Privacy Policy

Last updated: September 21, 2026

This Privacy Policy explains what information DigiBouquet and its service providers process when you use the website, how bouquet sharing works, and the choices available to you. DigiBouquet does not require an account.

Information We Collect

DigiBouquet does not require a user account. When you create a bouquet, we store the recipient and sender labels, message, selected flower identifiers, greenery identifier, card identifier, background identifier, a random sharing identifier, and the creation time. The builder selects existing visual assets by identifier; it does not accept image uploads or duplicate the image files in each bouquet record.

If you enable password protection, the password is submitted over HTTPS and processed temporarily by the server to create or verify a password digest. The database stores a salted scrypt digest, not the plaintext password.

When you visit any page, our hosting provider may also process ordinary request data such as your IP address, request time, requested path, referrer, browser and device information, and security or diagnostic logs. We use this data to deliver the site, maintain reliability, and prevent abuse.

If you contact us, we process the email address, name, message, and other information you choose to provide. Email and hosting providers may process that information to deliver and secure those services.

Bouquet Links and Personal Messages

New share links use an address in the form https://digibouquet.net/bouquet/{shareId}. The random sharing identifier does not contain the bouquet text or choices, but it acts as a bearer identifier: opening the link asks DigiBouquet's server to retrieve the stored bouquet. An unprotected bouquet can be opened by anyone who has its link.

You can optionally require a password. The recipient's password submission is processed temporarily to verify the stored digest. DigiBouquet does not set an unlock cookie or store the password in the recipient's browser, so the recipient must enter it again after refreshing or reopening the page.

After a protected bouquet is created, the plaintext password remains temporarily in the creator's current browser page so the built-in copy button can copy it. It is cleared when the creator refreshes or leaves the page, starts another bouquet, or closes the tab. The copy button writes a labeled link and plaintext password to the device clipboard. Clipboard history, device synchronization, browser extensions, or other applications may retain or read clipboard contents, so choose the destination carefully. The password is not placed in the share URL or returned by the creation API, and DigiBouquet cannot recover it later.

Password protection controls what the application returns before verification; it is not end-to-end encryption and does not make sensitive information suitable for storage. Do not include secrets, financial information, health information, precise location, or other sensitive personal information in a bouquet.

Older links may use /bouquet#b=...; those links continue to be decoded in the recipient's browser and are not migrated into the database. Still older links may use /create-bouquet?b=.... During a temporary migration period ending October 30, 2026, query-based links redirect to the fragment-based viewer. Unlike a fragment, the full query string in an old query link is sent to DigiBouquet's hosting infrastructure and may appear in request or security logs.

How We Use Information

We process bouquet, request, contact, and diagnostic data to create and display shared bouquets, deliver and secure DigiBouquet, respond to inquiries, investigate reported misuse, understand aggregate site performance, and comply with legal obligations. We do not sell bouquet content or use recipient labels, sender labels, messages, or viewing passwords to create advertising audiences. DigiBouquet does not intentionally include those fields in Analytics events or advertising request parameters.

Third-Party Services

Hosting and database: DigiBouquet is hosted on Vercel, and bouquet records are stored in a Supabase-hosted PostgreSQL database. Vercel may process requests, IP addresses, headers, URLs, and technical logs. Supabase processes the bouquet records and related database operational data needed to store, secure, back up, and troubleshoot the Service. Database credentials are restricted to server-side configuration and are not included in the browser application. See Vercel's Privacy Notice and Supabase's Privacy Policy.

Google Analytics: Google Analytics is enabled across DigiBouquet to measure aggregate site use. For page-view measurement, DigiBouquet sends the site origin and a normalized page path; query strings and URL fragments are removed. A database-backed /bouquet/{shareId} path is reported as /bouquet, so the random sharing identifier is not included in the Analytics page location or referrer. Legacy query and fragment payloads are also excluded from Analytics page-view URLs.

Google AdSense: Google AdSense is enabled on selected pages, including the home page, FAQ, bouquet builder, and the collection and detail pages for Guides, Flowers, and Bouquet Examples. AdSense is not loaded on shared bouquet viewers, About, Author, Contact, Privacy Policy, Terms of Service, Editorial Policy, or error pages. The bouquet builder contains advertising code while a creator makes a bouquet, but DigiBouquet does not intentionally send names, messages, passwords, or bouquet choices as ad parameters.

Google and its advertising partners may place or read cookies, use web beacons, and process IP addresses, device or browser identifiers, page interactions, and ad information to provide, measure, personalize, and secure analytics and advertising services. Google explains this processing in How Google uses information from sites or apps that use its services and the Google Privacy Policy.

Cookies and Tracking Technologies

Cookies are small files stored on a device. Google services and participating third parties may place or read cookies or use similar technologies such as local storage, web beacons, IP addresses, and other identifiers when permitted. DigiBouquet keeps advertising storage, advertising user data, and ad personalization denied by default. Analytics storage is enabled by default outside the European Economic Area (EEA), the United Kingdom, and Switzerland. In those European regions, all Google storage and personalization signals start denied, and Google's certified consent management platform collects the user's choice before consent-dependent Google processing is enabled. While Analytics storage is denied, Analytics may send limited, cookieless measurement pings but may not read or write Analytics cookies. Google's Funding Choices consent tool may load across the site so it can present or reopen the applicable privacy message.

Privacy Choices

Use the Privacy choices link in the footer to reopen Google's privacy message when that message is available in your region. You can also manage personalized advertising in Google Ads Settings, install the Google Analytics Opt-out Browser Add-on, and block or delete cookies in your browser. If no Google privacy message appears, it may not apply in your region.

Data Retention

Bouquets are designed to be stored permanently and have no automatic expiration date. The Service does not currently offer an account-based edit, delete, or self-service removal control. We may remove records in response to a verified privacy request, when legally required, to address misuse, or if the Service is discontinued. Deleted records or operational data may remain temporarily in provider backups and logs according to provider retention schedules. We retain contact correspondence only as long as reasonably needed to answer the request, maintain records, resolve disputes, or meet legal obligations.

Children's Privacy

DigiBouquet is a general-audience service and is not directed to children under 13. Do not put a child's personal or sensitive information in a bouquet link. If you believe a child has sent personal information to us through the contact channel, email support@digibouquet.net.

Data Security

We use reasonable technical and organizational measures appropriate to the Service, including HTTPS, random sharing identifiers, server-only database credentials, database access controls, no-store API responses, and salted password digests for protected bouquets. Protected bouquet content is not included in the page's initial HTML before password verification. No internet transmission or storage method is completely secure. A sharing link is a bearer link, and password protection is an access control rather than a guarantee of confidentiality or encryption.

Your Requests

Depending on your location, you may have rights to request access, correction, deletion, restriction, or objection concerning personal data we control. Contact support@digibouquet.net and include the relevant bouquet URL and the type of request. Do not email the viewing password or sensitive bouquet text. Because DigiBouquet has no accounts, we may need other reasonable information to verify and fulfill a request. For data controlled by Google, Vercel, Supabase, or another provider, use that provider's privacy controls or contact it directly when appropriate.

Changes to This Privacy Policy

We may update this policy as the service or applicable requirements change. We will revise the date at the top when changes are published.

Contact Us

For questions, requests, or concerns about this policy, email support@digibouquet.net or use the contact page.