Privacy Policy
Effective Date:August 12, 2026
Data Controller: the operator named in our Legal Notice. Contact: support@leaveittotheworld.com
1. Information We Collect
Published publicly on the wall: the message you write, the name you sign with (or "Anonymous" if you leave it blank), the date, and your country. If you tick "Hide my country", your country is not shown on your card, but it is still stored and counted in the site-wide country total.
Your email address, which you enter yourself when you post a card. It is used to send you a direct link to your card, and to limit each person to one card per day. It is never displayed publicly and never shared or sold. We also store a normalised form of it (lowercased, with tags such as +something removed) purely so that the daily limit cannot be bypassed with variations of the same address.
Your country, determined from your IP address at the moment you post your card. Only the two-letter country code is stored in our database.
A one-way fingerprint derived from your IP address. When you submit a message, boost a card, report a card, or claim a free message, we store a cryptographic hash computed from your IP address together with a server-side secret. We do not store IP addresses in readable form in our database. This hash exists solely to prevent abuse — the same visitor boosting one card twice in a day, reporting the same card twice, claiming more than one free message, or sending automated requests in bulk.
We do not require or store account passwords, and we do not collect any information beyond what is listed here.
2. Legal Basis for Processing (EU/EEA Users)
Where the GDPR applies:
- Performance of a contract — your email, message, name, and country are necessary to deliver the service you paid for.
- Legitimate interest — hashed IP addresses, limited to preventing abuse of the boost, report, and free-message features and to limiting automated requests.
- Establishment, exercise or defence of legal claims — retention of records relating to removed cards.
3. Third-Party Service Providers
We share data only with the providers needed to operate the platform:
- Brevo (Sendinblue) — delivery of the confirmation email.
- Hostinger — web hosting and database.
- ip-api.com — at the moment you post your card, your IP address is sent to this service to determine your country. We do not store the IP address in our own database. The third-party service may process the IP address in accordance with its own terms and privacy practices.
These providers process data on our behalf and only to the extent necessary to provide their respective service.
4. Cookies
We use only the essential session cookie required for the site to function. We do not use analytics or advertising trackers.
5. Data Retention
Your published card may remain publicly visible for as long as the service operates, unless it is removed at your request, for legal or moderation reasons, or where retention is required by law.
Cards removed for violating our Terms are hidden from the wall, but their record is retained as evidence in the event of a legal claim.
Your email address is retained as long as necessary to provide support related to your order and to meet accounting obligations.
Hashed IP addresses relating to boosts, reports, free messages, and request limits are retained only as long as necessary for those specific purposes.
6. Your Rights
Depending on your location, you may have the right to access the personal data we hold about you, correct inaccurate data, request deletion (note: this removes your card from the public wall), object to processing based on legitimate interest, restrict processing in certain circumstances, receive a copy of your data in a portable format, and lodge a complaint with your local data protection authority.
To exercise any of these rights, contact support@leaveittotheworld.com. We will respond within one month.
7. Direct Links to Cards
Each card has a unique link, sent to you by email. Anyone with that link can open the card. The card is public on the wall regardless, so the link reveals nothing that is not already visible.
8. User-Generated Content and Moderation
Users are responsible for the content they submit. We reserve the right to review, restrict, or remove content that violates our Terms of Service, infringes third-party rights, contains illegal or harmful material, impersonates another person, or otherwise violates our policies.
9. Children's Privacy
Our services require users to be 18 years or older, and we do not knowingly collect personal data from minors.
10. System Logs
For security and maintenance purposes, our hosting provider may automatically log technical data such as IP addresses, browser type, and request timestamps.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the Effective Date above.
12. Contact
Questions? Write to support@leaveittotheworld.com