Privacy, plainly.

Information we collect and why

• Accounts: Firebase Authentication processes email/password sign-in for Wishlist and Fund My Life. We use an account ID, name and selected avatar or photo to keep personal content separate. Passwords are sent directly to Firebase’s authentication service rather than stored in our application database.
• Content: product-specific names, messages, links, boards, wishes, notes, manually entered prices, photos, audio, video and payment QR images are processed to provide the experience you create.
• Platform payments: when checkout is enabled, we use the submitted checkout phone number, order and payment references, amounts, currency, status and delivery records to create and verify the platform purchase. We do not collect card details through our own forms.
• Safety and support: reports, support correspondence, timestamps and technical request information may be processed to investigate problems, moderate content, prevent abuse and enforce rate limits. Some rate-limit identifiers are stored as hashes.

Hatch: who can see a gift

Sender and recipient display names, messages, themes, uploaded media metadata and timestamps are stored to deliver the gift. Anyone with its recipient link can view it. A secret manage token controls supported editing and deletion; hashes and temporary management-session records are stored instead of publishing that token.

Names and messages can be held in browser session storage while composing; media previews stay local until uploaded. Authenticated Cloudinary media is delivered using short-lived signed requests. Hatch is not end-to-end encrypted.

Receipt: public entries, private order records

Published entry names, messages, optional links, entry numbers and publication times are public, including on share pages and downloadable receipt images. They may be copied or indexed elsewhere. Phone numbers, private order references and payment verification records are not part of the public receipt.

There is no self-edit function for a published entry. Support can handle correction/removal requests and moderation can hide content while preserving an entry number.

Wishlist: private unless you share

Your boards, wishes, notes and photos are accessible through your account by default. Enabling a board’s sharing link makes that board’s allowed contents readable without signing in. Other private boards and account email are not exposed by that link.

Disabling or rotating sharing revokes future access through the previous link. Image requests recheck the board’s current sharing status, including after an item is moved or removed.

Fund My Life: what publication exposes

Before publication, page content and uploaded photos/QR are accessible through the owner’s account. Publishing makes the chosen name, avatar/photo, bio, wishes, product links, payment QR and optional UPI ID publicly viewable.

The platform records the ₹199 publishing payment. Support money sent to the creator’s own QR/UPI does not pass through ZeroBrainCells, and we do not collect donor lists, live totals or support-payment histories for it.

Adult Money and external links

Adult Money is publicly browsable without a visitor account. Its product images, names, categories, optional prices and buying links are curated by the operator. Search and filtering run in your browser. Visiting a buying link opens an external seller’s website, whose privacy policy applies there.

Service providers

• Google Firebase Authentication and Cloud Firestore: account authentication and application records.
• Cloudinary: uploaded images, audio and video. Wishlist and Fund My Life images use authenticated assets; the application serves image bytes after owner, sharing or publication checks. Their signed provider URLs are not returned to visitors. Adult Money images are deliberately public.
• Cashfree, when checkout is enabled: platform payment processing and payment-status information. The provider processes the payment information entered on its hosted checkout.
• Hosting and infrastructure providers: serving the website and operational request logs. The final production hosting provider will be identified when deployment is configured.

These providers process information to deliver their services under their own terms and privacy practices. Information may be handled in locations used by the selected providers; we do not promise that every record stays in one country.

Cookies, local storage and analytics

Essential cookies keep you signed in, identify a Hatch creation session and authorize temporary management access. Firebase account sessions last up to five days; Hatch creation cookies up to two hours and management cookies up to one hour, unless renewed, cleared or invalidated earlier.

Browser local/session storage can hold composition drafts, pending checkout references and explicitly labelled development-preview data. Development previews stay in that browser and do not create real cloud accounts or public pages.

The current application does not include an advertising SDK or an analytics tracker. External links and providers may use their own cookies after you visit their services. We will update this notice if tracking is added.

Retention and deletion

Active accounts, published content and associated order records do not currently have an automatic expiry. Supported content can be removed using the product controls or by contacting the operator. Media deletion and unused-upload cleanup run asynchronously and can be delayed by provider failures; backups and provider logs may follow separate retention schedules.

Hatch gifts, published Receipt entries and paid page records do not promise permanent availability. Supported deletion removes access or content records first; queued media deletion may finish later. Payment, fraud-prevention or support records may need separate handling from public content removal.

For account deletion, data access, correction or removal that the product does not support directly, email zerobraincells2026@gmail.com. Tell us which account or content is involved. We may verify ownership to protect other users’ private information. We aim to reply within 24 hours; that is a response target, not a promise that every deletion or provider backup purge finishes within that period.

Updates and contact

We update this notice when the actual service changes. The date above identifies this version. Contact zerobraincells2026@gmail.com with questions about these practices.