Personal memories deserve plain, careful rules.

1. Scope and roles

This policy applies to pageandribbon.com, account-free previews, Page & Ribbon accounts, the private studio, checkout, support, the community ideas board, and published gift links. Page&Ribbon determines how account, transaction, security, and service data are used and is the controller of that data.

A gift creator chooses the names, photographs, recordings, stories, and other information added about friends, relatives, recipients, and other people. Creators must have an appropriate reason and any permission required to provide that material. If you appear in a gift and want to raise a privacy concern, use our privacy request form.

2. Information we collect

• Account information: display name, email address, verification state, optional profile image, sign-in provider, provider account identifier, and account dates. A password hash is stored only after password registration or recovery.
• Authentication and security information: session identifiers and expiry, sign-in method and basic scope record, IP address, browser or device information, rate-limit records, and security events. Page & Ribbon requests only Google’s basic openid, email, and profile scopes, does not request Gmail or Drive access, and does not retain Google access, refresh, or ID tokens after the sign-in callback.
• Gift content: recipient and sender names, messages, questions and answers, letters, photos, supported video and audio, captions, transcripts, alt text, design choices, and scene order.
• Service information: draft and publication status, save versions, file metadata, public-link and expiration dates, offline-delivery acknowledgement and export dates, and operational cleanup records.
• Payment information: Lemon Squeezy checkout and order references, store reference, amount, currency, refund amount, status, policy versions accepted, timestamps, and service-email delivery status and provider message reference. We do not receive or store the full card number or a complete checkout URL.
• Support information: contact details, request topic, order reference, message, correspondence, and resolution record.
• Experience feedback: a 1–5 rating, an optional note, the internal page path where it was sent, the feedback form used, and the submission time. The feedback form does not ask for a name or email address.
• Community participation: product ideas, threaded replies, categories, votes, private reports, moderation status, prompt preference, the part of the editor that led to the invitation, and the account identifiers needed to prevent duplicate voting and abuse. Public cards and replies do not display the account holder’s name or email.
• Recipient request information: request time, IP address, device/browser information, requested gift or media path, and security logs generated when a person opens a gift link.
• Optional measurement information: only after the browser allows it, a random visitor ID, a small milestone name, optional template and internal draft identifiers, the consent version and time, and the event time. The measurement event does not contain gift copy, media, answers, email addresses, IP addresses, or full URLs.

We receive information from you, the device or browser interacting with the service, Google when you choose Google sign-in, Lemon Squeezy, and the infrastructure providers that deliver and secure the service. Providing account and gift information is voluntary, but we cannot create an account or provide the requested gift without the information required for that function.

Before account creation, one temporary preview may be kept only in that browser’s local storage. Its words, design choices, and up to four compressed preview photos are not sent to Page & Ribbon as a hosted draft until the visitor asks to keep it and signs in to a verified account. Ordinary network and security logs can still be generated when any page or optional measurement endpoint is requested.

3. Why we use it and our legal bases

We do not make decisions producing legal or similarly significant effects through automated profiling. We do not use private gift content to train generative-AI models or for advertising.

4. Who processes information

We disclose only the information reasonably needed for these providers and purposes:

• Cloudflare: application hosting and delivery, database, private object storage, network security, and operational logs.
• Resend: verification, recovery, security, support, and transaction email delivery.
• Google Identity Services: optional account authentication. If you choose it, Google confirms a stable provider account identifier and verified email and may provide your name and profile image. Google also receives the OAuth request, Page & Ribbon domain, and ordinary network/device information under Google’s own terms and privacy notice. We do not use this connection to read Gmail, Drive, contacts, or calendars.
• Lemon Squeezy: Merchant-of-Record checkout, customer sales tax, financial receipts, payment confirmation, refunds, fraud prevention, chargebacks, and disputes. Lemon Squeezy receives checkout identity, billing, and payment metadata plus an opaque Page & Ribbon attempt reference; it does not receive the private gift title, message, answers, or media from us.
• Have I Been Pwned: compromised-password screening using a privacy-preserving partial hash lookup; the full password and full hash are not sent.
• Professional advisers and authorities: only where reasonably necessary for legal, accounting, security, insurance, or regulatory obligations.

Providers may use their own vetted subprocessors under their terms and data-protection arrangements. We may also disclose information during a genuine business reorganization, subject to confidentiality and continued protection. Page & Ribbon does not sell personal information, rent customer lists, or share personal information for cross-context behavioural advertising.

5. Gift links and recipients

Published gifts are unlisted and marked for search engines not to index, but they are not password vaults. Anyone with the unique link may be able to open or forward it unless the creator adds the optional PIN. We store a salted, one-way PIN verifier rather than the PIN, rate-limit attempts, and issue a short-lived HttpOnly access proof after a successful entry. Changing the PIN or replacing, closing, or restoring the link invalidates earlier access. The public link stops serving the gift 90 days after first publication. The creator’s private studio copy remains in the account unless the creator deletes it or asks us to do so.

Answers selected by a recipient in a gift questionnaire remain in that browser session and are not added to the creator’s draft. Page & Ribbon does not build recipient profiles from those choices. Recipient pages do not interrupt the gift with a measurement prompt. A simple “journey completed” milestone is sent only if that recipient browser had already independently allowed optional measurement, and it does not contain the gift URL or answer choices.

5A. Community ideas are public; private feedback is not

The ideas board is publicly readable. An idea is associated with the submitting account internally for moderation, abuse prevention, privacy requests, and account export, but the public card does not show that account’s name or email. A verified account is required to submit, reply, vote, or report. One account can cast at most one vote on an idea.

Ideas and replies wait for a safety review before publication. Replies may be displayed beneath an idea or beneath one top-level reply, but deeper reply chains are not accepted. Do not include recipient names, gift wording, photographs, recordings, contact details, confidential information, or anything you do not want made public. Reports are visible only to authorized Page & Ribbon reviewers. Private ratings and notes submitted through the feedback form are not placed on the ideas board.

6. Cookies and local browser storage

Essential cookies keep a verified account signed in, bind an optional Google authorization callback to the browser that started it, protect authentication flows, and—when a creator enabled a recipient PIN—remember a successful recipient unlock for up to 12 hours or until the gift expires. The studio uses local browser storage to remember editor layout and panel size. Before sign-in, local storage may also hold one temporary guest preview for up to 24 hours without use. It can include gift text, design choices, and up to four compressed preview photos and is cleared after a successful move into the private studio. With your permission, local storage also remembers a measurement choice and random visitor ID used for the limited first-party milestones described above. If a visitor dismisses or submits the five-minute feedback prompt, local storage remembers that time for 90 days so the prompt does not keep returning. A separate ideas-board preference remembers whether an editor invitation was shown, snoozed, or disabled. When signed in, the disabled or snoozed preference is also stored with the account so it can follow the user between devices. Authenticated gift content and the full private media library are stored in the protected service rather than this guest-preview record. Lemon Squeezy may use its own storage only after you choose to open its checkout. We use no advertising or cross-site behavioural-tracking cookies. See the Cookie Notice to change the choice.

7. How long we keep information

• Account-free preview: kept in that browser until it is moved into an account, cleared through browser controls, or expires after 24 hours without use. Page & Ribbon cannot recover a preview that was never moved into the service.
• Accounts and private gifts: kept while the account remains open so the creator can return, edit, and preserve the work, unless the creator deletes content or asks us to close the account.
• Public gift access: ends 90 days after first publication. Expiration disables the recipient link; it does not automatically erase the private gift.
• Verification and sessions: codes expire after 10 minutes and sign-in sessions normally expire after seven days. Related security records may be kept longer where reasonably needed to detect abuse and investigate incidents.
• Payments, cancellations, and legal records: kept for the period required by tax, accounting, consumer, anti-fraud, and dispute laws.
• Support requests: kept while the matter is handled and afterward for a reasonable period needed to document the resolution and protect legal rights.
• Experience feedback: automatically removed after two years. Individual notes may be deleted or de-identified earlier after they have served their improvement purpose.
• Community ideas and replies: public posts may remain while they are useful to the board or roadmap. Account association, votes, reports, and moderation records are retained while needed for participation, integrity, safety, disputes, and privacy requests. A post may be archived, merged where applicable, removed, or de-identified earlier.
• Optional measurement milestones: kept for up to 13 months, then deleted or aggregated so they no longer identify a browser or draft.

When information is deleted from the active service, limited encrypted or provider-managed recovery copies may remain until the applicable backup cycle expires. We isolate such copies from ordinary use and do not restore deleted content except when genuinely required for recovery, security, or law.

8. International processing

Page & Ribbon is operated from Israel. Providers may process information in Israel, the European Economic Area, the United Kingdom, the United States, and other places where they operate. Where transfer rules require it, we rely on an applicable adequacy decision, contractual safeguards made available by the provider, or another lawful transfer mechanism. You may ask for more information through the privacy contact.

9. Your choices and privacy rights

Depending on where you live, you may have rights to know or access personal information, correct it, receive a portable copy, delete it, restrict or object to processing, withdraw consent, and complain to a privacy authority. Israeli law provides rights of access and correction in qualifying databases. EEA and UK residents may also have GDPR rights, and California residents may have CCPA rights where that law applies, including non-discrimination for exercising them. Because we do not sell or share information for behavioural advertising, there is no sale/share opt-out required for our current practices.

Account holders can correct their name, verified email, password, gift text, and media in the service, and can download a structured copy of account, gift, and community-participation records from the profile. A purchased gift can also be downloaded as a password-confirmed offline ZIP containing its interactive pages and media. For deletion, an objection, or another request, use the privacy request form. We may verify identity and authority before disclosing or deleting information. Some requests are subject to lawful exceptions, including records we must keep for transactions, fraud prevention, or claims.

10. Security

Measures include verified accounts, hashed passwords, protected session cookies, same-origin and ownership checks, signed gift links, upload type and structure validation, rate limits, restricted media delivery, one-use expiring export links, security headers, safe error responses, and payment reconciliation. Downloaded ZIP files and extracted local copies are controlled by the customer’s device rather than Page & Ribbon. No service can guarantee perfect security. Share gift links and offline copies carefully, and avoid uploading information whose exposure could cause serious harm.

11. Children

Accounts and purchases are for adults aged 18 or older. The service is not directed to children. An adult creator who uploads content showing or identifying a child is responsible for having parental or guardian authority and for avoiding sensitive or unsafe information. Contact us if you believe a child’s information was provided improperly.

12. Changes and complaints

We will update the effective date when this policy changes. Material changes affecting an account will be communicated through the service or by email before they take effect where required. You may complain to the Israeli Privacy Protection Authority or the supervisory authority where you live, and contacting us first does not remove that right.

13. Contact

Page&Ribbon · business no. 213723174
10/4 HaDagan Street, Gan Yavne, Israel
support@pageandribbon.com