Confidentialité

The short version

We keep as little as possible. We do not sell your data, we do not run advertising trackers, and we delete voice recordings automatically after 90 days. If you want anything removed sooner, email support@sharelove.io and we will do it.

sharelove is operated by Blissfulplan Publishing Ltd, Covent Garden, 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom ("we", "us"). We are the data controller for the personal data described here. For data protection enquiries you can also write to contact@blissfulplan.com.

What we collect

When you send a card:

• your name and email address
• your recipient's name, and their email address only if you ask us to email the card for you. If you choose to share the link yourself, we never receive their address at all.
• their phone number, if you add one
• the written message you type
• the voice recording you make, if you make one
• the captions for that recording, if your browser produced them
• the design and occasion you choose
• the date and time you gave the two confirmations shown before payment, which we keep as the record that you gave them

When you pay: we never see or store your card details. Payment is handled entirely by Stripe on their own hosted page. We receive only a payment reference, the amount, the currency and whether it succeeded.

Automatically: your IP address, used to rate-limit our public endpoints so they cannot be abused. It is held for a short window for that purpose only.

If you contact us: your name, email and whatever you write to us.

Why we are allowed to hold it

• To perform a contract with you — we cannot deliver a card without the recipient's address and your message.
• Our legitimate interest in keeping the service working — rate limiting and abuse prevention.
• Your consent — captions are produced only because you chose to record, and you can decline them.
• Payment records, and the record of the confirmations you gave before paying, are kept where required by legal obligation (tax and accounting, and consumer law).

A note about your recipient

If you ask us to email the card, you are giving us someone else's address, and we use it for exactly one thing: sending that card. We do not add it to any list and we never email it again unless they open the card and you asked to be told. Please only send a card to someone who would welcome hearing from you.

If you share the link yourself instead, we hold nothing about your recipient beyond the name you wrote on the card.

If you receive a card you did not want, email us and we will delete it and block further sends to your address.

How long we keep things

What	How long
Voice recordings	90 days, then deleted automatically
Captions for a recording	Kept with the card record, as text
Record that you gave the confirmations before paying	Kept with the payment record
Card record (names, emails, written message)	Kept so the recipient's link keeps working
Payment records	As required by tax law
Contact messages	24 months
IP addresses used for rate limiting	Hours, not days

The card page stays reachable after the recording is deleted; the design and written message remain, the audio does not.

Who else processes it

We use a small number of providers, each for one job:

• Supabase — database and file storage
• Stripe — payments
• Brevo — sending the delivery and receipt emails
• Upstash — rate limiting
• Cloudflare — hosting and content delivery

They act on our instructions and may not use your data for their own purposes.

Your browser's own speech service (Google for Chrome, Apple for Safari) is not in this list, because it is not acting on our instructions. See "Captions, and what your browser does with your voice" above. Some operate outside your country; transfers rely on standard contractual clauses or an adequacy decision.

How your voice recording is protected

Recordings are stored in a private bucket. They are not publicly addressable. When your recipient opens their card, the server issues a short-lived signed link that expires after an hour. Guessing a card link is not practical: each one carries a random 128-bit token.

Captions, and what your browser does with your voice

If you record a message, your browser may transcribe it into captions while you speak, so your recipient can read along.

This part does not happen on our servers, and on most browsers it does not happen on your device either. Chrome and Safari implement this feature by streaming the audio to their own speech services — Google and Apple respectively — which transcribe it and send text back. We never receive that audio stream and we have no arrangement with either company; it is your browser talking to its own vendor, under that vendor's privacy policy, not ours.

We ask the browser to transcribe on your device instead wherever it supports that, and Firefox does not offer the feature at all, so no transcription happens there.

If you would rather nothing was transcribed, record your message in Firefox, or turn captions off before recording. Your card still works; it simply carries no captions. The voice recording itself is only ever sent to our own storage, described above.

How we count visits

We count page views and how many distinct people visited each day, so we know whether anyone is finding us. This uses no cookies and no third-party analytics service. The visitor count is a daily-salted one-way hash held in a counter — it cannot be reversed, cannot be linked to you, and cannot be used to follow the same person from one day to the next. We do not know who you are, we do not build a profile, and there is nothing here to sell.

Cookies and local storage

We use no advertising or analytics cookies. What we do store:

• a cookie remembering your chosen language
• your theme preference (light/dark), in your browser's local storage
• a session cookie, only for administrators signing in to manage the site

These are strictly necessary or functional. There is nothing to opt out of because there is nothing tracking you.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. Email support@sharelove.io. We will reply within 30 days.

If you are in the EEA or the UK and you are not satisfied with our answer, you may complain to your national data protection authority.

Children

sharelove is not directed at children under 16, and we do not knowingly collect their data.

Changes

If we change this notice materially we will update the date at the top. Card links already delivered will keep working.