How we protect your love story.

Sign-in uses a one-time password (OTP) sent to your mobile number via our SMS provider. We never store your OTP in plain text — only a hashed value is kept long enough to verify the code, after which it is invalidated.

Sessions are managed by our authentication backend using industry-standard tokens. You can sign out from any device at any time.

• Mobile number — to sign you in and contact you about your order.
• Photos, audio, and messages you upload — to render the personalized gift you create.
• Recipient name and details you enter — to personalize the gift page.
• Order and payment metadata — to fulfill your purchase and provide receipts.

We do not sell your data, and we do not use your uploaded photos or messages for advertising or model training.

Gift pages are reachable only via the unique link generated for that gift. Anyone with the link can view the gift — by design, so you can share it with your recipient over WhatsApp, DM, or email. Do not share the link publicly if you want the contents to stay private to the recipient.

Uploaded photos and audio are stored in private buckets and served through short-lived signed URLs; direct public links are not exposed.

• Row-level security is enabled on user data so each account can only access its own gifts and orders.
• OTP secrets are stored only as hashes and are accessible only to trusted server code.
• Storage buckets for photos and audio are private; files cannot be overwritten by other users.
• Payments are processed via an Indian payment gateway — card details are never stored on our servers.
• Secrets and API keys are kept server-side and are never shipped to the browser.

No service can promise zero risk. We continuously review our setup, but this page is not an independent audit or certification.

We rely on a small set of trusted providers to operate the service:

• Lovable Cloud (Supabase) — authentication, database, and storage.
• MSG91 — OTP delivery over SMS.
• Payment gateway — secure payment processing.

You can request a copy of your data, ask us to delete your account, or report a security concern by emailing support@dilse.gifts. We aim to respond within a few business days.

If you believe you've found a security vulnerability, please email us with the details before disclosing publicly so we can investigate and fix it.