Privacy policy

We collect the minimum data required to make a celebration meaningful: name, email, birthday (or anniversary), neighborhood, and the merchants you opt into. Merchants additionally provide business identity data (name, EIN, address, payout details).

We do not access your contacts, calendar, GPS background location, social graph, or browsing history. The product is built so that everything we know about you is something you chose to tell us.

To deliver offers from merchants you've opted into on the days you've told us matter, and to send transactional account messages (sign-in, billing, support).

We use aggregated, de-identified analytics to improve DASH product surfaces. We do not run behavioral ad targeting, and we do not enrich your profile with third-party data.

We share data with merchants only as a celebration signal (the window, not your name or full date). We use processors — Stripe (payments), Twilio (SMS), SendGrid (email), Cloudflare (hosting) — each bound by a DPA.

We never sell, rent, or trade celebrator data. It's contractually prohibited in our investor and operating agreements.

You can access, export, correct, or delete your data anytime from Account → Privacy. We honor CCPA, GDPR, and similar requests within 30 days, no questions asked.

Deletion is permanent across primary and backup systems within 30 days. We email a final ZIP export of your data on the way out.

We use strictly necessary cookies for sign-in and security, plus optional analytics cookies (Plausible, privacy-first, no PII) that you can disable in /legal/cookies.

DASH is not for users under 16. We do not knowingly collect data from children. If a parent or guardian becomes aware of such data, contact privacy@dash.day and we will delete it within 7 days.

Material changes are emailed to active users 30 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision.

Privacy questions: privacy@dash.day. EU representative: Maetzler Rechtsanwalts GmbH, Vienna.