Privacy policy

• We collect what GiftAdd needs to work: your email, your profile, and your lists.
• Only the members of a list can see it. Nobody can see who bought a gift.
• Your data is stored in the EU.
• We don't sell your data. [confirm]
• You can see, correct, download or delete your data by contacting us.

GiftAdd is run by [company name], [address], [company registration number]. We decide how your data is used, which makes us the “controller” under the EU's General Data Protection Regulation (GDPR). Questions about privacy go to [privacy contact email].

Only what you give us, and what's needed to run the app:

Account

Your email address. We use it to sign you in, with a 6-digit code we send you, and to write to you about your account.

Profile

Your nickname, the animal avatar and color you pick, and the currency for new lists. Your friend code.

Lists

Each list's name, color, currency, layout and join code, who's in it and since when, and the nickname each member uses in it.

Wishes

Name, category, estimated price, and any link, notes or picture you add. Who added each wish and when, and whether it's been bought. Not who bought it: that's never stored.

Categories

The categories you save for later.

Friends

Who you're friends with, and since when.

Technical data

Your IP address, device and app version, and times of use, which our servers process to sign you in, keep you signed in and protect GiftAdd against abuse.

Planned: crash reports (with Sentry) to fix bugs, and usage statistics (with PostHog) to see which features are used. Birthday reminders may follow later. None of these are collected yet, and this policy will say exactly what they collect before they are.

• Members of a list see the list, its wishes and which ones are bought, and each member's nickname (or list nickname) and avatar.
• Your friends see your nickname and avatar, and can add you to their lists.
• Anyone with a list's code can join that list, so only send it to people you want in it.
• Your friend code is only shown to you. Whoever you give it to, or who scans your QR code, becomes your friend.
• When you leave a list, or its owner removes you, the wishes you added stay in it, and the owner takes them over.
• Nobody can see who ticked a wish off. We don't store it.

The GDPR asks us to name a legal basis for each use:

Running GiftAdd

Your account, profile, lists, wishes and friends: to give you the service you signed up for (GDPR article 6(1)(b), contract).

Security

Technical data, to keep accounts safe and stop abuse: our legitimate interest in a secure service (article 6(1)(f)).

Crash reports

Once added: our legitimate interest in an app that works (article 6(1)(f)). [confirm]

Usage statistics

Once added: [your consent (article 6(1)(a)), or our legitimate interest].

These companies process data for us, only on our instructions, under data processing agreements:

Supabase

The database, accounts, pictures and live sync. Hosted in the EU ([region]).

Email

Sending sign-in codes: [email provider and region].

Sentry

Crash reports, once added. [region]

PostHog

Usage statistics, once added. [region]

Website hosting

[website host and region]

Apple and Google deliver the app through their stores, under their own privacy policies. If you sign in with your Apple or Google account once that's possible, they tell us your email address. If a provider processes data outside the EU or EEA, we rely on the EU's standard contractual clauses or an adequacy decision, such as the EU-US Data Privacy Framework.

• Your account, profile, lists and wishes: as long as you have an account.
• When you delete something, like a wish or a list, it's gone from GiftAdd straight away. Backups keep it for up to [backup period].
• When your account is deleted: [what happens to your lists, and to wishes you added to other people's lists], within [number] days.
• Technical logs: [log period].

Under the GDPR you can ask us to:

• show you the data we have about you, and give you a copy
• correct it (most of it you can change in the app yourself)
• delete it, along with your account
• send it to you in a format another service can read
• limit how we use it, or stop using it where we rely on legitimate interest
• withdraw consent, where we asked for it

Write to [privacy contact email] and we'll reply within a month. You can also complain to a data protection authority, for example the one where you live. In Denmark, that's Datatilsynet (datatilsynet.dk).

GiftAdd isn't meant for children under [minimum age]. If you believe a child has given us their data, contact us and we'll delete it.

This website uses no cookies, no analytics and no trackers. Its fonts come from our own server, not from Google. Like any website, its host logs requests, including IP addresses, to deliver pages and stop attacks, and keeps those logs for [log period].

Everything travels encrypted (HTTPS). The database itself checks every request against rules that only let people see the lists they're members of, and only let owners change a list's settings. There are no passwords to steal: you sign in with a one-time code sent to your email.

When this policy changes, the date at the top changes too. If a change matters, for example when we start collecting something new, we'll tell you in the app first.

[company name], [address]. Email: [privacy contact email].