Privacy Policy

• Gift information, including recipient and sender names, reveal text, an optional message, gift category, delivery details, and wrapping choice.
• Operational information needed for security and rate limiting. Joyfold validates a network address at its trusted hosting boundary and hashes it with a secret salt before shared limiter storage. We also use short-lived random session identifiers.
• Abuse report information, including a category, description, optional reporter email, timestamps, status, and minimal moderation audit information.
• Basic hosting and security logs generated by service providers. We do not intentionally log gift content, full recipient links, report text, reporter contact details, cookies, or raw network addresses.

We use information to create and display gifts, keep recipient links working, prevent abuse, enforce submission limits, investigate reports, suppress harmful content, maintain security, comply with law, and understand the service through limited non-content product signals if analytics are enabled.

Joyfold does not sell personal information or use gift or report content for targeted advertising.

Recipient-facing gift information is visible to anyone with the bearer link. Hosting, database, and security providers process limited information on Joyfold’s behalf. Restricted reviewers may access abuse reports and related moderation records.

We may preserve or disclose information when reasonably necessary for safety, to comply with valid legal process, to protect rights and the service, or to address an urgent threat. We do not promise reporters anonymity that we cannot guarantee.

• Gifts ordinarily expire six calendar months after creation and are deleted by scheduled cleanup after expiration.
• Rate-limit identifiers expire after their one-hour window and are removed by scheduled cleanup.
• Open abuse reports are kept while review is needed. Resolved reports and optional reporter contact information are ordinarily deleted 12 months after resolution.
• Minimal moderation audit records are ordinarily deleted 24 months after the action.

We may retain limited information longer when reasonably necessary for safety, a legal hold, law enforcement, or a dispute. Backups and provider systems may take additional time to cycle out deleted data.

Joyfold uses short-lived, HTTP-only session cookies to enforce separate creation and report-submission limits. Recipient links should be treated as private bearer links. Do not post them publicly or send them to someone you do not trust.

Reporter contact information is optional for ordinary reports. You may ask about access, correction, or deletion of information that can reasonably be associated with you. Legal rights vary by location, and we may need to verify a request before acting on it.

Joyfold is not intended for use by people under 18. Information may be processed in the United States or other places where our providers operate. Do not use the service where these practices are not lawful.

We may update this policy as the product changes. The effective date above shows the latest revision. You can also review the Terms of Service and Abuse Policy.

Joyfold’s monitored abuse email address has not yet been configured. Gift-specific reports can still be submitted from a published gift page. Public gift creation must remain disabled until a monitored address and human owner are assigned.