Private link, no app

One page. One payment. No subscription.

Lost a link?
Who is it for? Birthday, apology, love
Make one

Privacy policy

This policy explains what Abhinav Krishna (“we”), which runs Collywobbles at collywobbles.in, collects when you make, buy or open a page, why, and for how long. We collect as little as the product needs.

The short version

  • There are no accounts and no passwords. We ask for one email address, at payment.
  • Your page is private by default: a random link, hidden from search engines, with an optional passcode.
  • The page your recipient opens loads no advertising or analytics scripts.
  • We never see your card or UPI details. Razorpay handles the payment.
  • You can ask us to correct or delete your data at any time.

What we collect, why, and for how long

What Why we need it How long we keep it
Your email address To send your receipt, your links, recovery links and, on Deluxe, notifications about your page For the life of the page, and afterwards with the order record
If you join the waitlist while payments are closed: your email address, the design you were looking at and any creator code in the link you came by To email you once, on the day payments open Deleted 90 days after you join, or sooner if you ask
A log of the emails we send: what kind each was, when it went and the address it went to So the same email is not sent twice, and to limit how many recovery emails one address can be sent The address is removed from the log 30 days after an email is sent, and straight away when you delete the page
What you put on the page: names, text, photos, a voice note It is the product you asked us to make and show Until you ask us to delete the page. Unpaid drafts are deleted after 48 hours. A page taken down for breaking our terms has its photos and recordings deleted after 30 days
How many times a page was opened, and when it was first and last opened To show you, and on Deluxe to email you, that your page was opened For the life of the page. We keep a count, not a record of each visit, and we do not store the recipient’s IP address
What a recipient chooses to send back on a Deluxe page: a reaction, an answer, a short reply To pass it on to the buyer For the life of the page
A one-way scrambled form (a keyed hash) of the IP address used to create a page, send a reaction or file a report To limit abuse and spam 30 days. The key changes every day, so the hash cannot be turned back into an address or linked across days
Wrong passcode attempts on a locked page, counted for the page and for the same scrambled form of the IP address that made them To stop someone guessing a passcode Removed after 2 days
The campaign tags in the link you arrived by (utm_source, utm_medium, utm_campaign and utm_content) and any creator code To know which of our own links and adverts lead to orders, and to pay creators Kept with the order record. They describe our link, not you
Advertising measurement on an order: Meta’s click and browser identifiers, the page you landed on, the site you came from, any other tag in the link and your browser type To tell Meta once that an advert led to a purchase Removed from the order 7 days after the order is made. Meta’s identifiers and your browser type are not kept at all if you have turned ad measurement off (see “Turning ad measurement off”)
Order records: amounts, dates, plan, Razorpay order and payment references Accounting, tax and refunds For as long as tax and accounting law requires
Reports about a page: the reason, any details and any contact the reporter chose to give To review the page and reply With the record of the decision

Before you pay, your draft, including photos, is stored only in your own browser on your own device. It reaches our servers when you press Publish.

Photos

Photos are resized and compressed in your browser before they are uploaded. That step also removes the hidden data stored inside a photo, including the location where it was taken. We store the compressed copy only.

You are responsible for having the consent of anyone identifiable in a photo you upload. If a page shows you and you did not agree to it, use the “Report this page” link on the page or write to grievance@collywobbles.in.

What we do not do

  • We do not sell personal data.
  • We do not put advertising trackers on recipient pages.
  • We do not build profiles of recipients.
  • We do not read your pages, except when a page is reported or when you ask us for help with it.

Cookies and similar storage

  • Your device’s storage holds your draft and the private keys to pages you made, so you can come back to them without an account.
  • One strictly necessary cookie is set on a recipient’s device when they unlock a passcode-protected page, so they are not asked again each time.
  • Meta Pixel runs on the pages where you browse, make and pay for a page, and on these policy pages, to measure advertising. It can set Meta’s cookies. It does not run on recipient pages, and it does not run at all once you have turned ad measurement off.
  • Cloudflare Turnstile runs where we need to tell people from bots (for example when a page is created or reported, or after a wrong passcode on a locked page). It does not show a puzzle in most cases.

Turning ad measurement off

You can turn advertising measurement off in three ways:

  • switch on Do Not Track in your browser;
  • use a browser or extension that sends Global Privacy Control;
  • use the control at the end of this page, which is remembered on that device.

Any of the three turns off both halves of the measurement: the Meta Pixel is not loaded in your browser, and our server does not send Meta a purchase event when you buy. Meta’s identifiers and your browser type are not stored with your order. The campaign tags of the link you arrived by are still kept with the order, in our own records only.

Who processes data for us

We use a small number of service providers. Each receives only what its job needs.

Provider What it does What it receives
Cloudflare Hosts the site, the database and the stored photos and recordings; bot protection Everything stored on the service, and the technical details of each request
Razorpay Payment processing Your payment details, the amount, and your email address and phone number if you give them at checkout
Resend Sends our emails Your email address and the content of the email
Meta Advertising measurement on storefront pages Page visits and purchase events from the storefront, with the identifiers described above; your email address is sent in hashed form only. Nothing is sent about a buyer who has turned ad measurement off

These providers may store or process data on servers outside India. We may also disclose information when the law requires it, for example in response to a valid order from a court or an authorised agency.

Security

Links to pages contain a long random code. Manage links and passcodes are stored only in scrambled form, so we cannot read them back. A passcode is 6 to 8 letters or digits. After a few wrong tries, a locked page stops taking guesses from that device for a while and may ask for a quick check that a person is there. Uploads are checked for file type and size. Access to the systems that hold your data is limited to the people who run the service. No system is perfectly secure: if we learn of a breach that affects you, we will tell you and the authorities as the law requires.

Your choices and rights

You can:

  • edit a page with your manage link;
  • ask for a copy of the personal data we hold about you;
  • ask us to correct it;
  • ask us to delete a page and its contents. We will still keep the order record the law requires;
  • withdraw consent to advertising measurement at any time: see “Turning ad measurement off” above;
  • complain to our grievance officer, and, if you are not satisfied, to the Data Protection Board of India once it is taking complaints.

Write to support@collywobbles.in from the email address used at purchase, so we can check the request is yours. We reply within 7 days.

Children

Collywobbles is for buyers aged 18 and over. We do not knowingly collect personal data from children. Do not upload a photo of a child unless you are the parent or guardian or have their permission. If you believe a page shows a child without such permission, report it and we will act quickly.

Grievance officer

We acknowledge a complaint within 48 hours and resolve it within one month.

Changes

We will update this page when what we collect changes. The date at the top shows the latest version. If a change is significant, we will email buyers who are affected.