Privacy & your data

Cake Day is run by [Owner name] (the "data controller" under the GDPR). For any question about your data, write to privacy@example.com.

• Your account: your email address and a securely hashed password. If you sign in with Google, we receive your email address and basic profile from Google — never your Google password.
• Birthdays you add: names, dates, optional notes, and whether you want an email reminder.
• Preferences: your chosen color theme.
• Feedback: any message you send through the feedback form, plus your email if you choose to give it.
• Without an account: birthdays you add are kept only in your own browser on your device. Nothing is sent to us until you sign in.

The birthdays you add are about other people. Please only add information they would be comfortable with you keeping.

• To run the service you signed up for: keep your list, sign you in, and send the reminders you ask for (GDPR Art. 6(1)(b), performance of a contract).
• To read and reply to feedback and improve Cake Day (Art. 6(1)(f), legitimate interest).

We never use your data for advertising and never sell or share it with anyone except the service providers below.

• Supabase — stores the database and handles sign-in.
• Cloudflare — hosts the website.
• Google — only if you choose "Continue with Google"; fonts on this site are also loaded from Google Fonts.
• Resend — sends account and reminder emails.

Some of these providers may process data outside the European Union. Where they do, they rely on safeguards approved under the GDPR, such as the EU Standard Contractual Clauses.

Your account and birthdays are kept until you delete them or ask us to delete your account. Feedback is kept until we've dealt with it, and deleted after that.

You can ask to see, correct, export or delete your data, or object to how we use it. You can edit or remove birthdays yourself at any time in the app. For anything else, write to privacy@example.com and we'll reply within one month.

If you're not happy with our answer, you can complain to your data protection authority — in France, the CNIL.

To delete your account, email privacy@example.com from the address you signed up with and ask for your account to be deleted. We'll permanently remove your account and every birthday and note linked to it, usually within a few days and always within one month, and confirm by email when it's done.

If we change how we handle your data, we'll update this page and the date at the top.