Privacy policy

Last updated 2 September 2026

Ay Caramba! lets you share a piece of news with one link and lets the person who opens it record their reaction and send it back to you. This page explains what information the service handles, what it doesn't, and what you can do about it. It is written to be read, not skimmed past.

Who we are

Ay Caramba! is operated from the United Kingdom by the business behind ay-caramba.app. For anything about your data, email hello@ay-caramba.app.

The short version

Reaction videos are recorded on the friend's phone and never pass through our servers. They go straight from their phone to yours, by whichever app they choose.
The news you write (names, message, headline, photo) is stored so the link works, and is deleted automatically after 90 days.
We use no cookies and no advertising trackers, and we don't build profiles of anyone.
Gift links are affiliate links. If you buy something, the retailer may pay us a small commission. That relationship is between you and the retailer.

What we store, and why

When you create a link we store what you typed: your first name, your friend's name if you gave one, the instruction, the message, the headline, the kind of news, whether you asked for the camera to be required, and your WhatsApp number if you chose to add one. If you added a photo we store a phone-sized copy of it. We also record which country the link was created from, using the connection's network location rather than anything on your device, so that gift suggestions match where you are. All of this is needed to show the reveal to the people you send the link to. It is kept for 90 days from creation and then deleted automatically. Anyone who has the link can open it, so share it with people you trust.

When someone opens a link their browser asks their permission to use the camera. The recording is made and held entirely on their device. It is never uploaded to us. They watch it back and then decide whether to send it, and to whom, using their own phone's sharing. If they decline the camera they can still see the news, unless the sender chose "No reaction, no tea!", in which case the news stays hidden until they allow it.

Usage counts. To understand whether the service works, we count anonymous events: a link was created, a link was opened, the camera was allowed or declined, the news was revealed, a reaction was recorded, sent or saved, a gift suggestion was shown or tapped. These are plain counters per day, per country and per kind of news. They carry no identifier of any kind and no cookie. The one exception is a count of how many reactions have been recorded against each link, kept only so that a sender's reaction limit works; it says nothing about who reacted.

Web traffic. We use Cloudflare Web Analytics, which measures visits without cookies or fingerprinting and does not track individuals across sites. Cloudflare also delivers the site and, as part of that, processes connection details such as IP addresses for security and performance, under its own privacy policy.

Email. If you write to hello@ay-caramba.app we keep the correspondence for as long as needed to deal with it.

What we don't do

We don't set cookies or use local tracking identifiers.
We don't sell, rent or share your information with advertisers.
We don't see, store or analyse anyone's reaction video.
We don't use your data to train anything.

Gift suggestions and affiliate links

After a reaction is sent, the friend may see a short list of gift ideas that suit the news. These link to retailers and are affiliate links, provided through networks such as Awin and Amazon Associates. Clicking one takes the visitor to the retailer's site; from that point the retailer's and network's own privacy terms apply. Affiliate networks may set their own cookies on the retailer's site to record that a sale came from us. We receive only aggregate commission reports, not the identity of buyers.

Legal basis

We process the information you provide in order to perform the service you asked for (creating and showing a reveal). Anonymous usage counts and security processing rest on our legitimate interest in running and improving the service, which does not override your rights because the data is not personal. Camera access on the friend's device happens only with their explicit permission, given in the browser at the time.

Your rights

Under UK and EU data protection law you can ask what we hold about you, ask for it to be corrected or deleted, object to processing, or complain to the Information Commissioner's Office (ico.org.uk) or your local authority. Because reveals are identified only by their link, please include the link when you write to us so we can find it. Deleting a reveal removes the text and photo immediately; the anonymous counters are unaffected because they contain nothing about you.

Children

The service is for adults. If you believe a child's information has been uploaded, tell us and we will remove it.

Where data is held

Reveals are stored with Cloudflare, which keeps copies across its global network so links open quickly anywhere. Cloudflare provides appropriate safeguards for transfers outside the UK and EU.

Changes

If we change how the service handles information, we'll update this page and the date at the top. Material changes will be flagged on the site.