Privacy Policy

1. Information We Collect

When you create an account:

• Username — chosen by you; displayed publicly on your profile
• Email address — used for login and password recovery only; never shown publicly
• Password — stored as a secure hash (bcrypt); we never store or see your plain password

Optional profile information you may add:

• Profile avatar (photo or generated initial)
• Bio / short description
• Gender, relationship status, and birth year
• Country (auto-detected from IP for display purposes)

All optional profile fields are under your control and can be changed or removed at any time.

2. Activity Data

As you use BabyName World, the following activity information is stored:

• Wall posts Text you post to your profile wall, including timestamps
• Community feed Posts and comments you publish to the community feed
• Name comments Comments you leave on name pages
• Reactions Likes you give to posts (stored to prevent duplicate likes)
• Saved names Baby names you add to your personal list
• Follow links Which accounts you follow and which follow you
• Couple link If you use the partner-linking feature, the link between your account and your partner's is stored
• Profile visits When someone visits your profile, the visit is counted (anonymously if they are not logged in)
• Notifications System notifications you receive (likes, comments, couple requests, etc.) — visible only to you
• Last seen The last time you were active on the site

3. Gender Reveal Cards

If you use the Gender Reveal Card feature, we store:

• The reveal card details you enter (baby name, couple names, reveal type)
• A unique random token that forms the private link for your card
• The number of times the card has been opened

The reveal card link is accessible to anyone who has the URL. We do not control who you share it with. The card is linked to your account and will be deleted if you delete your account.

Your browser also stores in localStorage (on your own device only) whether you have already opened a specific reveal card, to prevent the animation from replaying.

4. Technical Data

Our server automatically records standard web server logs, which may include:

• Your IP address
• Browser type and version
• Pages visited and timestamps

We use your IP address to detect your approximate country (for display on your profile) using a local or third-party geolocation service. We do not store your precise location. Server logs are kept for a short period for security purposes and then deleted.

5. How We Use Your Data

We use collected data to:

• Operate and provide the Site's features (profiles, posts, notifications, reveal cards)
• Allow you to log in and manage your account
• Send a password reset email if you request one
• Protect the Site against spam, abuse, and security threats
• Improve the Site based on usage patterns (aggregated, not individual)

We do not sell, rent, or share your personal data with any third party for marketing purposes.

6. Cookies & Local Storage

We use a minimal session cookie (PHPSESSID) to keep you logged in and to protect forms from CSRF attacks. This cookie is session-based and is deleted when you close your browser or sign out.

We use your browser's localStorage (not transmitted to our servers) for:

• bnw_lang — your chosen language preference
• bnw_theme — your dark/light mode preference
• cookies_decision — whether you accepted or declined the cookie banner
• rv_done_TOKEN — whether you have already viewed a specific reveal card (prevents replay)

We do not use advertising cookies, analytics trackers, or any third-party cookies. See our full Cookie Policy for details.

7. Data Security

We take reasonable technical measures to protect your data:

• Passwords are hashed with bcrypt via PHP's password_hash() — we cannot recover your password
• All forms are protected with CSRF tokens to prevent request forgery attacks
• Sensitive directories (/config/) are blocked from direct web access
• HTTP security headers (CSP, X-Frame-Options, etc.) are applied on every response
• Sessions use strict-mode and HttpOnly, SameSite=Strict cookies

No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Children's Privacy

BabyName World is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct any inaccurate data
• Request deletion of your account and all associated data
• Withdraw consent (where processing is based on consent)

To exercise any of these rights, please use our contact form. We will respond within 30 days.

You can also delete your account directly from your account settings page.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. Continued use of BabyName World after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests, please use our contact form.