are stored privately and served through short-lived links. Gift passwords are stored only as one-way hashes. If a breach affects your personal data, we'll tell you and the Data Protection Board of India as the law requires.
Children
dearyou accounts are only for people aged 18 or older. We don't knowingly collect data from children through accounts.
Questions or complaints
Contact our Grievance Officer (named in our Terms) at grievance@dearyou.page, or by post at the address in our Terms. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.
We'll post any changes to this policy here with a new effective date. See also our Terms.