Privacy, terms & your data

Privacy policy

Esho (“we”, “us”) makes digital invitations for weddings and celebrations in Bangladesh. This policy covers the Esho website and the invitation pages your guests open. If anything here is unclear, write to us at hello@esho.app.

What we collect

Your account

• Name, and the mobile number or email address you sign in with.
• If you sign in with Google or Facebook: your account ID with that service, your name, your email address and your profile photo link. We never see or store your Google or Facebook password, and we don’t post anything on your behalf.
• If you use an email and password: your password is stored only as a secure one-way hash.

Your invitations

• What you type into an invitation: names, dates, times, venues, wording and RSVP contact details, and any photos you add.
• The design you chose and when you saved or published it.

Payments for Premium designs

• The amount, whether you paid with bKash or Nagad, the number you paid from and the transaction ID, so we can match your payment. We never ask for or see your bKash or Nagad PIN.

Technical information

• A sign-in cookie that keeps you signed in. We don’t use advertising cookies.
• How the site is used (Google Analytics, which sets its own cookies to count visits): the pages visited, roughly where from and on what kind of device. Pages that could identify you or a private link (Wish Lists, invitations, profiles, friend invites and your account pages) are sent only as the kind of page, never their address, title, a guest’s name or anything after “?” other than campaign tags. Links you tap to other sites are sent without anything after “?”, so a share link’s text and the link inside it never go, and what you type into search isn’t sent. This cleaning happens in your browser, before anything is sent to Google.
• Your IP address, briefly, to limit repeated sign-in attempts and protect accounts from misuse.
• Your browser also keeps your latest draft on your own device, so you don’t lose work.
• Counts of visits to Wish List pages, Discover and public profiles (Vercel Web Analytics, which uses no cookies). We record only the kind of page, never which wish list or profile, its link or what was searched.
• When you make a Wish List or change who can see it: the setting before and after, how old the wish list was and when. It stays linked to that wish list (not to your name or contact details) and only Esho staff see it, as totals, to check that the choices are clear.

How we use it

• To run your account, save your invitations and publish them at the link you share.
• To send sign-in codes by SMS, password reset emails and messages about your orders (for example, the link once your payment is confirmed).
• To check Premium payments and keep records of orders.
• To keep the service safe: stopping abuse, spam and fraud, and taking down invitations that break our terms.

We don’t sell your information and we don’t use it for advertising.

Who can see your invitation

A published invitation can be opened by anyone who has its link, so share it with the people you’re inviting. Invitation pages are hidden from search engines. Guests reply to you directly (for example on WhatsApp); we don’t keep their replies.

Who can see your Wish Lists

You choose for each wish list: Public (anyone can find it in Discover and on your public profile), Friends, specific people, anyone with the link, or Private. Strangers never see your delivery address or phone number. If you shared your collection link while it was Public, apps like WhatsApp or Messenger may continue showing a saved preview after you make it Private. Esho can’t remove those copies.

Services that help us run Esho

We use trusted providers who process data only to provide their service to us:

• Vercel: hosts the website, and counts visits to Wish List pages (see Technical information).
• Supabase: stores accounts, invitations and orders in its database.
• Google: Google Analytics (see Technical information), and sign-in if you choose it.
• Facebook (Meta): only if you choose to sign in with it.
• An SMS provider (for sign-in codes and order messages) and an email provider (for password resets).

These providers may store data on servers outside Bangladesh. We may also share information if the law requires it.

How long we keep it

• Your account and invitations: until you delete them or your account.
• Order records (amount, method, transaction ID): kept after account deletion for accounting, without your account details attached.
• Sign-in codes expire after 5 minutes and password reset links after 1 hour.
• Records of who-can-see-it changes to a wish list: 180 days, or until you delete the wish list.

Your choices

• Change your name, email, password and sign-in methods in Account → Settings.
• Unpublish or delete any invitation from My creations.
• Delete your account and all your invitations at any time: see Delete your data.
• Ask us for a copy of your data or to correct it by writing to hello@esho.app.

Children

Esho is for adults planning events. Accounts are not meant for anyone under 18.

Changes

If we change this policy we’ll update the date at the top, and tell you in the app or by email for important changes.

Contact

Questions or requests about your data: hello@esho.app.

Terms of use

By creating an account or publishing an invitation on Esho you agree to these terms and to our privacy policy. If you don’t agree, please don’t use Esho.

Your account

• You must be at least 18 and give accurate details.
• Keep your sign-in methods safe. You’re responsible for what happens in your account.
• You can delete your account at any time in Account → Settings.

Your invitations

• You keep ownership of what you write and the photos you add. You give Esho permission to store them and show them to anyone with your invitation’s link, only to provide the service.
• Only add content you have the right to use, including photos of other people.
• A published invitation can be opened by anyone with its link. You decide who you share it with.

What’s not allowed

Don’t use Esho for anything unlawful, hateful, harassing, sexually explicit, misleading or fraudulent, to collect money under false pretences, or to send spam. We may take down an invitation or block an account that breaks these rules. When we take down an invitation we’ll show you the reason.

Designs

The invitation designs, artwork and code belong to Esho and the designers we work with. You may use a design for your own invitations on Esho; you may not copy, resell or reuse the designs elsewhere.

Premium designs and payment

• Free designs cost nothing. Premium designs are a one-time payment per invitation, at the price shown at checkout. There is no subscription.
• For now, you pay by sending the amount with bKash or Nagad to the number shown at checkout, then entering the number you paid from and the transaction ID. We check each payment, usually within a few hours, and publish your invitation once it’s confirmed.
• If we can’t find your payment we’ll tell you why, and you can send the details again.
• A paid invitation stays live for at least 6 months from publishing.
• Refunds: if you paid twice, paid the wrong amount, or we can’t deliver your invitation, write to hello@esho.app with your order number (ESH-…) and we’ll refund you to the number you paid from.

The service

We work hard to keep Esho and your invitation pages online, but we can’t promise the service will never be interrupted. We may improve or change features over time. Esho is provided “as is”; to the extent the law allows, we aren’t liable for indirect losses, and our total liability for a paid invitation is limited to what you paid for it.

Ending

You can stop using Esho and delete your account at any time. We may suspend or close accounts that break these terms.

Law

These terms are governed by the laws of Bangladesh.

Changes and contact

If we change these terms we’ll update the date at the top, and tell you for important changes. Questions: hello@esho.app.

Delete your data

You can delete your Esho account and everything in it yourself, at any time. Here’s how.

What gets deleted

• Your profile: name, mobile number, email address, password, profile photo link.
• The link to your Facebook or Google account (the ID we received when you signed in with it).
• All your invitations, drafts and published ones. Their guest links stop working.
• Your sign-in sessions on every device.

Order records for Premium payments (amount, method, transaction ID) are kept for accounting, no longer linked to you.

Remove only Facebook or Google

To keep your account but stop signing in with Facebook or Google, open Account → Settings and press Disconnect next to it (you need another way to sign in first). You can also remove Esho from your Facebook settings under Settings & privacy → Settings → Apps and websites, or from your Google account under Security → Third-party connections.

Can’t sign in?

Email hello@esho.app from the address on your account, or tell us the mobile number you signed up with, and ask us to delete your account. We’ll confirm it’s you and delete your data within 30 days, and let you know when it’s done.