Privacy

MakeItForThem stores the page you make so the person you send it to can open it. There are no accounts, no analytics, and no advertising. There are also things it genuinely does not protect, and those are spelled out below rather than glossed over.

Everything you type into the builder, because the page is rebuilt from it:

• the two names, your message, the question, and the button and reply wording
• your colour, page style and any Pro story choices
• the photos you upload
• a count of how many times the page has been opened
• the date it was made

If you set a password, it is stored as a bcrypt hash, not as the password itself. Nobody — including whoever runs this site — can read it back.

Pages are not listed anywhere, not searchable, and marked so search engines skip them. But the link is the key: anyone who has the link can open the page, and a link forwarded to someone else works just as well. Treat it like a photograph you handed over, not like a locked drawer.

Turning on password protection means the contents are not sent to a browser until the password is proven, so the link alone is not enough.

Uploaded photos are held in public file storage. The web addresses are long and random, so they are not practically guessable and are not indexed — but they are not access controlled. A password protects the page, not the individual image files. If someone obtains a direct image address, it will open.

If that matters for a particular photo, it is safer not to upload it.

If the person you sent it to answers, what is stored is the answer, any note they chose to write, and the time. No IP address, no device or browser details, no location, and no read receipts. Writing a note is optional, and the page says plainly that it goes to you before anything is typed.

Replies are reached through a private link shown to you once, right after you publish. It cannot be worked out from the public page address.

Pro is a single payment handled entirely by Stripe. Card details are entered on Stripe’s own checkout and are never seen by or sent to this site. What is kept here is the email you give after paying and the Stripe session reference, which is how Pro is recognised again later.

• Supabase — hosts the database and the uploaded photos.
• Stripe — processes Pro payments.
• The hosting provider serving this site, which keeps ordinary server logs.

Each has its own privacy policy governing what it does with that data.

No cookies are set and no analytics or tracking scripts run. Three things are kept locally in your own browser and never sent anywhere: your Pro email so Pro stays unlocked, the list of pages you have made on that device, and a note of which pages you have already opened so the envelope does not replay.

Clearing your browser data removes all three — including your saved list of pages.

There is no self-serve delete yet, and no support inbox — inventing one here would be worse than saying so. The working route is to open an issue on the project’s GitHub with the page link. Do not put anything private in a public issue.