PRIVACY NOTICE / 2026-10-28

Your words.
Your choice.

Operator and contact

Send a Message to the Universe is an independent online creative project. For privacy questions, content reports, removal requests or other enquiries, contact admin@sendamessagetotheuniverse.com.

Data we collect and why

We store the encrypted message, its category, public/private choice, random star identifiers, creation time and an acknowledgement timestamp/version for the Terms and Disclaimer. The purpose is to provide the symbolic message experience, save your star, display content you chose to make public, and establish that the form acknowledgement was submitted. We process this information to provide the service you request and on the basis of your public-sharing choice and our legitimate interest in operating and securing the site, as applicable.

Public and private messages

Private messages are not displayed publicly through the site; they can be read by anyone holding the secret private return link. Public messages are displayed on public star pages and may appear in the public universe. They may be indexed, saved, shared or archived by others. Do not publish personal, sensitive or confidential information.

Security and access

Messages are encrypted on the server. The site operator and hosting infrastructure can technically access the server's encryption key and files; this is not end-to-end or zero-knowledge encryption. No login or password is needed. Secure HTTPS is required to protect communications in transit.

Retention, deletion and backups

Messages remain until deletion through the secret return link, removal by the operator, or discontinuation. Deletion removes the live message file. Copies may persist temporarily in hosting-provider backups or in third-party screenshots, search caches or external shares. The cumulative message count may persist after deletion. If you have lost the private link, ownership verification and deletion may not be possible without additional information.

Abuse prevention

The application uses a short-lived, keyed hash derived from an IP address to rate-limit submissions and reports. It does not store raw IP addresses in message records, although the hosting provider may maintain ordinary access logs. Public-message reports store a reason, a timestamp and a hashed reporter marker to prevent repeated submissions.

Cookies and analytics

We use limited essential browser storage for functions such as retaining your cookie choice and, for administrators, sign-in sessions. These functions are necessary for operating the service. Optional analytics is separate and is off by default.

If you choose “Accept optional” in the cookie banner, we enable Google Analytics 4 (measurement ID G-Z72ZWD9J8R) on public informational pages and the public universe. This helps us measure visits, broad traffic sources and page use. You may choose “Reject optional” instead and continue using the website. You can change your choice at any time using “Cookie settings” in the footer of a public page.

When enabled, Google Analytics can use first-party cookies such as _ga and _ga_*, and process browser, device, usage and approximate geographic information. Google may process information internationally. We do not intentionally transmit messages, secret return links, form contents, or payment information to Analytics. Analytics does not run on individual star pages, the API, report pages or administrator pages. For more information, see Google’s Privacy Policy.

First-party conversion counters

We count successful wish submissions and anonymous button interactions such as share taps, image downloads, public-atlas visits and PayPal-link clicks using aggregate daily totals. These internal counters do not contain message text, private links, star IDs, email addresses or raw IP addresses. To limit repeated automated events, a keyed, short-lived network fingerprint may be processed in private server storage for up to roughly one hour, and hosting logs may independently persist. Button activity is not proof that a share or payment was completed. This functional measurement is separate from optional Google Analytics.

Payments and other recipients

No AI API is required. If you choose to support the site, the PayPal link opens an external payment service, which handles payment details under its own policies. Hosting providers may process stored data and standard logs. International access or hosting may involve cross-border processing, subject to the protections required by applicable law.

Your rights and complaints

Depending on your jurisdiction, you may have rights to access, correction, deletion, restriction, portability, objection or withdrawal of consent. Contact the operator to make a request. You may also complain to a competent data-protection authority. To delete your own message immediately, use the deletion option on your secret star page.

Changes

This notice may be updated as the project evolves. Material changes should be reflected in an updated date and, when appropriate, a new submission acknowledgement.