Privacy Policy

Moment Acclaim (“Moment Acclaim”, “we”, “us”) lets you create personalized digital celebrations, such as birthday and anniversary “moments”, and share them through a private link. This policy covers the website at www.momentacclaim.com and the services on it (the “Service”).

The Service is operated by Moment Acclaim. For personal data about account holders, we are the “controller” (GDPR / UK GDPR) and the “business” (California law). You can reach us about privacy at support.momentacclaim@gmail.com.

• You sign in with Google. We receive your name, email address, and profile picture link from Google. We never see your Google password.
• The names, messages, memories, dates, and photos you put in a moment are stored so we can show them to the people you share the link with.
• Anyone who has a moment’s link can view it during its viewing window. Treat the link like a key and share it only with people you trust.
• We do not sell your personal information, show ads, or use advertising or analytics trackers.
• We only use cookies that are needed to keep you signed in.
• When a moment’s viewing window ends, the page stops showing it to visitors, but the content is not deleted automatically. You can ask us to delete it at any time.

Account information (from Google)

When you sign in with Google, Google shares basic profile information with us: your name, email address, profile picture link, and a Google account identifier. Our authentication provider also creates a user ID and keeps sign-in records (such as sign-in times, and the IP address and browser details of sign-in sessions) to run and secure your session. We store your name and profile picture link in your profile, together with your moment allowance and, if you joined through a referral link, who referred you.

Moment content you create

When you create a moment, we store what you enter, which can include:

• the recipient’s name and your relationship to them (for example partner, parent, child, or friend);
• personal messages, letters, stories, memories, captions, and “about” text;
• occasion dates (birthday or anniversary date, relationship start date, years together) and the tone you chose;
• photos you upload, and file names based on the recipient’s name or the original photo’s name.

Before upload, photos are cropped and re-encoded as JPEG images in your browser. In our current implementation this re-encoding drops embedded photo metadata (EXIF data, which can include camera details and GPS location). Images can be up to 8 MB.

Moment content often contains personal information about other people, such as the recipient. Please read People featured in moments.

Feedback

If you choose to rate Moment Acclaim, we store your rating (1–5), any optional comment, and the date, linked to your account.

Referrals

Your referral link contains your account’s random user ID. If someone signs up through your link, we record that you referred them and add extra moment slots to your account.

Technical information

Like most websites, our hosting and database providers receive standard technical information when you visit, such as IP address, browser type, requested pages, and timestamps, and may keep it in server logs for security and operations. We do not use this information to build advertising profiles.

What we do not collect

We do not collect payment information, precise location, contacts from your device, or recipients’ email addresses. We do not send emails to recipients; you share the link yourself.

The GDPR and UK GDPR require us to explain the legal basis for each use. Other laws may use different terms, but the purposes are the same.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not use it to train AI models.

Each moment gets a link containing a long, randomly generated code. Anyone who has the link can open the moment. There is no password or extra sign-in step for recipients. This is how it works:

• Before the occasion date: visitors see only a “scheduled” page with the opening date, not your content.
• Viewing window: from 9:00 AM on the occasion date (based on the time zone of the device used to create the moment) for 3 days, anyone with the link can view the full moment, including photos.
• After the window: visitors see an “expired” page. Your content stays stored until it is deleted (see Retention).
• You, signed in: you can view your own moments at any time.

Photos are stored in a private storage bucket and are delivered through temporary signed links that stop working after 6 hours. To load quickly, our hosting infrastructure may briefly cache optimized copies of images.

Moment pages are marked so search engines should not index them. However, we cannot control what happens once a link is shared: if a recipient forwards the link or posts it publicly, other people can open the moment during its viewing window, and anyone who views a moment can screenshot or save what they see.

We use only cookies that are strictly necessary to provide the Service. When you sign in, our authentication provider (Supabase) sets cookies that hold your session tokens so you stay signed in and so we can check who owns a moment. These cookies are removed when you sign out or the session expires. Because they are strictly necessary, we do not ask for consent to use them, but you can block or delete them in your browser. If you do, you will not be able to sign in.

We do not use analytics, advertising, social media, or cross-site tracking cookies or pixels. Our fonts and background music are served from our own site. If we ever add non-essential cookies, we will update this policy and ask for consent where the law requires it.

Because we do not sell or share personal information for cross-context behavioral advertising, there is nothing for an opt-out preference signal such as Global Privacy Control to switch off. We still respect such signals if that changes.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Supabase (database, file storage, and authentication). Supabase stores your account, moment content, photos, feedback, and referral records on our behalf. Our project is hosted in the Tokyo, Japan region.
• Google, for “Sign in with Google”. Google’s own privacy policy covers what Google processes when you use your Google account.
• Our website hosting provider (Vercel), which serves the website, processes requests, and may cache optimized images.
• People you share a link with, who can see the moment during its viewing window, as described above.
• Legal and safety reasons. We may disclose information if the law requires it, or to protect the rights, safety, or property of our users, the public, or Moment Acclaim.
• Business transfers. If Moment Acclaim is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

Our service providers may only use your information to provide services to us, under their data processing terms. Demo pages on our site may show stock images from Unsplash.

Your information is stored in Tokyo, Japan, and our service providers may process it in other countries, including the United States. These countries may have data protection laws that differ from those where you live.

The European Commission and the UK have recognized Japan as providing adequate protection for personal data. Where the law requires safeguards for other transfers out of the EEA, the UK, or Switzerland, we rely on mechanisms such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum included in our providers’ data processing terms. You can ask us for more information about these safeguards.

• Account and profile: for as long as your account exists.
• Moments and photos: until you ask us to delete them or your account is deleted. Expiry of the viewing window does not delete them.
• Feedback and referral records: for as long as your account exists.
• Sign-in records and server logs: for the periods set by our authentication and hosting providers for security and operations.

When you ask us to delete your account, we delete your profile, moments, feedback, referral records, and the photos you uploaded. Copies may remain in our providers’ backups for a limited time until those backups are overwritten. We may keep information longer when the law requires it, or to resolve disputes or enforce our terms.

Self-service deletion is not yet available in the dashboard. Until it is, please email support.momentacclaim@gmail.com from the email address of your account to delete a moment or your account.

We use reasonable technical and organizational measures, including:

• encrypted connections (HTTPS) between your browser and our services;
• database row-level security, so signed-in users can read only their own records;
• a private photo storage bucket where each account can upload only into its own folder;
• short-lived signed links for photos and long random codes for moment links;
• Google sign-in, so we never store passwords.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Anyone who has a moment link can view that moment during its viewing window. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities where the law requires it.

Wherever you live, you can ask us to access, correct, export, or delete your personal information by emailing support.momentacclaim@gmail.com. We may need to verify your identity, normally by having you write from the email address linked to your account. We will not discriminate against you for exercising your rights.

EEA, UK, and Switzerland

You have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. We respond within one month, which can be extended where the law allows. If you have a concern, please contact us first. You also have the right to complain to your local data protection authority. In the UK this is the Information Commissioner’s Office (ico.org.uk). We will acknowledge complaints sent to us within 30 days and keep you informed of the outcome.

California and other US states

If the California Consumer Privacy Act (as amended by the CPRA) or a similar US state law applies to us, you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to receive a portable copy; and to opt out of its sale or sharing or its use for targeted advertising or profiling. We do not sell or share personal information or use it for targeted advertising or profiling. In the last 12 months we collected these categories: identifiers (name, email, user ID, IP address); customer records; audio-visual information (photos); internet or network activity (server logs); and other content you provide (messages and memories). We collected them from you, from Google when you sign in, and automatically from your device, for the purposes described in this policy. We disclosed them only to the service providers listed above. We do not use sensitive personal information to infer characteristics about you. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity. If we deny your request, you may appeal by replying to our decision. We respond within 45 days, which can be extended where the law allows.

Pakistan

We handle personal information of users in Pakistan as described in this policy and honor the requests above. Pakistan does not yet have a comprehensive data protection law in force; we will update this policy if one is enacted and applies to us. Unauthorized access to information systems and data is an offense under Pakistan’s Prevention of Electronic Crimes Act, 2016.

Other countries

Depending on where you live, you may have rights under local law, such as Brazil’s LGPD, Canada’s PIPEDA, or India’s Digital Personal Data Protection Act. Contact us and we will handle your request in line with the law that applies.

Moments often include the names, photos, and personal details of people other than the person creating them, such as recipients, partners, family members, or children. By creating a moment, you confirm that you have the right to share this information and that the people featured would reasonably expect it. Please do not include sensitive information (for example health, religious, or financial details), identity documents, or intimate images.

If you appear in a moment and want information about you removed, email support.momentacclaim@gmail.com with the moment link and the details you want removed. We will review the request and, where appropriate, remove the content or disable the moment.

You must be at least 16 years old to create a Moment Acclaim account. The Service is not directed to children, and we do not knowingly collect personal information from children under 13 (or the higher minimum age where you live). If you believe a child has created an account, contact us and we will delete it.

Parents and guardians sometimes create moments that feature their children. If you do, please share only what you are comfortable with anyone who has the link seeing, and avoid details such as a child’s school or address.

We may update this policy as the Service or the law changes. We will post the new version on this page and update the “Last updated” date. If we make a material change, we will notify you through the Service or by email before it takes effect.

For privacy questions, requests, or complaints, contact us at support.momentacclaim@gmail.com.

See also our Terms of Service.