1. Who We Are

MomentSent LLC ("MomentSent", "we", "us", or "our") is a North Carolina limited liability company headquartered in Hubert, NC. We operate the MomentSent web application at momentsent.com (the "Service"), which allows subscribers to schedule and send physical printed cards to their contacts.

Questions about this policy may be directed to hello@momentsent.com.

2. Information We Collect

2.1 Information you provide directly

Account data: First name, last name, and email address when you create an account. Passwords are hashed using bcrypt and are never stored in readable form.
Profile data: Phone number, which we use exclusively to send SMS card reminders and delivery notifications. If you enable push notifications in your browser, we store a push notification token to send you in-app alerts about upcoming card sends and delivery confirmations.
Contact data: Names and mailing addresses of the people to whom you send cards. This information is used solely to print and mail cards on your behalf.
Card content: Messages, occasion notes, and personalization details you enter for each card.
Payment data: Billing details collected and stored by Stripe, our payment processor. MomentSent never stores raw card numbers, CVVs, or full bank account information.
Consent records: Timestamps and IP address recorded when you agree to our Terms of Service and SMS consent at signup, as required by law.

2.2 Information collected automatically

Log data: IP addresses, browser type, pages visited, and timestamps when you interact with our Service.
Device data: Device type, operating system, and browser version when you interact with the Service.
Cookies and local storage: We use a single first-party, HTTP-only session cookie required for authentication. This cookie keeps you logged in and is automatically removed when you log out or your session expires. We do not use advertising trackers, third-party analytics cookies, or cross-site tracking of any kind.
Analytics: We use Plausible Analytics to understand aggregate site traffic (pages visited, referral sources, country, device type). Plausible does not use cookies, does not collect personal data, and does not track visitors across sites or devices. All data is anonymized and aggregated. No cookie consent banner is required. See plausible.io/privacy for details.

Do Not Track: Some browsers offer a "Do Not Track" (DNT) setting. Because no uniform industry standard for DNT compliance exists, we do not alter our data practices in response to DNT signals. However, we do not engage in behavioral advertising or cross-site tracking regardless of your DNT setting.

2.3 Information from third parties

OAuth providers: If you sign in via Google or Apple, we receive your name and email address from that provider.
Card delivery vendor: Thankster may provide delivery status for cards we send on your behalf.
Stripe: Stripe shares subscription status, payment success/failure events, and a customer ID with us via webhooks.

3. How We Use Your Information

To create and manage your account.
To print and mail physical cards to the recipients you specify, whether through scheduled occasions or on-demand sends (Send Now).
To send SMS reminders about upcoming occasions (if you have consented).
To send transactional emails: account confirmations, card delivery updates, payment receipts, and trial-expiration notices.
To process subscription payments via Stripe and apply referral credits.
To generate your Relationship Wrapped year-in-review (aggregated card stats).
To detect and prevent fraud and abuse.
To comply with legal obligations.
If you have opted in, to send occasional marketing emails about MomentSent features or promotions. You may unsubscribe at any time.

We do not sell your personal information, use it for behavioral advertising, or share it with data brokers.

4. How We Share Your Information

We share information only as necessary to operate the Service:

Service providers (data processors)

Supabase: Hosts our database (PostgreSQL) and file storage. Data is stored in AWS US-East-1.
Stripe: Processes all subscription payments.
Thankster: Prints our folded greeting cards, stuffs them into envelopes, and mails them first-class to US and international addresses. Receives recipient name, mailing address, and card message.
Twilio: Delivers SMS reminders and delivery notifications to your phone number.
SendGrid: Delivers transactional and marketing emails.
Railway: Hosts our API server infrastructure.
Plausible Analytics: Provides privacy-first, cookieless website analytics. Plausible processes only anonymized, aggregate traffic data (page views, referral source, country, device type) and does not collect any personally identifiable information. Data is hosted in the EU on servers owned by Plausible Analytics OÜ.

Each provider maintains its own data protection and privacy terms governing how they handle information we share with them. We select providers that contractually limit use of shared data to providing services on our behalf and do not use it for their own commercial purposes.

Legal requirements

We may disclose information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of MomentSent, our users, or the public.

Business transfers

If MomentSent is acquired, merges, or undergoes a similar transaction, your information may be transferred as part of that transaction. We will notify you via email before your data becomes subject to a different privacy policy.

5. Recipient Data

When you add a contact's mailing address, you represent that you have a legitimate personal relationship with that individual and that mailing a physical greeting card to them is appropriate within the context of that relationship. We do not use recipient addresses for any purpose other than delivering the cards you request.

Recipient addresses are transmitted to Thankster solely for printing and mailing. Once a card is delivered, we retain the address in your account to make scheduling future cards convenient. You may delete a contact and their address at any time.

Some recipients whose addresses you provide may be minors (for example, a child's birthday contact). Because recipient addresses are supplied by you, an adult account holder, and are not collected directly from recipients, this does not constitute the collection of personal information from children within the meaning of the Children's Online Privacy Protection Act (COPPA) or similar laws. Recipient addresses are used solely to mail physical cards on your behalf and are not used for any other purpose. By adding a minor recipient, you represent that you are the parent, legal guardian, or otherwise have the authority to send mail to that individual.

6. SMS Communications

By providing your phone number and checking the SMS consent box at signup, you consent to receive automated text messages from MomentSent for card reminders and delivery notifications. Message frequency depends on the number of occasions you track. Standard message and data rates may apply.

To stop receiving SMS messages, reply STOP to any text. Reply HELP for assistance. You may also contact us at hello@momentsent.com. We will honor your opt-out within 24 hours. We will not charge you for HELP or STOP messages. No purchase is necessary to opt out.

We do not sell or share your mobile opt-in information, phone number, or SMS consent with any third parties or affiliates for their own marketing or promotional purposes. Your phone number is shared only with our SMS provider, Twilio, solely to deliver the text messages you have requested, and Twilio is contractually limited to using it for that purpose. No mobile information is shared with data brokers.

7. Data Retention

Active accounts: Data is retained for the life of your account.
Closed accounts: We delete or anonymize personal data within 90 days of account closure, except where retention is required by law (e.g., financial records for 7 years).
Card content: Messages and card snapshots are retained to support your sending history and Wrapped feature. You may request deletion at any time.
Recipient portal tokens: Expire after 90 days and are purged thereafter.
Log data: Retained for up to 12 months for security and debugging purposes.
Aggregated / anonymized data: De-identified, aggregate statistics (such as total cards sent platform-wide) are not subject to this retention schedule and may be retained indefinitely. Such data cannot reasonably be used to identify any individual.

8. Data Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest (via Supabase and Railway), row-level security policies on our database, and bcrypt-hashed passwords (managed by Supabase Auth). Access to production systems is restricted to authorized personnel.

No method of transmission or storage is 100% secure. If we become aware of a security breach that affects your personal data, we will notify affected users without unreasonable delay and in accordance with applicable law, including the North Carolina Identity Theft Protection Act (N.C. Gen. Stat. § 75-65) and any other applicable state breach notification statutes.

9. Your Rights and Choices

Depending on your location, you may have the following rights:

Access: Request a copy of the personal data we hold about you.
Correction: Ask us to correct inaccurate or incomplete data.
Deletion: Request deletion of your personal data ("right to be forgotten").
Portability: Receive your data in a structured, machine-readable format.
Objection / Restriction: Object to or restrict certain processing activities.
Opt-out of marketing: Unsubscribe from marketing emails at any time using the link in any email we send.

To exercise any of these rights, email hello@momentsent.com. We will respond within 45 days, or within the period required by applicable law. We may need to verify your identity before fulfilling certain requests.

California residents (CCPA / CPRA)

California residents have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of its sale or sharing. We do not sell or share personal information as defined by the CCPA and CPRA. To submit a verifiable consumer request, contact us at the email above.

Virginia residents (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of its sale and use for targeted advertising or profiling for decisions with legal or similarly significant effects. We do not sell personal data or use it for targeted advertising or such profiling. To exercise your rights, contact us at the email above. We will respond within 45 days.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly. If you believe we have collected information from a child under 13, please contact us at hello@momentsent.com.

11. International Users

MomentSent is operated from the United States. If you access the Service from outside the US, your information may be transferred to, stored, and processed in the United States. By using the Service, you acknowledge this transfer. We rely on the published data protection terms and privacy commitments of our service providers as the transfer mechanism for any international data flows.

12. Third-Party Links

The Service may contain links to third-party websites (e.g., pricing comparison pages, partner card printers). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice in the app at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes your acceptance of the updated policy. The current effective date is shown at the top of this page.

14. Contact Us

MomentSent LLC
P.O. Box 342
Hubert, NC 28539
hello@momentsent.com