Privacy policy

What we store

When you make a lifafa, we store:

• The envelope you chose: paper, colour, mithai, coin.
• The two names you typed, and the message you wrote.
• The occasion, or your own heading if you wrote one.
• The amount, and the notes that make it up.
• The recipient's UPI ID, needed to build the payment link.
• If you choose to add one, the twelve-digit UPI reference number. This is optional and you can skip it.
• A one-way salted hash of your IP address, used only to stop abuse. The raw address is never stored.

What we never collect

• Your name for an account. There are no accounts.
• Your phone number or email address.
• Your own UPI ID, bank details, card details or any payment credential. We never see them, because you pay inside your own UPI app.
• Payment screenshots, or photographs of any kind. You cannot upload an image here at all.
• Your location, contacts, or anything from your device.

We cannot see your payment

When you tap to pay, your browser hands off to your UPI app. That app does not report back to us. We receive no confirmation, no status and no transaction record, ever. If you add a reference number, that is you typing it in, not us retrieving it, and we have no way to check whether it is real.

Who can see a lifafa

Anyone with the link. Lifafa links use a long random identifier that cannot be guessed or walked through, and every lifafa page is marked noindex so search engines never list it. Treat the link the way you would treat the envelope: give it to the person it's for.

The private link you keep as the sender is a separate, different token. Someone who has the shared link cannot reach your payment screen.

Cookies and tracking

We use two analytics tools, and they behave differently enough that it is worth separating them.

Vercel Web Analytics records the page, the country, and the kind of device and browser. It sets no cookie and stores nothing on your device. To tell one visit from another within a single day it derives a hash from your request and throws it away daily, so nothing follows you between days, between devices or to any other site.

Google Analytics does set cookies. Two of them, named _ga and _ga_WDKX62E555, which hold a random identifier for this browser and last up to two years. That identifier is what lets Google count you as one returning visitor rather than several new ones, so unlike the tool above, it does follow you between visits on this device. The data goes to Google and is subject to their terms as well as this policy.

What we do not do with it: we run no advertising, we have not turned on Google Signals or ads personalisation, and we do not build profiles or remarketing audiences. Google Analytics does not store your full IP address, and we never send it your name, your message, the amount, or any UPI ID.

If you would rather not be counted at all, browser tracking protection, an ad blocker or Google's own opt-out add-on all stop it, and nothing on this site breaks if you do. We would rather say this plainly than hide it behind a banner you click to make go away.

Sharing

We do not sell, rent or share your data with anyone. The only exception would be a lawful order from a competent authority, or where we must act on a report of abuse.

How long we keep it

A lifafa stays until you ask us to delete it. Email us the link from the contact page and we will remove it.

Children

This site is not directed at children under 13, and we do not knowingly store information from them.

Changes

If this policy changes we will update the date at the top. Material changes will be called out on the home page.