Privacy Policy

MeBirth ("we," "us," or "our") is a social platform that connects people who share the same birthday, operated from British Columbia, Canada. We are the data controller (and, under Canadian law, the organization accountable) for the personal data you provide when using our service.

Our handling of personal information is governed by Canada's PIPEDA and British Columbia's PIPA, and — where applicable to users abroad — by the EU/UK GDPR and California's CCPA/CPRA.

Privacy questions or requests: tegbirsingh702@gmail.com

We collect only what is necessary to run the service:

• Account data: Email address and hashed password (managed by Supabase Auth).
• Profile data: First name, birth month, birth day (never birth year), country, city, gender (optional), a short bio (optional), and social media handle (optional).
• Profile picture: An image you upload, stored in our secure cloud storage.
• Usage data: Server logs (IP address, browser type, pages visited, timestamps) automatically collected by our infrastructure provider.

We do not collect your birth year, payment information, or any sensitive categories of data under GDPR Article 9.

We use your data solely to:

• Display your public profile to other users who share your birthday.
• Provide the birthday-twin matching feature.
• Send transactional emails (e.g., email verification, password reset). You may opt out of non-essential notifications in Settings.
• Maintain the security and integrity of the platform.
• Comply with legal obligations.

Legal basis (GDPR): Performance of a contract (Art. 6(1)(b)) for core functionality; legitimate interests (Art. 6(1)(f)) for security and fraud prevention; consent (Art. 6(1)(a)) for optional notifications.

We do not sell your personal data. We share data only with the following service providers under data processing agreements:

• Supabase Inc. — database, authentication, and file storage (USA, EU Standard Contractual Clauses apply).
• Vercel Inc. — web hosting and CDN (USA, SCC apply).

We may also disclose data if required by law or to protect the rights and safety of our users.

We retain your personal data for as long as your account is active. You may delete your account at any time via Settings → Danger Zone → Delete Account. Upon deletion, your profile data and uploaded photos are permanently erased from our systems within 30 days. Server log data may be retained for up to 90 days for security purposes.

If you are located in the European Economic Area or the United Kingdom, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request we restrict processing of your data.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any right, email us at tegbirsingh702@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

As a Canadian organization, we handle your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). You have the right to:

• Access: Ask what personal information we hold about you and how it has been used and disclosed.
• Correction: Request that we correct inaccurate or incomplete information.
• Withdraw consent: Withdraw your consent to our processing at any time, subject to legal or contractual limits (for example, by deleting your account).
• Deletion: Delete your account and associated data via Settings → Danger Zone → Delete Account.

We collect, use, and disclose personal information only for the purposes identified in this policy, only with your consent, and we limit collection to what is necessary for those purposes.

To exercise a right, email tegbirsingh702@gmail.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for BC residents, the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used.
• Delete your personal information.
• Opt out of sale — we do not sell personal information.
• Non-discrimination for exercising your CCPA rights.

We use only strictly necessary session cookies (via Supabase Auth) to maintain your login state. We do not use advertising, tracking, or analytics cookies.

MeBirth is not directed to children under 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us immediately at tegbirsingh702@gmail.com.

We implement industry-standard security measures including TLS encryption in transit, hashed passwords, Row-Level Security policies on our database, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page. Continued use of the service after changes constitutes acceptance.

Questions about this policy? Contact our privacy team at: tegbirsingh702@gmail.com