Privacy Policy · Deco My Tree

1. Information we process

The information depends on the features you use. Some request information is processed even when you browse without signing in. We process the following categories:

Account information: an internal account identifier; your phone number and a salted password hash for phone sign-in; or your selected social provider’s identifier and the name, email address and avatar reference it supplies, when available. We do not receive your social account’s password.
Trees and greetings: tree names, appearance, share identifiers, season and time zone; message text, signatures, selected ornaments, recipient and sending-account links, anonymity and public-reading choices, and creation or reading times.
Technical and source information: request IP address, approximate country, language and device type, account creation and activity times, referral campaign parameters when present, and security or rate-limit records. Approximate country information is not a request for your device’s precise GPS location.
Reports and correspondence: report reasons and details, the relevant greeting, a reporter account or an IP-derived identifier, moderation status, and information you choose to include in support or privacy requests.

2. How we use information

We use this information to sign you in, save and display trees, deliver greetings, enforce reading permissions and seasonal rules, show account details, understand referral sources and basic service activity, investigate reports, prevent spam and unauthorized use, answer requests and meet applicable legal obligations. Information needed for an account or a greeting is necessary to provide that feature; you can browse available public pages without creating one.

3. Grounds for processing

Where data-protection law requires a legal basis, we use information as necessary to provide the service you request, pursue legitimate interests such as security and abuse prevention, meet legal obligations, or act on consent where consent is required. These grounds depend on the activity and the law that applies. If processing relies on your consent, you may withdraw it without affecting earlier lawful processing.

4. Who can see trees and greetings

People with a tree link can see its public display, ornaments and visible signatures. The tree owner normally reads message text from Dec 25, according to the tree’s applicable settings. The sender can read their own greeting. Visitors can read its text after the reveal only if the sender chose public reading and the greeting remains available. Hiding a greeting changes its display status; it does not itself erase the stored text.

An anonymous greeting hides its displayed signature from the tree owner and visitors. We still retain the sending-account association for operation, moderation and safety. Anonymity is not a guarantee that the wording cannot identify you. A recipient or another authorized reader may save or share a copy outside our control.

5. Staff access and moderation

Authorized operators can access stored greetings and related records through administrative tools when needed for operation, support, moderation, security or legal obligations. This may include private or unrevealed text. The service does not provide end-to-end encryption, and a sealed message is an access-control feature, not a promise that only its sender and recipient could ever access it. Report details are not published to other users.

6. Cookies and storage on your device

We use essential sign-in cookies and browser storage to make the service work. You can clear them in your browser, but this may sign you out or remove unfinished work. The main storage functions are:

The user_token cookie keeps you signed in for up to 60 days unless you sign out, clear it or your account becomes unavailable. It is not readable by ordinary page scripts. A separate dmt_oauth cookie is used for the social sign-in flow and expires after about 10 minutes.
Language preference: after you respond to a language suggestion or select a language, your browser stores a setting that suppresses the suggestion for 30 days. Clearing site data removes this setting.
Unfinished tree and greeting drafts are stored in your browser. The app treats drafts older than seven days as expired and removes them when they are next read; clearing site data removes local copies sooner. Draft text is not submitted as a greeting until you send it.
Referral campaign parameters may be kept in browser storage until you clear site data and may be copied into account records when you register. They help identify how people found the service; they are not a record of your contacts or other websites you visit.

7. Service providers, sharing and external links

Hosting, delivery, database, security and sign-in service providers process information needed to provide their functions. This site uses Cloudflare infrastructure and requests fonts and icons from Google Fonts, so those providers may receive ordinary request information such as IP address and browser headers. Your selected social sign-in provider and our sign-in intermediary process the authentication exchange under their respective roles and policies.

Clicking a social share option opens the selected platform with your tree link and prepared text, and that platform may process the request or fetch a preview. It does not give us your contacts or automatically post to your social account. The share-link builder does not include private greeting text, account passwords or your phone number. Sponsored links, if enabled, lead to external sites under their own policies; private greetings are not supplied as advertising content by this feature.

We may provide information where reasonably necessary to comply with valid legal process, protect safety or rights, investigate abuse or respond to a request you authorize. We limit such disclosures to what is appropriate for the purpose and applicable law. We do not publish your private sign-in details as part of the public tree.

8. International processing

The service is delivered through global infrastructure. Depending on where you live and the providers involved, information may be processed outside your country. Cross-border processing remains subject to applicable data-protection requirements. You may contact us for details about the processing locations and safeguards relevant to your information; we do not promise that every copy remains in a particular country.

9. How long information is kept

Account, tree and greeting records are kept for the service’s operation and continuity; they are not automatically erased when a seasonal reveal or collection period ends. We assess retention using the information’s purpose, account status, security and dispute needs, applicable legal requirements and requests from affected individuals. Short-lived sign-in states and rate-limit counters are periodically cleared; infrastructure logs or backups, where present, may follow their providers’ retention cycles.

10. Account deletion and other removal requests

The account-deletion control signs you out, disables that sign-in identity for this site and hides your tree. It is not an immediate erasure of all stored information, and previously sent greetings are not automatically removed from recipients’ trees. Identity links and records needed to prevent reactivation, investigate abuse, resolve disputes or meet legal requirements may remain. Contact us about any additional deletion or correction request; we will assess it under the law that applies and explain any relevant limits.

11. Your choices and rights

You can choose your signature, anonymity and public-reading setting before sending; change a tree’s appearance; stop accepting greetings; sign out; or delete your account using the available controls. Depending on applicable law, you may also request access, correction, erasure, restriction, objection or a portable copy of certain personal information, and withdraw consent where it is the basis for processing. These rights are subject to their legal conditions and do not guarantee a self-service export or immediate deletion tool.

For a request, describe what you need and identify the relevant account or tree using only necessary information. We may need reasonable proof that a request concerns your information, and will respond within the period required by applicable law. You may also complain to the data-protection authority that has jurisdiction over your concern. Do not send passwords or unnecessary identity documents.

12. Security and your role

We use measures such as secure transport on the production site, salted password hashing, account-based access rules and abuse limits. No online system is completely secure, and technical or human errors can occur. Do not put passwords, financial details, identity documents or other highly sensitive information in a greeting. Protect your account and shared devices. We will address security incidents and give notifications where required by applicable law.

13. Children and young people

The service is not intended for children under 13 or anyone below the higher minimum age required where they live. A parent or guardian should be involved where local law requires their permission. We do not currently provide a parental-consent verification process. If you believe a child has supplied information contrary to these rules, contact us so we can investigate and take appropriate action, including restriction or removal where required.

14. Changes to this Policy

We may update this Policy when our practices or legal requirements change. The revision date appears above. We will provide additional notice or request consent where required for a material change. Refer to this page for the current explanation of our information practices.

15. Contact and privacy requests

For privacy questions or requests about your information, email support@decomytree.net. Tell us the request type and the relevant account or tree; do not include your password. We may ask for proportionate information needed to identify and respond to the request.