Legal
Effective date: June 7, 2026
Bored Button LLC (“we,” “us,” “our”) operates Sprig at sprig.cards (the “Service”), a tool for creating digital greeting cards and sharing them by link. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have.
For any privacy question or request, email [email protected]. For the purposes of the EU and UK General Data Protection Regulation (GDPR), Bored Button LLC is the “data controller” of personal data processed through the Service.
Information you provide:
Information collected automatically:
Sprig is free to use, and we do not collect payment information.
We keep things deliberately light. We use no advertising, analytics, or cross-site tracking cookies, and we do not track you across other websites. We also serve our fonts and other assets from our own domain—no third-party fonts, analytics, or tracking scripts load when you visit. What we do use is limited to what’s needed to make the Service work:
Because we use only strictly necessary and functional cookies and storage, we do not display a cookie-consent banner. If we ever add analytics or other non-essential technologies, we will ask for your consent first.
We use the information above to:
Our legal bases (GDPR). We rely on: performance of a contract / your request (to create your account and provide your cards); legitimate interests (to keep the Service secure, prevent abuse, and operate it reliably); and consent (for optional marketing emails and the optional survey, which you can withdraw at any time). We never sell your personal information or use it for third-party advertising.
When you create a card for someone, you give us that person’s name so we can display it on the card. You share the finished card with the recipient yourself—by link, or through your own messaging or email apps—so we do not collect a recipient’s contact details or message them on your behalf. If you are a recipient and would like your name removed from a card, contact us at [email protected] and we will delete it.
If you add a phone number to your account, we use it only to send one-time sign-in verification codes. We do not deliver cards by text, and we do not send marketing texts. Message and data rates may apply. You can stop these texts at any time by removing your phone number from your account (provided you have an email on file for sign-in), or by replying STOP.
We do not sell, rent, or trade your personal information. We share it only with service providers (“processors”) who help us run the Service, and only the data they need to do so:
These providers are bound by contract to use your data only to provide their services to us. We may also disclose information if required by law or to protect the rights, property, or safety of Bored Button LLC, our users, or the public, and as part of a merger, acquisition, or sale of assets (in which case we will notify you).
We are based in the United States, and the providers above are located in the United States. If you access the Service from the EU, UK, or elsewhere, your information will be transferred to and processed in the United States. Where required, these transfers are protected by appropriate safeguards such as the Standard Contractual Clauses or equivalent measures offered by each provider.
We keep your account information for as long as your account is open. Cards you create are stored so that you and your recipient can view them; when you delete a card, it is removed from your account. One-time sign-in codes expire within minutes and are purged. If you ask us to close your account or delete your data, we will erase it from our active systems, except where we are required to keep certain records by law. Residual copies may persist briefly in routine backups before being overwritten.
Depending on where you live, you may have some or all of the following rights regarding your personal information:
To exercise any of these rights, email [email protected]. We will respond within the timeframe required by applicable law. You will not be discriminated against for exercising your rights.
EU/UK residents (GDPR). You also have the right to lodge a complaint with your local data protection authority if you believe we have mishandled your data.
California residents (CCPA/CPRA). You have the right to know what personal information we collect and how we use it, to request its deletion or correction, and to opt out of the ”sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined under California law, and we do not use it for cross-context behavioral advertising.
We take reasonable technical and organizational measures to protect your information, including encrypted (HTTPS) connections, restricted access to our database, and storage of credentials and secrets outside the public web root. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 16 (or under 13 in the United States). If you believe a child has provided us personal information, contact us and we will promptly delete it.
We may update this Privacy Policy from time to time. The effective date at the top reflects the most recent version. If we make material changes, we will take reasonable steps to notify you. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
Bored Button LLC
Email: [email protected]