Privacy Policy.

Current account service

Email sign-in stores your verified email, account type, verification time and secure session records in Cloudflare D1. Resend delivers the sign-in code. Codes expire after 10 minutes and are stored as protected hashes; session tokens are also stored as hashes. Session cookies are essential for sign-in and expire after seven days unless you sign out earlier.

Sign-in does not subscribe you to reminders. Brand approval emails and optional customer reminders are still being activated. Reminder emails will bring you back to this website; they will never contain reward coupon codes. For account help or deletion requests, contact sohamvermaah43@gmail.com. Other planned features and policy placeholders below remain under review.

1. Who is responsible

[Registered business name] operates EverMinute and determines how personal data is used. Registered address: [Registered business address, state, PIN, India]. Privacy and grievance contact: [Grievance contact name and email]. Effective date: [Date].

2. Information we use

The planned service collects verified email and sign-in identifiers; brand and founder details; uploaded media; billing details; selected minute and offer settings; follows and requested reminders; and records of reward reveals and store clicks.

For reliability and abuse prevention, service logs may include request time, device/browser details, network address and security events. Use proportionate retention and avoid storing raw identifiers in analytics when aggregated or short-lived values will do.

• Private: account email, authentication records, uploaded unique codes, billing details and individual reveal records.
• Public after approval: the brand profile, founder name and photo, public contact information, media, reserved minute and advertised offer details.
• Payment card credentials are handled by the payment provider. They must not be collected or stored by this site.

3. Why data is processed

We use data to authenticate accounts, review brands, manage reservations and payments, deliver rewards, provide requested reminders, prevent abuse, answer support requests, and meet legal obligations.

Brand results should describe engagement through counts and appropriately protected unique-visitor measures. Brands must not receive visitors’ private emails or raw browsing histories merely because a person viewed or revealed a drop.

4. Service providers and sharing

Cloudflare hosts this service and its database; Resend delivers transactional email. Planned image storage, Google sign-in and payments may use Cloudflare R2, Google and Razorpay. Confirm all active vendors, their roles and cross-border processing arrangements before publication.

A link to a brand’s store takes you to another website with its own privacy notice. We do not sell account contact lists. Data may be disclosed when legally required or necessary to protect users and the service.

5. Cookies and analytics

Essential secure session and request-protection cookies are used for sign-in. Optional analytics or marketing technologies must be disclosed and controlled before being introduced. This preview does not include an advertising tracker or behavioural advertising.

The intended visitor analytics are aggregate and privacy conscious. Finalise the exact events, identifiers, retention and any consent requirements before enabling them.

6. Emails and choices

Security and service emails relate to accounts, claims or payments. Visitor reminder emails are sent only when requested, with an unsubscribe link. Unsubscribing from reminders does not prevent essential security or payment messages.

Choose and change followed brands and reminder timing in your account when available. Consent to optional communications must be separate from account access.

7. Retention and security

Keep account information while needed to provide the service; keep public brand profiles under the permanent-wall commitment unless removal is warranted; keep invoices and payment records for the legally required period. Set and publish exact retention periods for event logs, reveal records, OTPs and backups: [Retention schedule].

Use access controls, short-lived authentication codes, encrypted transport, server-side checks and restricted storage access. No system can promise absolute security. Account deletion may leave legally required records and restricted backup copies until their scheduled expiry.

8. Your requests

Contact sohamvermaah43@gmail.com to ask about access, correction, deletion, consent withdrawal, nomination or grievance rights available under applicable law. We may verify your identity before action. Explain any legal retention obligations or service effects rather than promising unconditional erasure.

The service is not intended for children below the stated account age policy. Confirm the age policy and any legally required parent/guardian process before launch.