Privacy
Birthday Book exists to help families remember birthdays. That means you'll tell us about people you love — so we hold ourselves to a simple rule: we store the minimum, we sell nothing, and you can delete everything. This page is the whole of it, in plain English.
Who we are
Birthday Book (birthdaybook.app) is run by The Online Studio 24 Limited — registered in England and Wales, number 06298699, registered office 18 Brushwood Drive, Chorleywood, Rickmansworth WD3 5RT — which is the data controller for everything described here. Questions, requests, complaints: hello@birthdaybook.app. If you're not happy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk).
What we store, and why we're allowed to
- Your account — name and email address, and how you like to be paid back after group presents if you tell us. Legal basis: performing our contract with you (UK GDPR Art. 6(1)(b)).
- Your book— your household, its members, and the people you add: name, birthday, country, relationship, interests, notes, gift ideas and who's getting what, messages on a birthday card wall, and (only if you use gift-card or printed-card sending) a delivery address or email. Basis: contract for your own data; legitimate interests (Art. 6(1)(f)) for family members who haven't signed up — see the next section.
- Forwarded invites— if you forward an email to your book's address we keep the text needed to extract the date and name, then show it to you for checking. Basis: contract.
- How you found us— if you arrive from one of our ads or links, the tags on that link (campaign name, Google's click id) are saved with your account, on our servers, once. Basis: legitimate interests (knowing whether our advertising works). Kept at most 13 months, then deleted automatically.
- Page counts — cookieless, aggregate counts of which pages are visited (via our host, Vercel). No identifier, no profile, nothing that follows you anywhere. Basis: legitimate interests.
Other people's details
Most people in your book haven't signed up themselves — you've added Grandad. We process those details under legitimate interests (Art. 6(1)(f)): the same address-book use the law has always allowed families. The details stay inside your household — and a connected family's book only ever sees a person you explicitly chose to share. They are never shown to anyone else, used for advertising, or sold. Every email we send about someone says where the data came from and how to object. Anyone can ask what we hold about them or have it removed: hello@birthdaybook.app.
What “no tracking” means here
No third-party analytics pixels, no advertising trackers, no marketing cookies, nothing cross-site — not from us, not from anyone we embed. No selling or sharing data with data brokers. No AI training on your family's data. When we suggest gifts, the suggestion is generated for you and thrown away — retailers never learn who the gift is for. When we measure our own ads, it works the other way round from the industry: nothing is planted on your device; our server notes which ad brought you and later tells Google only “that click became a sign-up”.
Cookies
Two, both first-party, both for the site to work: one keeps you signed in (essential), one remembers the email address you last signed in with on that device so you don't retype it (kept 90 days). That's the list — which is why there's no cookie banner.
Who handles data for us
A short list of processors, each doing one job under a data processing agreement: Vercel (hosting and the cookieless page counts), Neon (the database, hosted in the EU), Resend (delivering our emails), Anthropic (reading forwarded invites and writing gift suggestions — contractually no training on your data), Prodigi(printing and posting a card — they receive the card and the recipient's name and address only when you order one), Tremendous(sending a gift card — they receive the recipient's email and the amount only when you send one), Google(only if you choose “Continue with Google” to sign in; and our ad reporting described above), and GIPHY (GIFs on a card wall load from their servers when a page shows one). Where a processor is in the US, transfers rest on the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.
Retailer links
Gift links go to retailers' own sites; from that point their privacy policy applies. Some links earn us a commission — see how we're funded. We pass no personal data to retailers — only the search term.
We send the reminders you asked for and a monthly family digest. Every email has an off switch, and reminders stop automatically once a birthday is sorted. The “keep me posted” letter from the homepage is consent — one click and it stops.
How long we keep things
Your book: until you delete it. Sign-in links: one hour. Ad-attribution rows: 13 months. Deleted data is gone immediately from the live database and rolls out of backups within 30 days.
Children
Children don't have accounts. Their birthdays are added and looked after by the adults in their family, like entries in a paper address book.
Your rights
Access, correction, deletion, portability, objection — all of them, without charge. Most are self-service: edit or remove anyone from their page, export everything you can see from Settings, or delete your whole account and household in one confirmed tap (immediate and real). For anything else, or if you're in someone else's book and want out, email hello@birthdaybook.app — we answer within a month, usually much faster.
Changes
If this page changes in a way that matters, signed-in members get an email saying what changed and why.
Last updated 20 August 2026.