Privacy Policy

Vivid Flurry is built to know as little about you as possible. No accounts, no cookies, no tracking, no ads. This page explains what little data we do process, why, and your rights under the EU General Data Protection Regulation (GDPR).

Controller

Ajnur Imamovic, Linzer Straße 220, 1140 Vienna, Austria — ai3.htdm@gmail.com

What we process

• If you create an invitation:your email address (to notify you of the answer), the recipient's first name, the occasion (including any custom text you write), optional date options, and your visual theme choices.
• If you answer an invitation: your answer, an optional note, and an optional chosen date. We never learn your name or email address.
• Abuse prevention: a salted, daily-rotating hash of your IP address for rate limiting. Raw IP addresses are never stored, and hashes are deleted after 2 days.
• Server logs: our hosting provider (Vercel) processes IP addresses in short-lived infrastructure logs to deliver the site.

Legal bases

• Providing the invitation service you request — Art. 6(1)(b) GDPR (performance of a contract).
• Rate limiting and abuse prevention — Art. 6(1)(f) GDPR (legitimate interest in keeping the service functional and non-abusive).

How long we keep it

Every invitation and all data attached to it is automatically deleted 7 days after creation. Rate-limiting hashes are deleted after 2 days. Nothing is archived or kept beyond that.

Third-party GIF content

If you choose a GIF from the Giphy search, that GIF is served directly from Giphy's CDN (media.giphy.com). Giphy may log the request, including your IP address, in accordance with Giphy's privacy policy. We have no control over that. If you pick a curated GIF instead, no third-party request is made.

Deleting your data sooner

The notification email sent to an invitation's creator contains a delete link that immediately and permanently removes the invitation and all its data. You can also email ai3.htdm@gmail.com at any time.

Processors and recipients

• Vercel Inc. (USA) — hosting; our app runs in Frankfurt (EU), and transfers are covered by the EU–US Data Privacy Framework and standard contractual clauses.
• Supabase — database, hosted in Frankfurt (EU).
• Resend (USA) — sends notification emails; transfers covered by standard contractual clauses.

Everything else — fonts, animations, GIFs — is served directly from our own infrastructure. Your browser makes no requests to any other third party.

No cookies, no tracking

This site sets no cookies and stores nothing in your browser — that is why there is no cookie banner. We use Vercel Web Analytics for aggregate, cookieless usage statistics (page views by country and device type); it assigns no identifiers, does no cross-site tracking, and cannot identify you.

Your rights

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability (Art. 15–21 GDPR). Contact ai3.htdm@gmail.com. You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).