Privacy Policy

Last updated: September 25, 2026

This policy explains what information Hapipy collects when you use hapipy.com, what we do with it, who else receives it, and the choices you have. A shorter, plain-language overview is on Privacy & safety.

1. Who is responsible

Hapipy is an independent service operated by Ali Tarek (“Hapipy”, “we”, “us”). For anything about your data, contact tarekali192@gmail.com.

2. What we collect

Your account

Your email address, the display name you give us, your mobile number and its country, and your password, which is handled by Firebase Authentication (a Google service) — we never see it in readable form. Your mobile number is stored with your profile; it is visible to you and to Hapipy’s administrator, is not shown to other users, and is not shared with advertisers. We also store when the account was created and whether it has been suspended.

What you put in a world

The world’s name, the date your story started, its invite code and a salted hash of its password; and everything you add: letters, notes, planned dates, hidden memories (and hashes of their passwords), proposals, photos, music, and invitation drafts. This is readable by the members of that world and, technically, by Hapipy’s administrator (see section 5).

What you publish by link

• Shared letters: title, text, the author name you type, an optional photo, and the world name if sent from a world.
• Shared proposals: the question, button texts and messages, and whether it has been answered.
• Invitations: everything you put on the page — names, date, time, venue, address and map link, schedule, story, notes, dress code, photos and music — and a count of how many times it has been opened.

Anyone with the link can see this content. Invitations you choose to list publicly can also appear in search engines.

Replies to invitations

When a guest replies to an invitation, we store their name, whether they are attending, the number in their party, and — if the form asks — a message and dietary needs. Replies are visible to the members of the world that owns the invitation and to Hapipy’s administrator; guests cannot see each other’s replies.

Reports

If you report content, we store the page reported, the reason, any details you write and, if you give it, your email address so we can reply.

Usage records

When a signed-in member uses the app, we record their account ID and world ID once per day, to count active users. Actions taken by the administrator are recorded in an internal audit log.

Technical information

Like any website, our web server receives your IP address, browser and device details and the pages requested. Google receives similar information when Google Analytics, Google Fonts or Google advertising run on a page (see sections 4 and 6).

3. How we use it

• To provide Hapipy: sign-in, worlds, letters, proposals, invitations and replies.
• To keep it secure, prevent abuse, and review reports under our guidelines.
• To answer support requests.
• To understand, in aggregate, how the site is used, so we can improve it.
• To show advertising on some public pages (section 6).
• To meet legal obligations.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on: the performance of our agreement with you (to provide the service); our legitimate interests (security, moderation, support and basic statistics); your consent (for analytics and advertising cookies where consent is required); and legal obligations.

We do not sell your personal information, and nothing you write or upload inside Hapipy is used to target advertising.

4. Who receives it

• Google (Firebase Authentication and Cloud Firestore) — our sign-in and database provider. The database is hosted in the United States.
• Cloudinary — stores and delivers the photos and music you upload. Files are stored at long, unguessable addresses that are not protected by a login: anyone who obtains a file’s exact address could open it.
• Google Analytics — website statistics (section 7).
• Google AdSense — advertising on some public pages (section 6).
• Google Fonts — our typefaces are loaded from Google’s servers, which receive your IP address.
• Our web hosting provider — serves the website and keeps standard server logs.
• Other people, as you choose: the members of your world, and anyone you send a link to.
• Authorities, where the law requires it — in particular, reports of child sexual abuse material.

These providers process data in several countries, including the United States. Where data leaves the EEA or the UK, the providers rely on transfer mechanisms such as standard contractual clauses; their own privacy policies describe the details.

5. Access by Hapipy’s administrator

Hapipy’s administrator has technical access to the data stored in the service, including the contents of worlds. We use it only when needed to provide support you have asked for, investigate a report or a security problem, or meet a legal obligation. Administrative actions are recorded in an audit log.

6. Advertising (Google AdSense)

Some public pages of this website — the home page, the product pages for worlds and invitations, How it works and the blog — may show ads served by Google AdSense. Ads are never shown inside worlds, on letters, proposals or invitations, on sign-in pages, or on our legal pages, and the advertising code is not loaded there at all.

• Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info or, in Europe, youronlinechoices.eu.

In the EEA, the UK and Switzerland, pages that can show ads display a consent message from Google, a consent management platform certified under the IAB Transparency & Consent Framework. Until you make a choice there, Google is told not to use cookies for advertising or analytics on your device. Learn how Google uses information from sites that use its services.

7. Cookies, local storage and analytics

Google Analytics (property G-2NS16T2WCS) measures visits. Before sending a page view we remove the parts of an address that could identify someone — for example, an invitation link is reported as “/i/[invitation]”, and pages inside a world are reported without their titles. Google Analytics runs in Google’s Consent Mode: in the EEA, the UK and Switzerland it does not use cookies until you consent.

Your choices: use the Privacy choices control at the bottom of pages that show ads to change or withdraw consent; delete or block cookies in your browser settings; or install Google’s Analytics opt-out add-on. Blocking the necessary items will stop sign-in from working.

8. How long we keep it

• Account and world content: until you delete it, or until we delete your account at your request.
• Published letters, proposals and invitations: until they are deleted or unpublished. Content created without an account stays until someone asks us to remove it.
• Invitation replies: until the invitation’s owners delete them or the invitation is deleted.
• Reports and the administrator’s audit log: as long as needed to handle the report and keep a record of moderation decisions.
• Daily usage records: these are not currently deleted automatically; you can ask us to delete yours.
• Google Analytics and advertising data: according to Google’s retention settings and policies.

9. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict some processing, and to withdraw consent at any time. Account deletion and data export are handled by request: email tarekali192@gmail.com from the address on your account and tell us what you need. We aim to respond within 30 days. If you are in the EEA, the UK or Switzerland, you may also complain to your data-protection authority.

10. Security

Connections use HTTPS; database rules refuse access to anyone who is not a member of a world; and world and hidden-memory passwords are stored as salted PBKDF2 hashes. No system is perfectly secure, and the limits described above (uploaded files at unguessable but public addresses; administrator access) apply.

11. Children

Accounts are for people aged 18 or over. Guests replying to an invitation do not need an account. We do not knowingly collect personal information from children; if you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

When this policy changes, we update the date at the top. If a change materially affects how we use information you have already given us, we will say so on the site.

13. Contact

Questions or requests: tarekali192@gmail.com.