Privacy

marked.day is run by Mohammad Naweed Hesan. Contact: hello@marked.day.

Only what it takes to make and deliver your page:

• Your email address, for sign-in codes and receipts, or the one you give to get a reminder. We delete reminder addresses a week after the reminder is sent. A person at marked.day can add a private note to your account, for example to remember a support request. It is deleted with your account.
• The photo, message, and voice note or video you add.
• Names you type, like who the page is for and who it is from.
• Short thank-you notes, the country of your billing address, and the website address you add to a brand page. If you use a free-page code, we record which code you used and when. If you say thanks to a sender, we also keep your name and email for 90 days to stop abuse. The sender sees your name and message, never your email.

There are no passwords. You sign in with a code we email you, so there is nothing to leak.

Anyone with the short link, like marked.day/k3f9x2hm. Treat it like a key: whoever has it can open the page.

Your page shows in the public archive only if you switch on Show in the archive, and only after it opens. Sealed pages never appear there.

Homepage spots are public on their day, for everyone who visits marked.day. A person at marked.day can see any page while reviewing a homepage spot or a report.

Pages shown in the archive can appear in search engines. We ask them not to list photos in image search. Switch the archive off and the page leaves the archive within a minute, and search over time.

Until midnight in the timezone you picked, nothing on the page is sent to anyone's browser. Not the message, not the photo, not the voice note or video. Visitors get a sealed card and a countdown, and that is all. The link preview and the browser tab show only who it is for and the date. After it opens, the link preview can show the photo.

Phones quietly save where a photo was taken inside the file. We remove that location data when you upload, so it never ends up on your page.

We host on Cloudflare. It stores your pages and sees your IP address to keep the site safe. Cloudflare Turnstile checks that sign-in and checkout requests come from a person, not a bot. Mail sent to hello@, privacy@ and abuse@ passes through Cloudflare Email Routing. The open-source software we use is listed at marked.day/third-party-notices.txt. When the site slows down or refuses a request (too many tries, a failed bot check), we keep a one-way code of your address, never the address itself, for 30 days.

Stripe handles checkout on its own secure page. We never see your card number. We only hear back that you paid, and for what. We keep the country of your billing address, of your card and of your connection when you pay, for tax records.

We send email through Resend: sign-in codes, receipts, the reminders you ask for, thank-you notes, notices when a page is deleted or a payment is refunded, and the reason if we don't approve a homepage page. We never sell your address or hand it to advertisers. We keep a record of each email we send, with the address masked and whether it was delivered, for 30 days.

We use two cookies, only to make the site work: one keeps you signed in, and one keeps a page you have started on this device until you pay. No ad trackers, no tracking pixels, nothing that follows you around other sites. Your light or dark choice, whether you have signed in on this device, and which pages you have already opened are saved on your device only.

We count visits on our own servers, with no cookies and no third-party trackers. When a page loads, your browser sends us one small message with the page and the site you came from. We read your IP address and browser only to work out your country, region, device type, browser and system names and your first language, then we discard them: we never store your IP address or your full browser string. To count unique visitors we use a one-way code made from your IP address and browser plus a key that changes every day and is deleted after 2 days, so it cannot be turned back into your address or followed from one day to the next. We keep single visits for 3 months, and daily totals, which hold only numbers, for 14 months. If your browser sends Do Not Track or Global Privacy Control we do not count your visit; we only add one to a total. Known robots are left out of the numbers. We use this to run and improve the site (our legitimate interest). We do not sell or share it, and we do not link it to your account, your orders or your email.

We keep payment records for 7 years, as tax rules require, even after you delete your data, then we delete them. Deleted pages leave our backups within 30 days.

Delete a page any time from Your days. If it has not opened yet, you get your money back.

To delete everything else, write to hello@marked.day and we will delete it within 30 days. Otherwise your page stays up for as long as marked.day exists.

You can ask to see, correct or delete your data. Write to hello@marked.day.

marked.day is for people 16 and older.