Privacy Notice

Last updated: 14 June 2026

This notice explains how eCards by Tim Dixon collects, uses, and protects your personal data. It applies to everyone who uses the eCards service at ecards.timdixon.net.

1. Who we are

The data controller for this service is Tim Dixon.
You can contact Tim via the contact form on timdixon.net.

Tim Dixon is registered with the UK Information Commissioner's Office (ICO) as a data controller.

2. What personal data we collect and why

When you create an account

We collect your name and email address from your Microsoft account, along with a unique identifier for your Microsoft account. We use this to create and manage your eCards account and to send you service-related emails (card delivery confirmations, occasion reminders).

We also record the date and time you confirmed your age and accepted this Privacy Notice. This is a legal requirement for providing the service.

When you add contacts and occasions

You provide the names, email addresses, and occasion dates (such as birthdays or work anniversaries) of the people you want to celebrate. This data is stored solely to power reminders and card creation for your use. It is never shared with third parties, sold, or used for any purpose other than providing the service to you.

When a card creator invites group members to sign

If you are added to a contact group by another eCards user and they create a card for someone in that group, we may use your name and email address to send you a signing-invitation email on their behalf. The lawful basis for this processing is the legitimate interests of the card creator in coordinating a group card (UK GDPR Article 6(1)(f)). If you do not want to receive signing invitations, you can opt out at any time using the one-click link included in every invitation email; your opt-out is permanent and will be respected if you are ever removed and re-added to the group.

When you create a card

We store the card content, the recipient's email address, the scheduled delivery date, and any contributions (messages, names, photos) added by signatories.

When you sign a card

If you sign a card via a signing link, we collect your display name, your message, and optionally your email address (if you choose to receive a copy of the card). Signing does not require an account. Your message is stored on the card and is visible to the card organiser.

3. Legal basis for processing

• Contract performance (UK GDPR Article 6(1)(b)): processing your account data, contacts, and cards to deliver the service you have requested.
• Legitimate interests (UK GDPR Article 6(1)(f)): security logging and fraud prevention.
• Consent (UK GDPR Article 6(1)(a)): sending marketing or non-essential communications, where you have opted in.

4. How long we keep your data

• Account data — kept for as long as your account is active.
• Contacts and occasions — kept while your account is active and deleted with your account on request.
• Cards and contributions — kept indefinitely so recipients can revisit their cards. Contributions on cards you created are governed by your account status.
• Deleted accounts — your personal identifiers (name, email, Microsoft account ID) are anonymised immediately on deletion. Associated records are permanently purged within 90 days.
• Email logs — kept for 12 months for deliverability and legal compliance.

5. Who we share your data with

We share personal data only with the following processors, all operating under appropriate data processing agreements:

• Amazon Web Services (AWS / SES) — for transactional email delivery. AWS processes email in the EU (Ireland / eu-west-1 region).
• Microsoft Azure (Entra ID) — for sign-in authentication only. We receive only the minimum account information needed to create your session.

We do not sell, rent, or share your data with any advertising or analytics platform.

6. Your rights

Under UK GDPR you have the following rights. To exercise any of them, use the contact form on timdixon.net.

• Right of access (Article 15): you can request a copy of all personal data we hold about you. You can also download your data directly from your account settings page once signed in.
• Right to rectification (Article 16): you can correct inaccurate data via your account settings, or by emailing us.
• Right to erasure (Article 17): you can delete your account at any time from your account settings once signed in. This anonymises your personal identifiers immediately and purges associated data within 90 days.
• Right to data portability (Article 20): you can download your data as a machine-readable JSON file from your account settings.
• Right to restrict processing (Article 18): you can ask us to restrict how we process your data while a complaint is investigated.
• Right to object (Article 21): you can object to processing based on legitimate interests.
• Right to lodge a complaint: you have the right to complain to the UK Information Commissioner's Office (ICO) .

7. Cookies and local storage

Essential cookies

This site uses one essential cookie: the session cookie (laravel_session). It is set when you visit the site and keeps you signed in during your session. It expires at the end of your browser session. Essential cookies cannot be disabled without breaking the site.

We also set a CSRF token cookie (XSRF-TOKEN) to protect forms against cross-site request forgery. This is a security requirement and cannot be disabled.

Local storage (not cookies)

Your colour theme preference (Light, Dark, Muted Light, Muted Dark) is stored in your browser's local storage, not in a cookie. Local storage data never leaves your device and is not transmitted to our servers.

We do not use any advertising, tracking, or analytics cookies.

8. Security

This site uses HTTPS for all connections. Passwords are not used — authentication is handled entirely by Microsoft, which means we never receive or store a password. Access to personal data is restricted to authorised administrators and monitored via audit logs.

9. Changes to this notice

If we make material changes to this notice, we will notify you by email and update the "Last updated" date above. Continuing to use the service after a change constitutes acceptance of the updated notice.

10. Contact us

For any privacy-related query or to exercise your rights, contact:
Tim Dixon via the contact form on timdixon.net