Privacy Policy
Version 2026-09-28. The English text is the binding one.
Effective 2026-09-28.
The short version
- We keep a record of each card: your answers, line or poem, theme, look, language, note, and whether it was paid. We keep it for as long as we run the service to learn what people like and make better cards. We delete it when you delete your account.
- The things used to make and mail the card have shorter lives. Photos, panels and print files go 30 days after mailing, or 120 days for subscription cards, subject to a dispute or refund hold. If a card is cancelled before it is mailed, we keep its photo and panel until you delete your account; its print file, which carries the recipient's address, is deleted once the refund is settled. A one-off recipient's address goes 30 days after the last mailed copy. For a cancelled card, it is cleared once the refund is settled. An abandoned draft and its files go after 24 hours; a settled card's record stays. Subscription notes go 30 days after the subscription ends and its last funded card is made or refunded.
- The operator reads every card before it prints. For cards written from answers, that includes the answers and the drafted line or poem, through Telegram. Our review messages go when the operator decides, and always within 40 hours.
- Providers help us host the service, write and draw, take payment, send emails and deliver cards. Anthropic receives your answers, OpenAI receives your cropped photo and Google's Gemini receives words the operator writes for your card only after you allow it on the permission screen.
- We do not sell personal information, run ads, or track you across other apps or websites.
- You can ask for a copy, a correction or deletion. Delete your account in the app or write to support@giveadam.download. Deleting signs you out at once and cannot be undone. The deletion process and the few records that must remain are described below.
Who we are
Give a Dam is run by Alborz Mirzaie, a sole proprietor in Texas, in the United States. Write to support@giveadam.download about anything in this policy. We offer the service in the United States. Providers may process data where their terms and subprocessors allow.
What we collect, why, and how long
We keep two stores. The operational store holds what we need to make and mail a card. The record store holds a plain, structured record the operator can read to understand what people choose and make better cards. Removing an operational copy does not remove the record.
| What | Why we have it | How long we keep it |
|---|---|---|
| Your email and optional sign-up name | Sign-in codes, receipts, card notices, and the name a line may open with | Until account deletion |
| Your adult confirmation, accepted terms and privacy versions, and model-provider permission, with their times | To record what you agreed to | With your account; billing consent follows its separate row below |
| Your optional birth date, or a record that you skipped it | For a later birthday card; never printed or sent to a model provider | Until account deletion |
| Record store: the record of each settled card — path, spoke, language, theme and quotation, look, template or own-photo choice, line or poem, optional note and whether one was written, answers exactly as typed with their question-set version, directness and off-limits choices, delivery, product, payment state and dates | To learn what people like and make better cards. The operator can search, count and download these records. The record contains the photo choice, not the photo or address | Kept while your account exists, for as long as we run the service. Deleted with your account. A settled card's record remains if checkout is abandoned or the order is refunded |
| Operational store: your answers, up to 7 strings of up to 200 characters each, with the name supplied for the line if any | To write and screen a line or poem and let the operator review it | Encrypted with a per-card key. The key goes within 24 hours after the line settles, within 7 days after payment at the latest, or at once on refund or decline. An unpaid draft goes after 24 hours from creation. The plain record-store copy follows the row above |
| The line or poem on the card, and your optional note, on the operational card and order | To print the card; your own words and note can also appear in the app | Until account deletion. A line or poem written from your answers is not shown before the card arrives |
| Your cropped photo, its print derivative, the panel artwork, their small copies for the app, and the print file for a single card or a card from a pair | To make, mail and if needed reprint the card | 30 days after mailing; an abandoned unpaid card's files and unreferenced uploads go after 24 hours. A reprint restarts the mailed-file clock. If a card is cancelled before it is mailed, we keep its photo and panel until you delete your account; its print file, which carries the recipient's address, is deleted once the refund is settled. |
| The photo, panel, their small copies for the app, and print file of a subscription card | To make and reprint it and answer a payment dispute | 120 days after mailing, or longer while a dispute or refund hold needs them. Account deletion clears them after billing and refunds settle. The mailed date remains as described below |
| Subscription image queue: pictures you add for future subscription cards | So the operator can choose a picture for your card | Kept while your account exists and removed when you remove them. Used pictures follow the card's files and their mailing clock; if the card is cancelled instead, the original stays until you delete your account |
| Your chosen place name under the picture and how you asked to be named on the back | To print them on the card | With the card until account deletion. Only the chosen place name leaves the phone; the photo's coordinates do not |
| Your saved address | To mail your cards and receive replies you allow | Until you remove it or delete your account |
| A one-order recipient's name and address, including one supplied through a claim link or copied for a private reply | To mail that card and a replacement if needed | 30 days after the last copy is mailed. For a cancelled card, it is cleared once the refund is settled. An unreferenced private reply address goes after 24 hours. Saved addresses follow the row above |
| The serial number, reply code, mailed date and order state | To identify a mailed card and handle delivery, blocks and accounting | The mailed date and necessary order facts remain for tax, accounting, chargeback and legal rules after personal content is removed on account deletion |
| A blocked sender or recipient label and a keyed one-way code made from the mailing address | To honour a block or do-not-mail request after the readable address goes | As long as needed to stop unwanted mail; used only for that purpose |
| Payment references, amounts, dates, tax, destination state and ZIP code | To settle payments and keep accounts | For the period tax, accounting, chargeback and legal rules require. Account deletion removes personal content; the amount, date, serial number, tax, destination state and ZIP code, payment reference and order state remain |
| Order records: the mailing date we showed you, the text you accepted above Pay and its language, your delay choice and its date, and refund references | To record what we promised, what you agreed to and what we refunded | Kept with the financial record for the period tax, accounting, chargeback and legal rules require, including after account deletion |
| Delay emails: the address they were sent to and their content | To record the delay notice and choice sent to you | Kept with the order. Account deletion removes the recipient email address; the notice content remains |
| Cancellation emails: the address they were sent to and their content | To record the cancellation notice sent to you | Kept with the order. Account deletion removes the recipient email address, subject and message content |
| Subscription preference text and every earlier version | So the operator can choose your cards on a page only the operator can open. Never sent to a model provider, in an email body, or to Telegram | While the subscription lives or a funded card awaits making or refund, then 30 days after the later of the subscription ending and that backlog being resolved. Cleared on account deletion after billing and refunds settle |
| Subscription and billing records: customer, subscription and invoice IDs, funded months, amounts, refunds, deletion steps, and your agreement to recurring charges with the full accepted disclosure | To bill, fulfil, refund and record what you agreed to | For the period tax, accounting, chargeback and legal rules require, including after account deletion. They contain no preference text. Consent evidence stays at least 3 years from consent or 1 year after the subscription ends, whichever is longer |
| Subscription notices and delivery results | To record the confirmation, annual reminder and notices of changes sent to you | With billing records. They contain no preference text; account deletion clears the recipient email |
| Stripe event inbox metadata | To process payment events reliably without counting one twice | 90 days from receipt; unfinished events and unresolved invoices stay until resolved. Financial records have their own period above |
| Support emails | To answer you and record the matter | 12 months after the matter closes, unless a law or an open dispute requires longer |
| Crash and fault reports | To find and fix faults | At most 90 days at Sentry |
| Daily database backups, including both stores | To recover from a failure | 7 days. A backup can hold both the operational ciphertext and key, and the plain card record, after live deletion. It ages out of the backups within this period |
Claim links expire after 14 days, counted from the sender's payment, and a new link does not extend that, with a reminder 7 days before expiry. Free promotional credits expire after 40 days; purchased credits never expire. These clocks do not erase a settled card's record. For these clocks, a day is 24 hours.
Your light or dark choice stays on your phone. The app uses Sentry to report crashes and technical faults so the operator can find and fix them. A report carries the fault, the app version, the device model, the operating system version and two identifiers that Sentry's software makes on your phone: a random installation number, and a code derived from the identifier Apple gives this app on your device. They let the operator see whether several reports come from one phone; they do not carry your name, email or account. We do not attach your answers, card text, photos, email, address or account, and request details are removed before a report leaves the phone. We use the card records to understand choices. Stripe's payment sheet reports its own use to Stripe.
Who sees what
The operator. The person running the service reads each card before it prints. For a card written from answers, our service sends the answers, their questions, the sign-up name if supplied, and the draft to the operator's Telegram account after payment. Anthropic supplies an English rendering when needed. The operator approves the draft, asks for another or writes it. The service deletes its Telegram messages on decision and always within 40 hours. The operator's own replies, containing the operator's words, stay in that account. The operator can also read the record store, including answers, lines and notes, to learn what people like and improve cards. Neither recipients nor other senders can open it.
Writing and pictures. Anthropic receives your answers and the supplied name to write or redraw a line or poem, screen it and make an English rendering for the operator. OpenAI receives the cropped photo to draw the panel; no answers, text or address go with it. Both transfers wait for the permission screen. Neither receives your birth date. Anthropic's commercial terms do not allow it to train models on our customers' content. OpenAI says API inputs and outputs are not used for training by default; standard abuse-monitoring logs may last up to 30 days. Providers' own retention and safety rules apply to their copies.
Google's Gemini API translates only words the operator writes into the card's language. Those words may include your name or a friend's name; your answers are not sent to Gemini. Gemini is used only for an account that allowed it on the permission screen. Anthropic translates the operator's words when Gemini is not configured, not allowed, or does not answer.
Sentry. Sentry receives the crash and fault reports described above, with the two identifiers named there, and keeps them for at most 90 days. It receives no answers, card text, photos, email, address or account details.
Your answers are never printed as written or shown to the recipient. The last answer on the self and friend question sets only shapes the line; it is never quoted or summarised on the card. My own words and Draw have no answers. A poem and a sender's own line are screened before printing; a flagged text waits for review.
Photos. You choose the crop. The app removes camera and location metadata before upload and the service removes it again when making the print image. Only the place name you choose is kept as a caption. Files live in private storage and are reached through short-lived signed links. For subscription files, a dispute opened in the moment a file is being removed after its retention period may find that file already gone, in which case the order record answers the dispute.
Payment, hosting and delivery. Stripe receives payment and billing details and handles them under its own policy. We receive references, amounts and outcomes, never a full card number. Stripe holds subscription payment methods. Stripe sends a receipt for each renewal, failed-payment notices and expiring-card notices; it sends no renewal reminder. Our app sends the accepted disclosure after the first payment, an annual reminder 30 days before each enrolment anniversary on both plans, and notices of material and fee changes. Those emails state the relevant dates, charge, cancellation route and contact and link to the accepted Terms and Privacy Policy.
Supabase hosts our database, sign-in and private storage, including the record store, and the daily database backups kept for 7 days. Fly.io runs the service and handles its data in memory and transit. Resend receives the email address and message content to send sign-in codes, receipts and notices. Telegram carries the review described above. Apple distributes the app and provides Apple Pay through Stripe under Apple's terms. USPS sees the printed address and carries the card. We disclose information otherwise only where the law requires it or to protect someone from harm.
We share your data only with the providers named in this policy, and only for what it describes. Each provider we engage to process your data, other than Telegram and Stripe, is bound by its terms of service or data processing terms to use it only to provide its service to us and to give it the same or equal protection this policy describes. Stripe also uses payment details for its own services, such as Link and fraud prevention, under its own privacy policy. Apple and USPS handle what they receive under their own terms and the law.
Telegram is the exception. The operator's review messages pass through a Telegram account under Telegram's own terms, and we have no data processing agreement with Telegram. So we send only what the review needs, only after payment, and delete our messages when the operator decides and always within 40 hours.
Connections and hosted storage are encrypted. In the operational store, the answers have a further layer of encryption with a per-card key destroyed on its clock. We also keep a plain copy in the record store, which only the operator can read, through the service's own database access. Destroying the operational key does not make those answers unreadable. The app cannot access the database directly. Answers, lines, notes, addresses and email addresses are never written to application logs, analytics events or error reports.
Your rights and account deletion
Write to support@giveadam.download for a copy of your information; we respond within 30 days. You can ask for a correction or deletion. Addresses and names can be corrected before printing; write to us after payment. We may ask for enough information to confirm the request is yours. We never give a sender an address supplied privately through a claim link, or a recipient the sender's answers.
You can delete your account in the app. The moment you do, we sign you out and you can no longer sign in to that account. A deleted account cannot be restored, by you or by us. We remove your card records, including answers, lines, poems and notes; destroy operational answer keys; remove photos, panels, print files, queued pictures, readable addresses, your name and birth date; and clear subscription preferences and all their earlier versions. A paid single card or card from a pair within its cancel period is cancelled with the change-of-mind refund in Terms section 8. If a delay notice is open or you have agreed to wait, deletion cancels the unmailed card with the full refund in Terms section 8. Otherwise, after its batch has closed, the card is still mailed and deletion finishes after that. A refund still owed to you must settle before deletion finishes; we finish deletion within 30 days of your request, unless a payment dispute you opened with your bank is still open. The unused second card of a bought pair is refunded to the original payment method as Terms section 13 describes. Promotional credits are forfeited, and mailed cards cannot be recalled. Billing records needed for tax, accounting and chargeback rules and the mailed date stay. We strip personal content from the accounting records and keep only the block information needed to honour do-not-mail requests.
Deletion is a durable task. We stop subscription fulfilment, cancel billing and close open invoices, including those on an ended subscription. A payment arriving before an invoice closes is reconciled and any amount that bought no funded cards is refunded. Each paid subscription card not yet mailed, including one already made, is refunded at $8.00 to the original payment method, up to what was paid for it, less any refund already made. We issue that refund through Stripe within 30 days of the deletion request. A refund still in progress must settle before deletion finishes; we finish deletion within 30 days of your request, unless a payment dispute you opened with your bank is still open. When you delete your account we sign you out at once, and you can no longer sign in to that account. We email you when deletion has finished, and also when it starts if it cannot finish at once. After you are signed out, billing, refunds, record removal and file removal run on our service in order, and unfinished steps retry. A deleted account cannot be restored. Backups age out within 7 days of live deletion.
Cancelling a subscription without deleting the account stops future charges at the end of the paid period. Paid cards are still mailed and cancellation itself gives no refund. Preferences follow their clock in the table; the card records stay while your account exists.
If you receive a card without an account, we hold your name and address to mail it and a replacement if needed, then clear them 30 days after the last copy is mailed, or, for a cancelled card, once the refund is settled. Use the reply code or write to support@giveadam.download to block a sender or ask for no more mail. An address under a do-not-mail request is also refused when someone enters it on a claim page. A keyed one-way address code keeps that request working after the readable address goes. The sender's record may still include what they wrote about you; write to us about information concerning you.
Children, California and tracking
The service is for adults aged 18 or older. If we learn that an account belongs to someone under 18, we delete it. If a single card or a card from a pair is addressed to someone under 18, we decline it and the sender gets back what they paid, or their credit, as described in Terms section 8. A subscription card follows the decline and deletion rules in the Terms.
These choices are open to everyone. We do not treat you differently for using them. California residents have rights to know, delete and correct personal information and opt out of sale or sharing under the California Consumer Privacy Act. We sell and share nothing for advertising. An authorised agent must show they act for you. If California law requires a breach notice, we send it within 30 calendar days after discovery or notification, unless the law permits a delay, and explain what we know and what we are doing.
We do not sell personal information, run advertising, use advertising identifiers or track you across other companies' apps or websites. The app asks for no tracking permission. Public pages set no tracking cookies and treat Do Not Track signals the same because they do no tracking. The reply page keeps its card code out of browser caches and referrers. The scannable code names that page, not a person. The public iPhone association file names only the app; Safari's App Store banner tells us nothing unless you tap it. The operator's admin pages use a session cookie.
Changes and contact
When this policy changes, the effective date changes and the app asks you to accept the new version before your next order. We ask before using data we already hold in a new way.
Alborz Mirzaie, a sole proprietor in Texas, United States. support@giveadam.download.