Privacy Policy

We do not sell your data, show ads, or use tracking or advertising cookies. Profiles are not published on public web pages or to search engines.

MeBirth ("we," "us," or "our") is a social platform that connects people who share the same birthday, operated from British Columbia, Canada. We are the data controller (and, under Canadian law, the organization accountable) for the personal data you provide when using our service.

Our handling of personal information is governed by Canada's PIPEDA and British Columbia's PIPA, and — where applicable to users abroad — by the EU/UK GDPR and California's CCPA/CPRA.

Privacy questions or requests: tegbirsingh702@gmail.com

We collect only what is necessary to run the service:

• Account data: Email address and hashed password (managed by Supabase Auth).
• Profile data: First name, birth month, birth day (never birth year), country, city, gender (optional), a short bio (optional), and social media handle (optional).
• Profile picture: An image you upload, stored in our secure cloud storage.
• Activity: Birthday wishes and connect requests you send and receive, profiles you report, and messages you send through our feedback form.
• Settings: Whether birthday emails are on, whether your all-time stats are shown, and when we last emailed you (so we never send the same email twice).
• Usage data: Server logs (IP address, browser type, pages visited, timestamps) automatically collected by our infrastructure provider, and anonymous page-speed measurements (see section 9).

We do not collect your birth year, payment information, or any sensitive categories of data under GDPR Article 9.

We use your data solely to:

• Display your public profile to other users who share your birthday.
• Provide the birthday-twin matching feature.
• Send account emails (email verification, password reset, email-change codes). These are needed to run your account.
• Send the birthday emails you choose to turn on. With that one switch on in Settings, you can get: an email when a new birthday twin joins; an email when someone wishes you or asks to connect (at most one of each a day); and one birthday greeting on your birthday, which lists birthday freebies in your country. Turning the switch off stops all of them. There are no ads and no newsletters.
• Maintain the security and integrity of the platform.
• Comply with legal obligations.

Legal basis (GDPR): Performance of a contract (Art. 6(1)(b)) for core functionality; legitimate interests (Art. 6(1)(f)) for security and fraud prevention; consent (Art. 6(1)(a)) for optional notifications.

We do not sell your personal data. We share data only with the following service providers under data processing agreements:

• Supabase Inc. — database, authentication, and file storage (USA, EU Standard Contractual Clauses apply).
• Vercel Inc. — web hosting, CDN and anonymous page-speed measurement (Speed Insights) (USA, SCC apply).
• Resend — delivers our emails. It receives your email address, first name and the content of the email (USA).
• Google — only if you choose "Continue with Google": Google confirms who you are and shares your name and email address with us, under Google's own privacy policy.
• Anthropic — writes the daily horoscopes. It receives no personal data: only the date and the zodiac signs.

Some public images and map data load in your browser straight from their hosts — country flags (flagcdn.com), the world map (cdn.jsdelivr.net, unpkg.com) and photos of famous people (Wikimedia). Like any website, those hosts can see your IP address when your browser fetches the image. We send them nothing about you.

We may also disclose data if required by law or to protect the rights and safety of our users.

We retain your personal data for as long as your account is active. You may delete your account at any time via Settings → Danger Zone → Delete Account. Upon deletion, your profile data and uploaded photos are permanently erased from our systems within 30 days. Server log data may be retained for up to 90 days for security purposes.

If you are located in the European Economic Area or the United Kingdom, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request we restrict processing of your data.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any right, email us at tegbirsingh702@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

As a Canadian organization, we handle your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). You have the right to:

• Access: Ask what personal information we hold about you and how it has been used and disclosed.
• Correction: Request that we correct inaccurate or incomplete information.
• Withdraw consent: Withdraw your consent to our processing at any time, subject to legal or contractual limits (for example, by deleting your account).
• Deletion: Delete your account and associated data via Settings → Danger Zone → Delete Account.

We collect, use, and disclose personal information only for the purposes identified in this policy, only with your consent, and we limit collection to what is necessary for those purposes.

To exercise a right, email tegbirsingh702@gmail.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for BC residents, the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used.
• Delete your personal information.
• Opt out of sale — we do not sell personal information.
• Non-discrimination for exercising your CCPA rights.

We use only strictly necessary session cookies (via Supabase Auth) to maintain your login state. We do not use advertising, tracking, or analytics cookies.

Your browser also keeps a few small preferences for MeBirth in local storage — for example that you closed the cookie notice, or which wishes you have already seen. They stay on your device and are not used to track you.

We measure how fast pages load with Vercel Speed Insights. It sets no cookies and does not build a profile of you: it records page-load timings with the page address and a general device type.

You must be 16 or older to use MeBirth, wherever you live — the same rule as our Terms and the sign-up page. We do not knowingly collect personal data from anyone under 16, and we delete any account we learn belongs to someone under 16. If you believe a child has given us data, contact us immediately at tegbirsingh702@gmail.com.

We implement industry-standard security measures including TLS encryption in transit, hashed passwords, Row-Level Security policies on our database, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the date at the top of this page and, for significant changes, by email. Continued use of the service after changes constitutes acceptance.

Change history

• 22 September 2026 — minimum age set to 16 everywhere (it read 13, or 16 in the EEA); "At a glance" summary added; Resend, Google and Anthropic added to the list of providers; the birthday emails, local storage and page-speed measurement described.
• 9 September 2026 — guest browsing removed.
• 1 January 2025 — first published.

Questions about this policy? Contact our privacy team at: tegbirsingh702@gmail.com