Privacy Policy

Last updated 2026-10-27

This policy explains what Unwrap (Zijian Xiao, China) collects and why.

What we collect

• Account: your email address and a scrambled (hashed) version of your password. We cannot read your password.
• What you add:
  • Recipient and sender first names: show on the gift tag
  • Your message and optional photo: show inside the box when opened
  • Opening time and reply note: tell the sender their gift was opened
• Account usage: when you signed up and, if this product records it, when you first wrapped your first gift. We use these times to understand whether the product is helpful.
• Payments: handled by Creem, our merchant of record. We never see your card details; we receive your email, what you bought, and the payment status.
• Payment identifiers: Creem order, subscription and transaction IDs and their internal account association, used for accounting. These are pseudonymous identifiers that can be linked to a person.
• Technical: your IP address, used briefly to stop abuse (for example too many sign-in attempts).

Cookies

We use only first-party cookies: one keeps you signed in, one protects forms, one remembers which link first brought you here, and a random browser cookie lasts up to 90 days to count returning browsers once per UTC day. Daily browser digests change each day. We filter known robots and exclude configured test accounts. Page views and daily browser counts do not store your IP address. No advertising cookies and no tracking across other sites.

Who processes data for us

• Creem (payments and invoices)
• Our email provider (account and service emails)
• Our hosting provider (where the service runs)

We do not sell your data.

The operator's internal root sync process receives daily counts and payment records with raw payment identifiers for reconciliation. The operator's Radar business dashboard receives daily counts and payment records with hashed identifiers for business reporting. Both receive payment records without email addresses or the content you add. Hashing these identifiers does not make them anonymous.

How long we keep it

Account data, account usage records and content are kept as long as your account exists and deleted when you delete it.

Creem and the operator retain accounting records, including payment identifiers and the internal account association, for as long as required by law, even after account deletion. These account-data and accounting retention periods also apply to the operator's internal sync process and Radar dashboard, including raw or hashed payment identifiers.

Your rights

You can see, change or delete your data from your account, or ask us at m4ra7h0n@gmail.com.