Privacy Policy

The short version

• 🌷You can play the daily puzzles with no account and no sign-up.
• 🌷To create a gift, we collect what you give us: your name, the recipient's name, and — depending on how you choose to deliver it — the recipient's email or phone number, plus your personal message and any photo you upload.
• 🌷We use trusted processors to run the service: Supabase (database + accounts), Stripe (payments), Resend (gift emails), our hosting provider, and — when enabled — Anthropic (to help author custom puzzles) and an analytics tool.
• 🌷Gifts are reached through an unguessable private link (`/g/<id>`). Anyone who has that link can open the gift, so share it only with the recipient.
• 🌷We do not sell your personal information, and we don't show tracking/analytics until you agree (where consent is required).
• 🌷You can ask us to access or delete your information at any time at [email protected].

Information we collect

Information you give us

• 🌷Account details (optional): if you sign in to save streaks and stats, we collect your email address through our authentication provider (Supabase) and a display name.
• 🌷Gift content: the recipient's name, your name (as sender), the occasion, your personal message, the "reveal" text, and the answers/clues you provide that we turn into the puzzles.
• 🌷Recipient contact details: if you choose email or scheduled delivery, the recipient's email address; if you choose text delivery, the recipient's phone number (used to pre-fill a message you send yourself from your own device).
• 🌷Photos: any image you upload to include in the gift reveal.
• 🌷Payment information: when you buy a gift, your card details are collected and processed directly by Stripe. We do not receive or store your full card number — only limited confirmation data (such as that a payment succeeded).

Information we collect automatically

• 🌷Device and log data: basic technical information such as IP address, browser type, and pages requested, kept in standard server logs by us and our hosting/processor providers for security and reliability.
• 🌷On-device storage: we store puzzle progress, streaks, and your cookie/analytics choice in your browser's local storage. This stays on your device and is not, by itself, sent to us.
• 🌷Analytics (only when enabled and, where required, after you consent): if analytics is turned on, [ANALYTICS PROVIDER] collects usage events (for example, which puzzles are played and general interaction data) to help us improve the site. See Cookies & analytics.

Information about other people (recipients)

When you create a gift, you give us personal information about someone else — at minimum the recipient's name, and often their email or phone number, plus a message and photo that may relate to them. This is central to how the product works, so please read this carefully.

• 🌷By providing a recipient's details, you confirm you have a genuine personal relationship with them and a lawful basis to share their information with us for the purpose of sending them a gift.
• 🌷We use recipient information only to create, deliver, and display the gift you made — not for our own marketing.
• 🌷If you are a recipient and want to know what a gift about you contains, have it corrected, or have it deleted, contact us at [email protected] (you can also ask the person who made it). We will honor verified requests as described in Your rights.

How we use your information

• 🌷To provide the daily puzzles and save your progress, streaks, and stats.
• 🌷To create, preview, deliver, and display the gifts you make — including generating the custom puzzles and showing the reveal.
• 🌷To process payments and prevent fraud (through Stripe).
• 🌷To send transactional email — chiefly the gift email to a recipient you chose to email.
• 🌷To operate, secure, debug, and improve the service, and to understand aggregate usage (analytics, when enabled).
• 🌷To comply with law and enforce our Terms of Service.

Legal bases (EEA / UK users)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR/UK GDPR:

• 🌷Performance of a contract — to provide the puzzles and deliver the gifts you ask us to create.
• 🌷Legitimate interests — to keep the service secure, reliable, and improving (balanced against your rights).
• 🌷Consent — for non-essential cookies/analytics, and where otherwise required; you can withdraw consent at any time.
• 🌷Legal obligation — to meet tax, accounting, and other legal requirements.

Third-party services we share data with

We use a small set of vendors ("processors") to run Bailey's Tulips. Each receives only the data needed for its function, and each is bound by its own terms and privacy commitments. We do not sell personal information to anyone.

• 🌷Supabase — database and authentication. Stores gift content (including recipient details, message, and photo) and, if you sign in, your account and game results.
• 🌷Stripe — payment processing. Receives your payment and billing details directly to charge for a gift.
• 🌷Resend — email delivery. Receives the recipient's email address and the gift email when you choose email/scheduled delivery.
• 🌷Anthropic — AI puzzle authoring (only when enabled). When the operator enables AI generation, the answers and personal details you provide for a gift may be sent to Anthropic's API to compose the custom puzzles. Under Anthropic's commercial terms, API inputs are not used to train its models. If AI generation is off, gifts are built from curated templates and nothing is sent to Anthropic.
• 🌷Hosting/infrastructure provider — serves the site and keeps standard logs.
• 🌷[ANALYTICS PROVIDER] — usage analytics, only when enabled and (where required) after consent.

We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a merger or sale of the business (you'll be notified of any change in control of your data).

Public gift links

Every gift lives at a private link of the form `/g/<id>`, where `<id>` is a long, randomly generated value that is not listed anywhere and is impractical to guess. Anyone who has the link can open the gift and see its contents (recipient and sender names, your message, the photo, and the puzzles). This is by design, so a recipient doesn't need an account to open their gift.

• 🌷Treat the link like a key: share it only with the person it's for. Anyone you forward it to can view the gift.
• 🌷We ask search engines not to index gift links, so they should not appear in search results, but a link is still viewable by anyone who has it.
• 🌷If a link is shared more widely than you intended, contact us at [email protected] and we can delete the gift.

Cookies & analytics

We use a small amount of browser storage that is strictly necessary to run the site — for example, to keep you signed in, remember puzzle progress, and remember your cookie choice. These don't require consent.

If and when analytics or other non-essential tracking is enabled, we ask for your consent first where the law requires it (for example, in the EEA and UK). You'll see a banner letting you accept or decline; nothing non-essential runs until you accept. You can change your choice at any time using the Cookie preferences control on this page or in the site footer.

How long we keep information

• 🌷Gift content is kept so the recipient can open the gift, and for a reasonable period after, then deleted or anonymized (target: [RETENTION PERIOD]). You can ask us to delete a gift sooner at any time.
• 🌷Account data and game results are kept while your account is active; delete your account and we remove them (subject to limited legal/operational retention).
• 🌷Payment records are retained by Stripe and by us as needed for tax, accounting, and fraud-prevention obligations.
• 🌷Logs and analytics are kept for a limited period for security and product purposes.

Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. This applies to both givers and recipients.

• 🌷To exercise any of these, email [email protected]. We may need to verify your identity before acting.
• 🌷Recipients: you can ask us to delete or correct a gift made about you even if you didn't create it.
• 🌷You can withdraw cookie/analytics consent anytime via the Cookie preferences control.
• 🌷If you're in the EEA/UK, you may also complain to your local data protection authority. California residents have rights described in California privacy rights.

Children's privacy

Bailey's Tulips is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 13 (or under the minimum age in your country, such as 16 in parts of the EEA). Accounts and purchases are for adults only.

• 🌷Givers sometimes create gifts that mention or depict children (for example, a baby reveal or a child's birthday). If you upload a photo of or details about a child, you confirm you are the child's parent or legal guardian, or have that person's permission, and you are responsible for that content.
• 🌷If you believe a child has provided us personal information directly, contact [email protected] and we will delete it.

Security

We use reputable providers and reasonable technical and organizational measures to protect your information, including encryption in transit and access controls on our database. No method of transmission or storage is 100% secure, so we can't guarantee absolute security — but we work to protect your data and to notify you and regulators of breaches where required.

International data transfers

We and our processors may store and process information in the United States and other countries. Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses). If you have an EEA/UK representative requirement, our representative is [EU/UK REPRESENTATIVE].

California privacy rights

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, to request deletion and correction, and to opt out of "sale" or "sharing" of personal information. We do not sell your personal information and do not share it for cross-context behavioral advertising. To exercise your rights, email [email protected]. We will not discriminate against you for exercising them.

Changes to this policy

We may update this policy as the product and our practices evolve. We'll change the "Last updated" date above and, for material changes, provide a more prominent notice. Continuing to use the service after an update means you accept the revised policy.

Contact us

Questions, requests, or concerns about privacy? Email [email protected] or write to [LEGAL ENTITY], [MAILING ADDRESS]. For general support, use [email protected].