Privacy policy

• Owner: Andrés Igualada
• Privacy contact:

If you create a gift:

• What you put in the gift: the photos you upload and the text and names you write, including those of the people you send it to. They're deleted with the gift.
• Your email address, if you publish a gift or sign in to your account. We confirm it with a one-time code: we don't use passwords.
• Your preference about news, if you check the box, along with the date you did so.
• If you use “Write with AI”, the text you write so the AI can draft the message (the occasion, who it's for, your name). Photos are never sent to the AI.
• If you protect the gift with a question, the question, the hint and the answer. The answer is stored encrypted.
• If you schedule the delivery or send it by email (Premium), the date and time you choose and the email addresses of the people you send it to. We keep them while the gift exists, so you can see who it went to and we can tell you in our notices; they are deleted along with it.
• The country you create it from, which we infer from your IP address (we don't store the IP address with the gift). We use it to offer you your country's price.

If you receive a gift: only the technical data of the visit (see below). We don't ask you for anything. If someone sends it to you by email, that person typed your address: we use it once to send it to you and then delete it. If you press “I don't want to receive gifts” in the footer of the email, we keep an irreversible fingerprint of your address (not the address itself) so we never write to you again. If the gift has a question to open it, the answer you type is only used to check it: it isn't stored. If the gift asks you a “Yes” or “No” question, we store your answer, how many times the “No” ran away and when you answered, so we can tell the person who gave it to you. If you reply to the gift, we store the reaction you pick, any message you write and when you replied, so we can tell the person who gave it to you; they are deleted with the gift. We don't store who you are or where you answer from.

From any visit: the IP address and technical browser data, which we use to serve the website, protect it from abuse and limit the number of attempts (for example, of sign-in codes).

If you create a gift from outside Europe (that is, not from the European Economic Area, the United Kingdom or Switzerland), we use Microsoft Clarity to record how you use the create page and the editor: your clicks, how you scroll and which screens you see. Everything you write and upload (texts, photos, recipients, emails) is hidden in your browser before it is sent, so we can't see your letters, your photos or who you're giving them to. We only use it to see where people get stuck and to improve it.

Other people's data. If other people appear in your gift (in photos or by name), you are the one who decides to upload them: make sure they're happy with it, especially if they are minors. If you appear in a gift and want us to remove it, write to us at .

We don't sell your data, we don't build profiles and we don't use it for third-party advertising. What Microsoft does on its own with Clarity's recordings is described in section 5.

Nobody sees your gift except people who have its link: the gift isn't published in any listing, but anyone with the link can open it, unless you add a question. Only share it with the people you want to.

To provide the service we use these providers, who only process the data on our behalf and under a data processing agreement:

Microsoft (Clarity), the tool we use to record how the create page and the editor are used outside Europe, doesn't act on our behalf: it is an independent controller of the data it receives (the IP address, the browser, cookies and what you do on the page, without the content that is hidden). Under its terms, Microsoft may use it to improve its products and to build profiles for advertising purposes (Microsoft Advertising), as described in its Privacy Statement. We tell it not to use the data for advertising (advertising consent denied), but what it does with the data is its decision. That's why we don't load it from the European Economic Area, the United Kingdom or Switzerland.

Some of these providers are US companies or may access the data from outside the European Economic Area. In those cases the transfer is covered by the EU-U.S. Data Privacy Framework, when the provider has signed up to it, or by the European Commission's standard contractual clauses (Art. 46 GDPR).

We would only hand data over to an authority if the law requires us to.

For the website to work we only use what's strictly necessary, so we don't ask for your consent (Art. 22(2) of the Spanish LSSI):

• bmp_session, a cookie that keeps you signed in for 30 days. It only exists if you sign in with your email.
• bmp_unlock_…, a cookie that remembers for 30 days that you answered a gift's question correctly, so you aren't asked again. It only exists if you open a gift with a question.
• bmp_manage, a cookie that keeps for 30 days the access to the editor of a gift you open, so its address doesn't carry the key. It only travels to that editor and only exists if you open it.
• bmp_locale, a cookie that remembers, for one year, the language of the pages you visit, so your account and the editor are shown in that language.
• Browser local storage (“My gifts”): stores on your own device the links to the gifts you create or open, so you can find them when you come back. It never leaves your browser.
• Browser local storage (statistics): which website you first came from (for example, “google.com”), which is saved with the gift if you create one, and which gifts you've already opened, so each opening is counted only once.

We don't use advertising cookies. Nor analytics cookies, except for the Clarity exception below: from Europe, the United Kingdom and Switzerland we use none, and we won't without asking for your permission first.

Microsoft Clarity (not strictly necessary) is only loaded if you are outside the European Economic Area, the United Kingdom and Switzerland, and only on the create page and in the editor. It sets two first-party cookies, _clck and _clsk, with a pseudonymous identifier that joins your visits into a single session, and it may set Microsoft's CLID, ANONCHK, MR, MUID and SM. If your browser doesn't accept cookies, Clarity doesn't set them.

To know how many people visit the website and which pages they use, we use Umami, a cookie-free analytics tool that doesn't store your IP address or anything that identifies you: it only counts visits and actions in aggregate (for example, “someone created a birthday gift”). It never receives your gift links or edit links.

You can ask us at any time to access your data, correct it, delete it, object to its use or restrict it, and to take it with you in a common format (portability).

• Deleting your account and your gifts: you can do it yourself from your account, instantly.
• Stopping news and upgrade emails: from your account or with the unsubscribe link in each email.
• Everything else: write to us at from your account's email address. We'll reply within one month at most.

If you think we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the data protection authority where you live.

You must be at least 14 years old to create gifts with an account (Art. 7 of the Spanish LOPDGDD), or older if the law where you live requires it. If you're younger, ask a parent or guardian to create it for you.

Everything travels encrypted (HTTPS). We don't store edit links, sign-in codes or sessions in plain text: only an encrypted fingerprint (a hash) that can't be used to recover them. Access to our systems is limited to those who need it to maintain the service. The answer to a gift's question is the exception, because we show it to the person who created the gift: it's stored encrypted with a key that only the server has.

If we change anything important, we'll post it here with the new date and, if you have an account, we'll let you know by email before it applies.