privacy

The German version of this text is the binding one.

In short

• What's inside a box (photos, letter, voice memos, video, coupons, names, places) is encrypted on the phone before it leaves the device. The key exists only in the link. We don't have it and can't look at the content.
• There is no account with a name, email address or phone number.
• There are no ads, no analytics services and no cookies.
• A sent box stays available for two years and is then deleted. Whoever sent it can delete it earlier in the app.

1. Who is responsible

2. When you pack a box (app)

An identifier instead of an account

On first launch the app creates a random identifier for you. It is an anonymous account with our provider Supabase. We don't ask for a name, email address or phone number. The identifier is what ties your boxes and purchases to you. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

The content of the box

Photos, the letter, voice memos, the video greeting, poses for the photo booth, coupon texts, your name and the recipient's name and, if you turn on the map, the places where your photos were taken: the app encrypts all of it on your device (AES-256-GCM) and only then uploads it. The key is created on your device, is kept there in the operating system's protected storage and sits in the link after the # sign. Browsers don't send that part of a link to servers. So we can't read the content, and we can't restore it either.

Photos usually show other people. You are responsible for being allowed to share these pictures with the recipient.

What the server stores unencrypted

• the box's identifier and your identifier
• the box's state (draft, sent, blocked, deleted) and the occasion, if you chose one
• the number of photos, and the names and sizes of the encrypted files
• times: created, sent, “opens on”, expires, photo strip arrived
• events from the box (see section 3), only their kind and time

Drafts

While you pack, everything stays on your device. Uploading starts only when you go to “send”. If you stop after that, before buying, the encrypted draft stays on the server for 30 days at most.

Purchase

Payment is handled by Apple (App Store) or Google (Google Play). We don't receive payment details. To verify the purchase we use RevenueCat. It receives your identifier, the product you bought and the purchase confirmation from Apple or Google. We ourselves store the product, the transaction number, the time and the box the purchase was used for. The legal basis is performance of the contract.

Notifications

If you allow notifications, we store your device's push address, its operating system and the app's language. Notifications such as “Your box was opened.” are delivered through Expo and through Apple or Google. They contain no names and nothing from the box. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your device settings.

Access on your device

• Camera: for the poses, the video greeting and to photograph a handwritten letter
• Microphone: for voice memos and the video greeting
• Photos: only the pictures and videos you pick
• Location of a photo: the app reads it from the image data of the photos you pick. It goes into the box only if you turn on the map. The app works out the place name on the device from a bundled list of cities, without asking a map service. The app never asks for your current location.

3. When you open a box (browser)

You need no account to open a box and you give no details. Your browser loads the encrypted files and decrypts them on your device.

What stays on your device

The page remembers in your browser's local storage how far you are in the box, game scores and your photo strip. These are not cookies, and none of it is sent to us.

What the giver learns

They get a notification when the box was opened, the letter was read, the video was watched, a coupon was redeemed or a photo strip was sent. The server stores only the kind of event and the time. The legal basis is our legitimate interest in giving the giver this feedback (Art. 6(1)(f) GDPR); it is part of the gift.

Photo booth

The camera runs only if you allow it, and the pictures stay in your browser. Only when you send the strip is it encrypted with the box's key and uploaded. Only the person who sent the box can look at it.

Coupon for a box of your own

When you open the coupon, the server creates a code. It belongs to the box, not to you. If someone redeems the code in the app, it is linked to that person's identifier.

4. The website

cutesy.gifts is delivered through Cloudflare; the boxes' data is stored with Supabase in Frankfurt am Main. On every request these services process what is technically necessary: IP address, time, the address requested and details about your browser. They keep this in logs for a short time to keep the service running (Art. 6(1)(f) GDPR). Fonts and map data are served from our own server. We don't embed third-party content.

5. When you report a box

With “report” inside the box you can tell us about illegal content. We store your text, the box's identifier, the time and a non-reversible fingerprint of your IP address. It lets us see whether several reports come from the same place. The report also reaches us as an email, sent through Resend. The legal basis is our obligations under the Digital Services Act (Art. 6(1)(c) GDPR).

6. When you withdraw

With “withdraw from contract” you can withdraw from a purchase. We store your name, your details about the purchase, your email address, the time and a non-reversible fingerprint of your IP address, which slows down mass submissions. We send the confirmation of receipt to the email address, through Resend. The legal basis is our statutory duty to accept and confirm the withdrawal (Art. 6(1)(c) GDPR).

7. Service providers

• Supabase, Inc. (USA): database, file storage and server functions. The data is stored in Frankfurt am Main.
• Cloudflare, Inc. (USA): delivery of the website.
• RevenueCat, Inc. (USA): verification of purchases.
• Apple Distribution International Ltd. (Ireland) and Google Commerce Ltd. (Ireland): sale, payment and delivery of notifications.
• 650 Industries, Inc. (“Expo”, USA): sending notifications.
• Resend, Inc. (USA): emails about reports and withdrawals.

Where data reaches the USA in the process, we rely on the EU–US Data Privacy Framework or on standard contractual clauses.

8. How long we keep data

• Sent box: two years from sending or, if it opens later, from that day. After that the server deletes the files.
• If you delete a box in the app, its files and events are removed right away. The link then only shows that the box no longer exists. For a sent box an empty entry with its identifier and times remains, so that its purchase can't be used a second time.
• Draft on the server: 30 days without changes.
• Coupon codes: valid for 30 days.
• Withdrawals: three years, so that we can prove them.
• Purchase records: until you delete all data. Billing itself stays with Apple or Google.
• “Delete all data” in the app removes your identifier together with all boxes, purchases, push addresses and events.

9. Your rights

You can ask what data we hold about you, have it corrected or deleted, have its processing restricted, object to it and receive your data in a common format. You can withdraw consent at any time. Write to the address above. Because we don't know you by name, please tell us your identifier. You find it in the app under “about cutesy”.

You can also complain to a data protection authority. The one responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg) in Stuttgart.

10. Age

Cutesy is meant for people aged 16 and over.

11. Changes

When something changes in the app or on the server, we update this text. The version shown here applies.

Last updated: 12 November 2026