Privacy Policy

Draft — to be reviewed by counsel before launch (PRD 13.1).

What we collect

• Senders: your email address (to verify you and let you manage gifts), the gift you create, and payment records from Stripe. We never see your full card details.
• Receivers: nothing, unless you ask for a reminder — then your email address and time zone.
• Basic technical data (IP address for abuse prevention and pricing currency).

How we protect gifts

Gift contents stay on our servers until they unlock. Photos live in private storage reachable only by short-lived signed links. Gift card codes are encrypted at rest.

Cookies

We use one essential cookie to keep senders signed in. Analytics cookies are only used if you opt in.

Retention

Photos, voice and video messages are kept for 12 months after a gift is opened (or after it unlocks, if it's never opened); we email the sender 30 days before they're deleted. Letters and other text stay with the gift. Deleted gifts are permanently erased within 30 days.

Your rights (GDPR / UK GDPR)

You can access, export or delete your data at any time from My gifts or by emailing privacy@nopeeking.me.

Children

NoPeeking is for people aged 13 and over. We don't knowingly collect data from children under 13.