Privacy Policy

How to contact me

Email me@dealwithmuhammad.com or message me on WhatsApp at +60 11-3986 5270.

What I collect, and why

• Your invitation: everything you type or choose when you publish, such as names, parents' names, hosts, dates, venues, addresses, map links, messages, contact names and phone numbers, and your design choices. I store it so that guests can open it and you can edit it. No photos are uploaded.
• Where it was made: the country and city my host works out from your IP address, saved with the invitation.
• Accounts (optional): your email address, which invitations are yours, and when you signed up and last signed in. You don't need an account. If you sign in, I use your email to send sign-in codes.
• Guest visits: each time an invitation is opened I count one visit against its limit and record the time, approximate location (country, region and city, from the host), device type (phone, tablet or desktop) and where the link was tapped (for example WhatsApp, or a website's address). Guests don't sign in, and I don't save their IP address with the visit.
• Limits against abuse: short-lived counters that contain your IP address, and your email address when you ask for a sign-in code.
• Site analytics: a script from my main site counts page views on every page here, including invitations. It records the page address, where you came from, the address of links you click to leave the site, your country, and your device type, browser and operating system. It uses a scrambled daily ID, made from your IP address and browser details and kept for up to two days, to count each visitor once a day.
• Custom design requests: the form on the custom page sends nothing itself. It opens WhatsApp or your email app with your message filled in.

Who can see an invitation

• Anyone with the link can open it. There's no password. Search engines are asked not to index it, and it isn't in the site's gallery or sitemap.
• The link preview in WhatsApp and other apps shows the names, the date and sometimes the venue.
• Public stats: the analytics numbers are public on my stats page. Its lists of top pages and links clicked can show an invitation's address, which often contains the names, and the map links guests tap.
• Normally only you can edit it, using your private edit link or your account. If you turn on open editing, anyone who opens its edit address can change it.
• I can see every invitation, its visit numbers and the email of the account it belongs to, because I run the site. I use that to run it, help people and deal with abuse.

If you put other people's details on an invitation, please make sure they're happy with that. If you appear on an invitation and want something removed, contact me.

Who it's shared with

There are no ads on this site. These services handle data for it:

• Supabase stores invitations, accounts, visit records and limit counters, and runs the sign-in.
• Amazon Web Services (AWS Amplify) hosts this site. It receives visitors' IP addresses and browser details and may keep them in its logs.
• Google (Gmail) delivers sign-in emails and holds email you send me.
• Namecheap forwards email sent to me@dealwithmuhammad.com.
• Vercel and Upstash host my main site and its analytics database, which receive the page view data above and serve the analytics script and app menu.
• Google Maps loads inside an invitation when it shows a map, and receives the venue, the guest's IP address and browser details. Google may also use its own cookies there.
• YouTube loads on an invitation only if I've set it up to play a song at the host's request, using YouTube's privacy-enhanced address. YouTube receives the guest's IP address and browser details.
• Google Fonts supplies letter shapes for link preview images. My server sends the words drawn on the image (names, date, venue), not anyone's IP address. Fonts on the pages themselves come from this site.

These companies can run their servers outside Malaysia and outside your own country, and each has its own privacy policy. Buttons for Google Maps, Waze, Google Calendar, WhatsApp and phone calls only take you to those services when you tap them. I may also share information if the law requires me to.

Cookies and browser storage

• Cookies: if you sign in, Supabase cookies keep you signed in. My code sets no other cookies, and none for guests. Google Maps and YouTube may set their own, as above.
• Your browser's local storage: the invitation you're drafting and, for invitations you published in that browser, their links and private edit keys. Clearing your browser data removes them, so keep your edit link somewhere safe.
• If you add ?dwm-ignore=1 to an address here, local storage also remembers not to count your visits in that browser.

How long it's kept

There's no automatic deletion: invitations and their visit records stay after the event, until you delete the invitation or I remove it. Deleting an invitation deletes its visit records. Accounts stay until you ask me to delete them; deleting an account doesn't delete its invitations unless you ask for that too. Limit counters are cleared from time to time once they're a day past expiry. The daily analytics ID lasts up to two days, while the analytics totals have no end date. Providers may keep logs and backups for their own periods, and email stays until I delete it.

Security

The site runs over HTTPS. Sign-in uses emailed codes, so there's no password to leak. Edit keys are stored only as hashes on the server. Browsers don't talk to the database directly; everything goes through the site's server. Requests are limited to slow down abuse. That said, an invitation is readable by anyone who has its link, this is a site run by one person, and it has no security certification or independent audit. No online service can promise perfect security. If a breach affected you, I'd tell you and do what the law requires.

Your rights

You can ask me for a copy of your data, and ask me to correct or delete it. You can delete your own invitations in the editor, and for anything else email me@dealwithmuhammad.com. Malaysia's Personal Data Protection Act 2010 applies to how I handle personal data, and if you're in the EU or UK you also have rights under the GDPR, including the right to complain to your data protection authority.

Children

DWM Invite isn't for children under 13. A parent can make an invitation for a child's party. If a child under 13 has given me their details, tell me and I'll delete them.

Changes

If what the site does changes, I'll update this page and the date at the top. See also the Terms of Use.