Plain-language policy
Privacy at Make a Hug
Effective August 22, 2026
Make a Hug is designed around unlisted links and no recipient account. This page explains what stays in your browser, what is stored so a care package can travel to another device, and what third-party services receive.
Drafts stay on your device
Before you create a share link, your draft—including selected photos, audio and drawings—is saved in your browser using IndexedDB. It is not sent to Make a Hug while you are still drafting. If IndexedDB is unavailable, a text-only fallback may be saved in local storage. Clearing site data removes that local draft.
What is stored after you create a link
When you choose “Create my private link,” Make a Hug stores the recipient and sender names you entered, the cover message, your goodie text and links, and any uploaded photo, drawing or audio file. This content is stored in a private Cloudflare R2 bucket so the recipient can open it from another device.
The package is not listed in a directory and package pages are marked not to appear in search engines. Anyone who obtains the long random URL can still open it. A private link is not end-to-end encryption, so do not include passwords, financial records, medical records or anything that would be dangerous if the link were forwarded.
Deletion keys and retention
When a package is created, Make a Hug returns a deletion key that is saved only in that creator’s browser. The service stores a one-way hash of the key, not the key itself. Using “Delete forever” removes the package record and its uploaded keepsakes. Packages otherwise remain available until deleted or until the service must remove them for safety, legal or operational reasons. Losing the browser’s local data may mean losing the deletion key.
Service and security data
Cloudflare processes network information needed to deliver and protect the site, which can include IP address, request time, browser details and security signals. Make a Hug enables sampled Workers logs and traces for reliability and abuse investigation. Application errors are logged without package message content.
Analytics
The site uses Plausible Analytics, Microsoft Clarity and Google Analytics 4 to understand visits, performance and whether the creation flow works. These providers may process device, interaction, approximate location and network information under their own privacy terms. Custom events sent by Make a Hug describe actions such as “goodie added” or “package created”; they do not include recipient names, sender names, message text, private package IDs or deletion keys.
PayPal
The optional support button is provided by PayPal. If you use it, PayPal processes the payment and related account information under PayPal’s privacy policy. Make a Hug does not receive or store your full payment-card details, and payment is not required to create or open a package.
Your choices
- Keep a package uncreated and it remains a local draft.
- Use “Delete forever” in Your sent hugs to remove a created package.
- Use browser privacy controls or content blockers to limit analytics where supported.
- Do not share a package URL beyond the intended recipients.
Children and sensitive content
Make a Hug is not directed to children under 13 and should not be used to store sensitive personal records. Only upload content you have permission to share.
Questions
Questions about this policy can be sent to hello@makeahug.com.