Privacy policy.

The short version

• We collect what the product needs to work: your email, the people and dates you add, and the answers friends send back through a form.
• We do not sell data or show ads. Google Analytics runs on public pages only after you accept analytics cookies.
• You can delete your account from Settings at any time, and everything attached to it goes with it.
• A small number of companies process data for us — hosting, database, email delivery — and they are listed below.

Who is responsible

Giftlify, operated from Ukraine, is the data controller for the information described here. You can reach us about anything on this page at privacy@giftlify.io.

What we collect, and why

If you have an account

• Email address and password. To sign you in and to send your reminders. Passwords are stored only as a one-way hash by our authentication provider; nobody at Giftlify can read them.
• Display name, if you give one, to address you in emails.
• Time zone, detected from your browser when you first sign in, so a reminder arrives at nine in the morning where you are rather than where our servers are. You can change it in Settings.
• Reminder settings — whether you want reminder emails and at what hour.
• The people you add and their dates: names, relationship, dates such as birthdays, and anything you choose to note about them, such as interests, sizes, budget or things to avoid.

That last point is information about other people. Please add only what you need to choose a good gift, and nothing you would be uncomfortable with them seeing. It is visible only to you.

If someone sent you a preferences form

The form lets you tell the person who sent it what you would like — interests, favourite things, sizes, a wishlist, gift types to skip and ingredients or materials to avoid — and optionally your name. You do not need an account, and every field is optional.

Your answers go to one place: the account of the person who sent you the link. They are not published, not shared with anyone else, and not used for anything but helping that person choose a gift. If you would like them deleted, ask the sender, or write to us and we will remove them.

The ingredients and materials field is meant for things like "no scented products" or "avoid wool". If you mention an allergy or a health condition there, you are choosing to share it with the person who asked; please share only what they need to know.

If you just visit

Our hosting provider records standard server logs — IP address, browser type, the page requested and the time — to deliver the site and protect it from abuse.

Optional Google Analytics

If you accept analytics cookies, we use Google Analytics to understand visits to our public website and blog, including which pages people read, how they reach the site, and broad browser and device information. Google receives technical information, including your IP address as part of the network connection, and uses a cookie identifier to distinguish visits. We do not enable advertising personalization or Google signals.

The Google Analytics tag does not load before you accept. We exclude account screens, sign-in and password pages, friends' preferences forms, and URLs containing query parameters or unrecognized fragments, apart from validated Google tag diagnostic parameters. We do not send names, email addresses, gift preferences, form answers, or private link tokens as analytics data. If you move into an excluded page, analytics stays off until the next full page load.

You can accept or reject in the cookie notice and change your choice using Cookie settings on public pages. Rejecting does not affect the service. Changing to Reject stops further analytics collection and removes the analytics cookies this site set in your browser. Read how Google uses information from sites that use its services.

Protecting the form from abuse

When a preferences form is submitted, we keep a scrambled, one-way hash of the sender's IP address, mixed with a secret value, so that one address cannot flood the forms. The hash cannot be turned back into an address, and it is deleted within a day.

Emails we send

We send the reminders you set up, and emails you trigger yourself — confirming your address, resetting your password. Every reminder has a one-click unsubscribe link, and you can switch reminders off in Settings. We do not send marketing emails, and we never sell or share email addresses.

A reminder may include the answers a friend gave through your form, so that you have them when you need them.

Cookies and storage in your browser

When you sign in, your session is kept in your browser's local storage so you stay signed in; it is strictly necessary for the service and is removed when you sign out. Pages on the blog read it only to decide whether to show the "Dashboard" link or "Log in".

We remember your analytics cookie choice in local storage for up to 180 days. After acceptance, Google Analytics can set _ga and _ga_PJLNS154EM cookies. We configure these to expire after 180 days without extending that period on each visit. Clearing your browser storage removes the saved choice.

Our fonts are loaded from Google Fonts, which means your browser requests them from Google and Google receives your IP address as part of that request.

Some links in our articles may be affiliate links. When you follow one, the retailer may set its own cookies on its own site to record that you came from us; that happens under the retailer's privacy policy, not ours.

Who processes data for us

We use a small number of providers to run the service. Each processes data only to provide its service to us.

• Supabase — database, sign-in and background jobs. Your account data, the people and dates you add, and form answers are stored here, in the United States.
• Netlify — hosting, which serves the site and keeps the server logs described above.
• Resend — email delivery, which receives your email address and the content of each email we send you.
• Google Fonts — typefaces, as described above.
• Google Analytics — optional website analytics, only after you accept, as described above.
• Paddle — payments, once paid plans are available. Paddle acts as the merchant of record: it handles the checkout and your payment details directly, and we never see your card number.

Some of these providers are based in, or store data in, the United States. Where personal data from the European Economic Area or the United Kingdom is transferred there, it relies on the safeguards those providers offer, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.

Our legal bases

For readers in the European Economic Area and the United Kingdom, we rely on:

• Contract — to run your account and send the reminders you asked for.
• Consent — for answers submitted through a preferences form, which are given voluntarily and can be withdrawn by asking for their deletion.
• Consent — for optional analytics cookies and related measurement; you can withdraw it using Cookie settings.
• Legitimate interests — to keep the service secure and working: server logs and the abuse protection on forms.

How long we keep it

• Your account and everything in it — the people, dates, reminders and form answers — until you delete your account. Deleting it in Settings removes all of that immediately from the live database.
• Backups made by our database provider may hold deleted data for a limited period before they expire.
• Abuse-protection hashes — deleted within a day.
• Server logs and email delivery records — kept by Netlify and Resend under their own retention periods.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to receive it in a portable format, or to stop processing it. You can delete your account yourself in Settings. For anything else, write to privacy@giftlify.io and we will answer within one month.

If you are in the European Economic Area or the United Kingdom and believe we have handled your data wrongly, you have the right to complain to your local data protection authority.

Children

Giftlify accounts are not intended for anyone under 16. Our articles about gifts for teenagers are written for the adults buying them. If you believe a child has given us personal information, write to us and we will delete it.

Security

Everything travels over encrypted connections. Each account can read only its own data, enforced by the database itself rather than only by the app. Preferences-form links are long and unguessable, and you can reset one from a person's page at any time, which makes the old link stop working immediately.

Changes to this policy

If we change what we collect or how we use it, we will update this page and the date at the top. If a change matters, we will also tell account holders by email before it takes effect.