Privacy

What we store, and why

• Your greeting: your name (and nickname, if you add one), their name, your message and theme. This is what the recipient sees.
• Link fingerprints: share, session and inbox links are stored only as keyed hashes. We can check a link is valid, but we can't read the link back from our database.
• Anonymous usage counts: events like “greeting opened” or “firework triggered”, with a time and the greeting they belong to. No IP address, device ID or browser fingerprint is attached.
• Rate-limit counters: to stop spam we count requests per network address. The address is hashed with a secret before it's used, and the counters are deleted within a day.

What we never collect

• Phone numbers, email addresses, contacts or location.
• Advertising or third-party tracking cookies. The only cookies are functional: they remember your session and inbox on this device.

Retention and deletion

• Greeting links expire after 90 days and are permanently deleted 30 days after that.
• Usage counts are deleted after 180 days.
• You can delete any wish you receive from your inbox at any time. It disappears straight away and its link stops working.
• Greetings you send expire automatically after 90 days; reported greetings can be removed sooner.

Where it lives

Data is stored in a PostgreSQL database on Amazon Web Services, in a private network that only the DiwaliVerse server can reach. It is never shared for advertising.