Privacy Policy

1. Who we are

CountingUS (countingus.com) is operated by Puspalatha Balakrishnan, No:8, Raghavendra Koil Street, Balaji Nagar, Anakaputhur, Chennai 600070, India, who is the data controller for the processing described on this page. You can reach us at puspalatha@hodolist.com. Our postal address is in the Impressum.

2. What we collect

CountingUS lets you build a shareable counter page for a relationship or friendship. When you fill in the form at /create, you send us:

• the two names you enter, and whether the page is for a couple or for friends;
• the date and time you want the counter to start from;
• the personal message you write;
• up to three photos you upload (max 2 MB each);
• an optional YouTube link;
• your email address, which we use to send you the link to your page and its QR code;
• any coupon or offer code carried in the URL you arrived with.

We do not ask you to create an account, and we do not ask for a password. Everything above is sent to our own backend at api.countingus.com and stored there so your page can be served. That backend is our own infrastructure and is not necessarily located in the EU or the EEA, so your data may be processed outside the EU. Where that is the case, we still handle it under the GDPR standards described on this page.

Please only upload photos and write messages about people who are happy for you to do so. You choose what goes on the page, so please do not put anything there that you would not want a stranger who has the link to see.

3. Your counter page is public to anyone with the link

A finished page lives at a URL of the form countingus.com/site/<page-name>. That URL is not password protected: anyone who has it — or who guesses it — can open the page and see the names, the message, the photos and the counter. That is the point of the product, but it is worth being explicit about. Visitors can also tap a "clap" button on your page; we store only the running total of claps, not who tapped it.

We email you a separate edit link containing a secret token. Anyone who has that link can change or view your page's content, so please keep it to yourself.

4. Unfinished drafts stay in your browser

While you are filling in the create form, we save what you have typed in your own browser's local storage (under the key counterFormData) so you do not lose it if you reload. Photos are never included in that saved draft. It never leaves your device, we cannot read it, and it is deleted as soon as your page is created. You can clear it yourself at any time through your browser's site-data settings. This is a strictly necessary storage item and does not require consent.

5. Payments

Payments are taken by Razorpay, whose checkout script loads on our site. You enter your card, UPI or bank details directly into Razorpay's checkout — those details never reach us, and we never store them. We pass Razorpay the order amount, the page name and an internal order reference so the payment can be matched to your page, and Razorpay tells us whether the payment succeeded. Razorpay acts as its own controller for the payment data it collects and processes it under its own privacy policy. The legal basis is performance of our contract with you, Art. 6(1)(b) GDPR.

6. Server logs

Our hosting provider records standard web-server access logs when a page or an image is requested, including your IP address, the time of the request, the page requested, the referring page and your browser's user-agent string. These logs exist for security, abuse prevention and debugging, on the basis of our legitimate interest in running a working and secure site, Art. 6(1)(f) GDPR. They are not combined with the analytics data described below.

7. Cookies and analytics

We use Google Analytics 4 to understand which pages people find useful — how visitors arrive, which articles they read, and how far down they get. We use it to improve what we write and build, not to profile individuals, and we do not use it for advertising.

Nothing loads until you agree. When you first visit, a banner asks whether you accept analytics cookies. Until you choose "Accept", no analytics script is downloaded, no cookie is set, and no data about your visit is sent to Google. If you choose "Reject", or simply ignore the banner, that remains true for your entire visit. The site works identically either way.

If you accept, Google Analytics sets cookies (named _ga and _ga_<id>) that hold a randomly generated identifier. That identifier lets us recognise a returning browser, so a person who reads three pages is counted once rather than three times. We enable IP anonymisation, so your IP address is truncated before it is stored. These cookies expire after up to two years, and analytics data is retained for 14 months.

What we measure, if you accept: the pages you view, roughly how far you scroll, which sections of an article hold your attention, how long you stay, which of our main buttons you click, and whether you click a link that leads off the site. This is aggregated in Google's reporting; we do not attempt to identify individual readers, and we never send Google the contents of your counter page, your photos or your email address.

Who receives it: Google Ireland Limited, and its parent Google LLC in the United States, act as our analytics provider. Data may be transferred outside the EU; Google relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework for those transfers. Google's own description is at policies.google.com/privacy.

Legal basis: your consent, under Article 6(1)(a) GDPR and § 25(1) TTDSG. You can withdraw it at any time using the Cookie settings link in the footer; withdrawing deletes the analytics cookies from your browser and stops any further collection. Withdrawal does not affect the lawfulness of what was collected beforehand.

Strictly necessary cookies: any cookie or storage item required to make the site work (for example, your unfinished draft, or the record of this very cookie choice) is stored on your own device, is not shared with anyone, and does not require consent.

8. Who else receives your data

• Our hosting provider, which runs the site and the api.countingus.com backend where your page content and photos are stored.
• Razorpay, for taking your payment (see section 5).
• Google, for analytics — but only if you accepted the banner (see section 7).
• The email provider we use to send you your page link and QR code.
• Anyone you give your page link to, since the page is public (see section 3).

We do not sell your data and we do not share it for advertising. Beyond the above, we disclose it only where the law requires it.

9. How long we keep it

Your counter page and its photos are kept for as long as the plan you bought runs: 30 days on Flex, one year on Showcase, and indefinitely on Preserve. Your email address and payment reference are kept while your page is live and afterwards for as long as commercial and tax law requires us to keep the record. Analytics data is kept for 14 months. You can ask us to delete your page and your email address sooner — see below.

10. Your rights

You have the right to access the data we hold about you, to have it corrected, to have it erased, to have its processing restricted, to object to processing based on our legitimate interest, and to receive your data in a portable form. Where processing rests on your consent, you can withdraw that consent at any time. To exercise any of these, email puspalatha@hodolist.com.

You also have the right to complain to a data protection supervisory authority. If you are in the EU or the EEA, you may lodge a complaint with the data protection authority in your own country of residence.

11. Changes to this policy

We update this page when what we do changes, and we change the date at the top when we do.