What we know about you, and what we don't.

Who we are

ApnaSurprise is operated by Pawan Kushwah, at Tiwariganj, Lucknow, Uttar Pradesh, 226028, India. For anything on this page, write to apnasurprise@gmail.com.

What we collect

When you build a gift

The gift itself: the recipient's first name, your name, the relationship and occasion you picked, whatever you write, the photos you upload with their captions, the soundtrack you choose, and the PIN protecting it — as a one-way hash, never the digits themselves. This is the product — we cannot store a gift without storing the gift.

You do not need an account to do any of this. A draft is tied to a signed cookie in your browser rather than to an identity.

When you pay

Your email address and phone number, the plan and add-ons you chose, the amount, and the identifiers Razorpay gives us for the order and payment.

We never see your card. Card details are entered on Razorpay's own checkout and go straight to them. Nothing resembling a card number, CVV or UPI PIN reaches our servers or our database.

When you make an account

Your name, email address, and a password we store only as a hash — we cannot read it, and a reset link is the only way back in.

When you apply to the partner programme

Your name, email address, where you told us your audience is, what you wrote about how you would share this, and a phone number if you chose to add one. We keep the IP address the form was sent from, which is the only way to recognise one person filing forty applications.

We use it to decide on your application and to reply to you. Nothing is sent to you automatically — a person writes back — and it is never sold, shared or used to market anything at you. It is not connected to any gift or order, and it is never visible in the partner portal: partners see totals for their own codes and nothing else, including nothing about anybody who has applied.

While you use the site

If you allow it, which step of the builder you reached, the occasion you picked, the page path, the referring site, and a random session id that lets us tell one visit's steps apart from another's. It carries no name and no email. If you decline, none of it is collected — see cookies below.

A published gift also counts how many times it has been opened. That is a single number on the gift, for the person who made it. We do not log who opened it, when, or from where.

What never leaves

This part is enforced in code, not by policy:

• The AI drafting helper never reads your gift. When you ask for suggested words, what we send is the occasion, the relationship, the tone, the language, and up to four short fragments you typed as hints. The recipient's name, your name, the finished message, the photos, your email and your phone are all withheld — the model writes a placeholder and your browser substitutes the real name locally, so a name never crosses the wire. The request schema strips anything else, so it cannot happen by accident.
• Link previews contain no gift content. The card that appears when you paste a gift link into a chat is generated text only — never one of your photos — because a forwarded link would otherwise leak the gift into every group it passes through.
• Location and camera data are stripped from your photos. A phone photograph normally carries EXIF metadata — GPS coordinates, the device, the exact moment it was taken. Your browser re-encodes each photo before it is uploaded, which keeps only the pixels, and the server walks every JPEG, PNG and WebP again on arrival and drops the metadata blocks it finds. Colour profiles are kept, because those affect how the photo looks and say nothing about you. The one exception is a HEIC file your browser could not re-encode, which we store as it arrived — rare in practice, because the phones that produce HEIC are the ones whose browsers can re-encode it.
• Every gift is locked with a PIN by default, free, on every plan. You choose the digits and you can turn the lock off; if you leave it on, a forwarded link is not enough to see your photographs. We store the PIN as a slow one-way hash, so we cannot read it back to you — only replace it, which you can do from My gifts at any time.
• Gifts are not indexable. Every gift page is served with noindex, nofollow and excluded in robots.txt, so a shared link cannot turn up in a search result.
• We do not sell or rent anything to anyone, and we run no advertising or third-party tracking pixels.

Cookies and storage

Three kinds, and only one of them is a choice.

Essential — always on. A signed cookie recording which gifts belong to this browser, so you can find what you built without an account; and a session cookie if you sign in. Refusing these would lock you out of something you paid for, so we do not offer that as an option. They contain no advertising identifiers and are readable by nobody but us.

Referral — only if you arrived through a partner's link. A signed cookie holding that partner's code and the time you first opened the link, which expires after 48 hours. It is how a partner is credited for a gift you start in that time without you having to keep their code in the discount box. It holds nothing about you, nobody but us can read it, and it is never set on a gift page.

Notifications — only if you tap Allow. Nothing is asked for when you arrive. If you choose to turn notifications on, your browser gives us an address at its push service, which we store with a rough label for the browser (“Chrome · Android”), when you last visited, and which gifts this browser made — so a reminder about an unfinished gift reaches the browser that started it. A signed cookie holding only that subscription's id lets a new draft be linked to it. If you press “Not now”, we remember when in local storage so we don't ask again for a month. Notifications never contain the name of the person a gift is for. Turn them off at any time on the notifications page, with the “Turn off” button on a notification, or in your browser's settings — the cookie is removed and nothing more is sent.

Measurement — off until you say yes. The step-by-step builder analytics described above, plus the random session id it uses, stored in your browser's session storage. Nothing is written or sent until you accept the banner, and choosing “No thanks” keeps it off permanently on that browser. Your answer is remembered in local storage under sm_consent; clearing site data will ask you again.

There are no cookies from ad networks, social platforms or analytics vendors, because we do not embed any.

Who else touches your data

Only the services that make the product work, each doing one job:

Razorpay

Takes the payment. Receives your email, phone and the amount; handles your card details entirely on their own systems.

Cloudflare R2

Holds the photos you upload, so gift pages can serve them. Each file is stored under a random 32-character name, and a locked gift does not hand those addresses to the browser until the PIN has been accepted — so somebody who cannot open the gift never learns where its photos live. The files themselves are served without a second password, which is the honest limitation: a photo URL, once someone has it, keeps working until the gift is deleted.

Resend

Sends the receipt with your gift link, and password-reset emails. Receives your email address and the link.

Google (Gemini)

Generates suggested wording, under the strict limits described above. Never receives your gift, your name, or the recipient's.

Upstash

Counts requests for rate limiting, so one person cannot brute-force a gift PIN. Stores a hashed key, not an identity.

Your browser's push service

Only if you turn notifications on. Google (Chrome and most Android browsers), Apple (Safari), Mozilla (Firefox) or Microsoft (Edge) delivers each notification to your device. The message is encrypted so that they can deliver it but not read it.

Netlify

Hosts and serves the site.

Some of these operate outside India, so your data may be processed abroad. We use them under their standard terms and send each the minimum it needs to do its job.

How long we keep it

• Published gifts — for as long as the gift exists, because the whole point is that the link keeps working. Deleting a gift from My gifts takes it offline immediately.
• Photographs — deleted from storage when you delete the gift. Not hidden, not orphaned behind a URL that still works: the stored files are destroyed and cannot be recovered, by us or by anyone who once had the link. This is irreversible, which is why the confirmation says so.
• Drafts you never paid for — kept so you can come back and finish, and removed during routine cleanups.
• Orders and receipts — retained as long as tax and accounting law requires, which we cannot delete on request.
• Sessions and reset links — expire on their own; reset links work once.
• Notification subscriptions — until you turn notifications off, or your browser tells us the subscription has ended. After you turn them off we keep a note that this browser said no, and nothing else is sent to it. The record of each individual notification sent is deleted with the rest of our analytics.
• Partner applications — kept while we decide, and after that as the record of a decision we may have to explain. Ask us and we'll delete yours; if it was approved, the partner account and what it has earned are separate records and stay.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it — including your account and every gift on it. Write to apnasurprise@gmail.com from the address on the account and we will act within 30 days. Deleting a published gift breaks its link permanently; we will say so before doing it, not after.

If you would rather not be measured at all, decline the banner — no account or email required.

Children

This is not a service for children. We do not knowingly collect data from anyone under 18, and if you believe a child has sent us information, write to us and we will remove it.

Complaints

Our grievance officer is Pawan Kushwah, reachable at apnasurprise@gmail.com. If something about how we handle your data is not resolved to your satisfaction, you may escalate to the Data Protection Board of India.

Changes

When this page changes in substance we update the date at the top. The wording lives in version control, so every revision is dated and reviewable rather than quietly swapped.