Privacy Policy | theBouquet

1. Information We Collect

theBouquet does not require an account to use. We collect the following information:

Bouquet Data: The bouquets you create, including images, text messages, optional voice message URLs and durations, recipient names, and sender names.
Voice Message Data: If you are a supporter and attach a voice message, your recording is uploaded to a storage provider and linked to your bouquet so recipients can play it from the bouquet link.
Usage Data: Google Analytics and Google Tag Manager are used to collect anonymous usage statistics to improve the service.
Custom Uploads & Content Moderation: When you upload custom images to the platform, these images are briefly processed using automated third-party moderation services (such as Google Cloud Vision) strictly to detect and prevent the upload of inappropriate, violent, or adult content. These uploads are retained on storage providers to serve your virtual bouquet links, but are not used for AI training purposes.
Email Addresses: If you are a supporter and choose to send a bouquet via email, the recipient's email address is used solely to deliver the notification and is not stored. If you buy theBouquet a coffee via Ko-fi, your email address is received via webhook and used solely to deliver your supporter unlock link. It is stored as part of your supporter record — see Section 6 for retention details. If you submit a payment receipt via email or Instagram DM for the InstaPay option, your email address is collected solely to deliver your supporter unlock link and is stored as part of your supporter record. Receipt screenshots are reviewed for verification purposes only and are not retained after processing.
Spam Protection Data: Cloudflare Turnstile is used to protect the service from automated abuse. This may collect behavioral signals and device information as part of Cloudflare's bot detection. See Cloudflare's Privacy Policy for details.
Rate Limiting Data: Your IP address is temporarily processed to enforce daily usage limits and ensure fair access for all visitors. IP addresses used for rate limiting are not stored beyond what is necessary for this purpose and are not linked to your identity.
Supporter Data: If you buy theBouquet a coffee via Ko-fi, a unique token, your Ko-fi email, and an optional expiry date are stored to verify your status. This is tied to your browser's localStorage.

2. How Your Information is Used

To provide the bouquet creation and sharing service.
To store and deliver optional supporter voice messages to recipients through bouquet links.
To display your public bouquets in the Showcase gallery and use them for marketing or promotional purposes (only if you opt in).
To send bouquet notification emails to recipients you specify (available exclusively for supporters).
To protect the service from spam and automated abuse.
To improve the performance and reliability of the site.

3. Third-Party Services

theBouquet utilizes the following third-party services:

Cloudinary: To store and serve bouquet images.
Supabase Storage: To store and serve optional supporter voice message files and bouquet data.
Google Analytics & Tag Manager: To collect anonymous usage statistics.
Cloudflare Turnstile: To protect the service from spam and automated abuse.
Vercel: For hosting and deployment.
Brevo: To deliver bouquet notification emails to recipients you specify, and to send supporter unlock links.
Google Cloud Vision: To automatically moderate custom uploaded image content.
Ko-fi: Used to process coffee treats and deliver supporter perk unlock tokens.
Upstash: Upstash (Redis) is used to enforce daily bouquet limits per visitor. IP addresses are processed transiently to track usage counts within a 24-hour window. See Upstash's Privacy Policy for details.

4. Cookies

Essential cookies required for the service to function are used, as well as cookies set by Google Analytics and Cloudflare Turnstile for anonymous analytics and spam protection. localStorage is utilized to store your supporter status token. Cookies are not used for advertising purposes.

5. Data Sharing

theBouquet does not sell, trade, or rent your information to third parties. Data is only shared with the third-party services listed above, strictly for the purpose of providing the service.

6. Data Retention

A 30-day data retention policy is enforced for bouquets created by free visitors to maintain server stability. After 30 days from creation, free bouquets expire. Once expired, the bouquet image is removed, but the letter/message remains available through the original link. Supporter bouquets have no fixed expiration date and remain stored for as long as theBouquet is operational and sustainable. This is not a perpetual guarantee — if conditions change, advance notice will be given before any retention policy is applied to existing supporter bouquets.

Supporter tokens and associated Ko-fi email addresses are stored to preserve access to your exclusive rewards. For new supporter tokens, an expiry date is also stored so the 3-month access can be validated. Legacy supporter records created prior to April 9, 2026, have no expiry date and remain grandfathered. You may request deletion of your supporter data or specific bouquet data manually by contacting support with your bouquet link, understanding that this will permanently revoke your supporter perks and access to deleted creations.

7. Your Rights

You have the right to:

Request information about the data held related to your bouquets.
Request deletion of your bouquet data.
Request deletion of your supporter data (Ko-fi email and token), understanding this will revoke your supporter perks.
Withdraw consent at any time.

8. Children's Privacy

This service is not directed to children under the age of 13. Personal information from children under 13 is not knowingly collected.

9. Changes to This Policy

This Privacy Policy may be updated from time to time. A notice will be posted on the site for any significant changes.

10. Contact Us

If you have questions about this Privacy Policy, please reach out at thebouquetsite@gmail.com.