Privacy policy

This policy explains what Flower Bouquet Digital (“we”, “us”) collects when you use flower-bouquet-digital.vercel.app. The short version: we store the bouquets you send so their links work, we use analytics to improve the product, and we never sell your data.

What we store

• Bouquets you send: the flower arrangement, wrap, the names and note you write, card style and stickers, occasion, optional open date and optional expiry date.
• Reactions, chat messages and reports: emoji reactions and short messages between a sender and each recipient, and reports about a bouquet.
• Personal links (optional): the first name a sender types for each person they send a personal link to, and whether and how often that link was opened.
• Received bouquets (signed in only): which bouquets you opened, so they appear under My bouquets on every device.
• Songs and voice notes (optional): the song link you add, with the title, artist and cover image we look up from Spotify, YouTube or Apple Music; and voice notes you record, stored privately and played only through short-lived links. A voice note is deleted when you delete its bouquet or remove it while editing.
• Notifications (optional): if you turn them on, your browser’s push subscription (an address at Google, Apple, Mozilla or Microsoft’s push service), which bouquets it’s for, and which kinds of notification you want. Turning them off deletes it. Notifications say who opened or answered a bouquet, never what they wrote.
• Badges (signed in only): which badges your account earned and when. Streaks and stats are worked out from your bouquets when you open My bouquets.
• Referrals: when you make a bouquet after opening someone else’s, we note which bouquet brought you, so its sender sees a count (“3 people sent flowers after opening yours”). They never see who you are.
• A one-way hash of your IP address, used only for spam and abuse prevention (rate limits). We never store your raw IP address.
• Accounts (optional): if you create one, your email address and a securely hashed password (or your Google account email if you sign in with Google). Accounts only exist to show your bouquets on any device.

You can make and send bouquets without an account. We never ask for your phone number or payment details.

Stored on your device

Your browser keeps your AI key if you connected one (see below), a list of bouquets you sent, a private edit key for each (so only you can edit or delete them), a list of bouquets you received, a random device ID that keeps your chat with each sender private to you, which chat messages you have already seen, your unsent draft and your cookie choice. With v2 it can also keep: the last bouquet you opened (for 30 days, so a bouquet you make next counts toward its sender’s referral stats), your badges and whether you’ve seen their celebration, your notification settings, whether the “Your garden” panel is open, a count of your visits, and when you last said “Not now” to notifications or installing the app (so we don’t ask too often). Images, videos, GIFs and badge images you download are created on your device and are not uploaded to us. Clearing your browser data removes all of this.

AI note writer

“Help me write” runs on your own AI account with Google (Gemini), OpenAI, Anthropic or OpenRouter. Your API key is kept only in your browser (for the current tab, or on this device if you tick “Remember”) and your browser sends it, with the tone, names, occasion and details you give, straight to the provider you chose. None of it passes through or is stored on our servers, and it is never sent to our analytics. The provider’s own privacy policy covers what they do with the request. Signing in with OpenRouter creates a key on your OpenRouter account that you can revoke there.

Embedded players

A song card shows its cover image from the music service. The Spotify, YouTube or Apple Music player loads only when the recipient taps the card; from then on that service’s own cookies and privacy policy apply. YouTube uses its privacy-enhanced mode.

Notifications and the app

We only ask for notification permission after you tap a button, and never on a bouquet someone sent you. You can turn notifications off in My bouquets or in your browser at any time; that deletes your subscription from our database. Tapping a notification opens My bouquets with a tag that tells our analytics the visit came from a notification. Installing the app adds nothing new to what we collect. The app keeps copies of the home page, the bouquet maker and My bouquets on your device so they open on a weak connection; bouquet pages and your data are never stored in that cache.

Analytics and cookies

• Google Analytics for Firebase: which features people use (for example, which flowers are popular).
• Microsoft Clarity: heatmaps and anonymized session recordings. Names, notes and replies you type are masked and never recorded.
• Vercel Analytics and Speed Insights: page views and performance, without cookies.
• Sign-in cookies (only if you create an account) keep you signed in. They are strictly necessary.
• Cloudflare Turnstile may run a privacy-preserving check when you send a bouquet, to stop bots.

In the EU, EEA and UK, analytics only load after you accept. Elsewhere, Google Analytics loads a moment after the page does and Clarity loads after your first interaction, and you can opt out from the notice. Links shared from the app carry a tag naming the app they were shared through (for example WhatsApp), so we can see which ones people use; it contains nothing about you. To change your choice, clear this site’s data in your browser and choose again.

Who can see a bouquet

Anyone who has its link. Links are random and unlisted, and bouquet pages tell search engines not to index them. Please don’t put sensitive information in a note.

How long we keep data

• Bouquets stay until you delete them or until the expiry you chose. Expired and deleted bouquets stop working immediately.
• Rate-limit records are kept only as long as needed to prevent abuse.
• Voice notes are deleted with their bouquet. A recording you make but never send may be kept for a short while, then deleted.
• Notification subscriptions are deleted when you turn notifications off, or when your browser tells us they no longer work.
• Account data stays until you ask us to delete your account.

Your choices and rights

Edit or delete any bouquet from My bouquets. You can ask us to access, correct or delete your data, or to delete your account, by reporting through any bouquet page or contacting us via the about page. Depending on where you live (for example under GDPR or India’s DPDP Act) you may have additional rights, and we will honour them.

Service providers

Data is stored with Supabase (database and accounts) and served by Vercel (hosting). Analytics are provided by Google (Firebase) and Microsoft (Clarity). Bot protection is provided by Cloudflare. Notifications are delivered through your browser’s push service (Google, Apple, Mozilla or Microsoft). These providers process data on our behalf. Song details come from the public pages of Spotify, YouTube and Apple Music, which we contact without sending anything about you. The AI provider you connect for the note writer (Google, OpenAI, Anthropic or OpenRouter) is chosen and paid for by you and receives requests directly from your browser, not from us.

Children

Flower Bouquet Digital is not directed at children under 13, and we do not knowingly collect their data.

Changes

If we change this policy in a meaningful way, we will update the date at the top of this page.