Last updated: June 2026
When you register for Otiniy Ecards, we collect your name, email address, and a hashed version of your password. We never store your password in plain text.
When you create or view an e-card, we log the action along with your IP address and the date/time. IP addresses are used solely for security and open-tracking purposes.
We do not sell, trade, or rent your personal information to third parties. We may share data with email delivery providers (such as Resend or SendGrid) solely to send transactional emails on your behalf. These providers are bound by their own privacy policies.
When an e-card is viewed, we perform an IP-address geo-lookup using ip-api.com (a free third-party service, no API key or account required). The viewer's IP address is sent to ip-api.com to resolve approximate country, region, and city for open-tracking statistics. We do not control ip-api.com's data handling; please review their privacy policy. Private/local IP addresses are never sent to this service.
Otiniy Ecards uses a single session cookie to keep you logged in. This cookie is HttpOnly, SameSite=Strict, and is transmitted over HTTPS only. We do not use advertising or analytics cookies.
E-cards you create are retained until you delete them or until their expiry date (if set). Account data is retained while your account is active. You may request deletion of your account and associated data by contacting us.
We use industry-standard measures including bcrypt password hashing, CSRF tokens on all forms, HTTPS enforcement, and rate limiting on login attempts. Despite these precautions, no system is 100% secure.
You may request access to, correction of, or deletion of your personal data at any time by contacting us at our contact page.
We may update this policy from time to time. Continued use of the service after changes are posted constitutes acceptance of the updated policy.
Questions about this policy? Contact us and we will respond within a reasonable timeframe.