Privacy Policy

Version 1.1 · 25 October 2026

Send a Scratch is built so that the contents of a card cannot be read by the people running it. That is not a promise about our conduct; it is how the software is put together, and the two places where it does not hold are named explicitly below.

1. Who is responsible

DonkeyCat GmbH, Lindengasse 43/19, A-1070 Vienna, Austria, is the controller within the meaning of Art. 4(7) GDPR. Full company details are in the imprint. For any question about this policy or to exercise a right listed in section 8, write to office@donkeycat.com.

We have not appointed a data protection officer; the thresholds in Art. 37 GDPR are not met.

2. How the encryption changes what we hold

When you build a card, your browser assembles the image, the message and any calendar event and encrypts them with AES-256-GCM before anything is uploaded. The key is generated in your browser, is never sent to us, and ends up in the fragment of the link — the part after the #. Browsers do not transmit that part of a URL to servers, so the key cannot appear in a request, a log file or a backup, even accidentally.

The practical consequence: we hold a block of bytes we cannot decrypt. We cannot tell you what a card contains, we cannot produce it in response to a request, and we cannot hand it to anyone else in a readable form. We can delete it.

3. What is stored, and why

Data	Purpose	Legal basis
Encrypted card contents	Delivering the card you asked us to host	Art. 6(1)(b) — performance of the service you requested
Occasion, custom preview image and wording	Rendering the link preview	Art. 6(1)(b)
Language, size in bytes, creation and expiry time	Serving the card and deleting it on schedule	Art. 6(1)(b)
Unlock time and time zone, when you set one	Refusing to release the card before that moment	Art. 6(1)(b)
First and last open time, number of opens	Answering “has the page been opened?” for the sender	Art. 6(1)(b)
A hash of your five-character management code	Checking the code without being able to reconstruct it	Art. 6(1)(b)
A hash of the requesting IP address, plus an hourly counter	Rate limiting; stopping bulk abuse and code guessing	Art. 6(1)(f) — our legitimate interest in keeping the service usable

The IP address is used as a hash and is not stored in readable form. A card record contains no name or email address. If you opt into reply alerts, a separate subscription associates your email address with that card.

Anonymous totals and reactions

We count daily visits, creations, failures, share actions and completed reveals by language, occasion, mobile/desktop and action type to improve the service. We also count coarse source categories (search engine, recipient button, home or occasion page, other website, unknown) and builder steps. Only the category is carried to creation and sharing; raw referring URLs are not included in these metrics. We also count validation stages, reply categories (text, photo or both) and visits to the sender’s reply inbox, without linking those events to a card. These aggregate totals contain no visitor or card identifiers, IP addresses, message text, photos or encryption keys. There is no individual journey profile or cross-site tracking. Optional browser events respect Do Not Track and Global Privacy Control; operational server totals are still counted. Our basis for service measurement is our legitimate interest in understanding and improving its operation (Art. 6(1)(f)).

Recipients may send an anonymous reaction after revealing a card. Only per-card totals for each reaction are stored and shown to its sender (Art. 6(1)(b)); these are not unique-person counts. The reaction totals expire with the card. Opening counts measure page visits, not completed scratches.

Private replies to the sender

A recipient may send a short message and optional photo back to the sender. These are encrypted in the recipient’s browser with the card key; we store only ciphertext, its size and time, and its association with the card. The management code controls retrieval, and the sender’s browser decrypts the reply. This is part of providing the card service (Art. 6(1)(b)). Up to ten replies are allowed per card. Replies expire by the card’s expiry at submission time, so renewing a card does not extend existing replies. Deleting the card also removes its replies. A reply is anonymous unless its author identifies themselves in its encrypted contents.

Optional sender feedback

If you choose to send feedback, we store its category, language, time and optional comment as plain text for up to 90 days, separately from cards. This is readable by our team and used to improve the service (Art. 6(1)(f), legitimate interest). No name or email is requested. Please do not include card links or private card contents. Feedback is not linked to a card or visitor identifier. You may object by contacting office@donkeycat.com; quote your feedback and approximate submission time so we can locate it.

What is not collected

No accounts. An email address is requested only for optional reply alerts. No cookies, no localStorage, no sessionStorage. No individual visitor analytics, no tracking pixels, no advertising, no profiling, no automated decision-making within the meaning of Art. 22 GDPR. Web fonts are served from this domain, so loading a page makes no request to any third party.

4. Retention

• Cards: between 7 and 365 days, chosen by the sender. Deletion is automatic.
• After a card is first opened: retention is at most another 14 days, never beyond the original expiry.
• At any time: whoever holds the management code can delete the card immediately.
• Daily aggregate totals: 90 days. Automatic physical deletion may follow expiry with a delay.
• Rate-limit counters: one hour.
• Server request logs at our hosting provider (timestamp, path, status code, truncated IP, user agent): 30 days.

5. Hosting and processors

The service runs on Google Cloud Run with Google Cloud Firestore, operated by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland, as our processor under Art. 28 GDPR. Compute is in region europe-west1 (Belgium) and storage in the EU multi-region eur3. Google's Data Processing Addendum and the EU Standard Contractual Clauses apply. No other processor is involved, and no data is sold, rented or shared for advertising.

6. Recipients

Anyone you send the link to can open the card — that is the point of it. We do not disclose data to anyone else, except where we are legally obliged to. Note that even under a legal obligation we could only produce ciphertext and the metadata in section 3, because we hold no key.

7. What you put in a card is your call

You choose what goes behind the foil, including whether it contains personal data about someone else. If it does, you are the one deciding that, and the same rules apply to you as to anyone handling another person's data. Please do not use a scratch card as a way of moving sensitive information around — it is a gift, not a vault, and the terms list what may not be uploaded.

8. Your rights

Under Art. 15–21 GDPR you have the right of access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests. Write to office@donkeycat.com.

Two honest limits. First, unless you opted into email alerts, we generally cannot connect your identity to a specific card record — please include the card id from your link. Second, we cannot give you the contents of a card, because we cannot decrypt them; you already hold the only key, in your own link.

You may also complain to a supervisory authority, in Austria the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

9. Children

The service is not directed at children and asks for no age information.

10. Changes

Material changes are published here with a new version number and date. The current version is shown at the top of this page.

Optional reply email alerts

Senders can explicitly request a one-time email when the first reply arrives, after verifying their email address. This optional processing is based on your consent (Art. 6(1)(a) GDPR). We store the address, language, card association, notification-only token and delivery state separately from encrypted cards and aggregate telemetry. Twilio SendGrid receives the email address and notification-only links for delivery; it receives no card or reply content, decryption key or private reply link. Unverified requests expire after 24 hours. Verified requests expire no later than 30 days after confirmation or the card expiry recorded at confirmation, whichever is earlier. Expired records are eligible for automatic deletion. We remove the email address when the reply alert is accepted by the email provider; unsubscribing or deleting the card removes the subscription. You can withdraw consent through the email settings link or the private sender page. Email delivery can fail; keep your private reply link to check replies yourself.