Privacy Policy

• Gift information, including recipient and sender names, reveal text, an optional message, gift category, delivery details, and wrapping choice.
• Operational information needed for security and rate limiting. Joyfold validates a network address at its trusted hosting boundary and hashes it with a secret salt before shared limiter storage. We also use short-lived random session identifiers.
• Abuse report information, including a category, description, optional reporter email, timestamps, status, and minimal moderation audit information.
• Basic hosting and security logs generated by service providers. We do not intentionally log gift content, full recipient links, report text, reporter contact details, cookies, or raw network addresses.
• For visitors that our hosting provider identifies as being in the United States, limited product events such as starting, previewing, publishing, opening, and unwrapping a gift. These events use broad classifications such as gift category, wrapping choice, and device type. Visitors outside the United States, or whose location is unknown, receive no product analytics.

We use information to create and display gifts, keep recipient links working, prevent abuse, enforce submission limits, investigate reports, suppress harmful content, maintain security, comply with law, and understand the service through limited non-content product signals if analytics are enabled.

Joyfold does not sell personal information or use gift or report content for targeted advertising.

Product analytics help us understand where the create and unwrap flows work well or lose momentum. We do not send gift contents, gift links, gift codes, names, messages, or delivery text, and we do not connect a gift creator to its recipient across devices.

Recipient-facing gift information is visible to anyone with the bearer link. Hosting, database, and security providers process limited information on Joyfold’s behalf. Restricted reviewers may access abuse reports and related moderation records.

When limited United States product analytics are enabled, PostHog processes the allowlisted event data on Joyfold's behalf. PostHog does not receive gift contents, recipient links, or gift codes from this analytics integration.

We may preserve or disclose information when reasonably necessary for safety, to comply with valid legal process, to protect rights and the service, or to address an urgent threat. We do not promise reporters anonymity that we cannot guarantee.

• Gifts ordinarily expire six calendar months after creation and are deleted by scheduled cleanup after expiration.
• Rate-limit identifiers expire after their one-hour window and are removed by scheduled cleanup.
• Open abuse reports are kept while review is needed. Resolved reports and optional reporter contact information are ordinarily deleted 12 months after resolution.
• Minimal moderation audit records are ordinarily deleted 24 months after the action.
• The anonymous product-analytics identifier exists only in memory for the open browser session and is not stored in a cookie or local storage. Limited event records are retained according to Joyfold's configured provider retention period.

We may retain limited information longer when reasonably necessary for safety, a legal hold, law enforcement, or a dispute. Backups and provider systems may take additional time to cycle out deleted data.

Joyfold uses short-lived, HTTP-only session cookies to enforce separate creation and report-submission limits. Recipient links should be treated as private bearer links. Do not post them publicly or send them to someone you do not trust.

Product analytics do not use cookies or persistent browser storage. The analytics identifier lasts only for the current in-memory browser session.

Reporter contact information is optional for ordinary reports. You may ask about access, correction, or deletion of information that can reasonably be associated with you. Legal rights vary by location, and we may need to verify a request before acting on it.

Joyfold is not intended for use by people under 18. Information may be processed in the United States or other places where our providers operate. Do not use the service where these practices are not lawful.

We may update this policy as the product changes. The effective date above shows the latest revision. You can also review the Terms of Service and Abuse Policy.

For help with abuse or a report, email abuse@joyfold.app. Do not send gift codes, decryption keys, or full recipient links by email.