Privacy Policy

Who is responsible

Giftlist is made and run by Intrinsic_bywittywitch, an individual developer based in Romania. That person is the data controller for the purposes of the GDPR.

For anything about privacy, including the requests described under Your rights below, write to general@usegiftlist.com. You can also use the feedback form in the app.

What Giftlist collects

Only what the app needs to work. Each item below exists because a feature would break without it.

Your account

Email address and a password. The password is handled by Supabase Auth and stored only as a hash — it is never visible to us, and we cannot recover or read it.

Your profile

Display name, username, date of birth, profile photo, preferred currency and chosen app colour. All optional except the username, which you need before you can share a list.

What you save

Your lists and the gifts in them: titles, links, prices, notes, categories and interests, plus any pictures you upload.

Your connections

Friend requests and friendships, the people whose birthdays you follow, and anyone you block.

Claims

When you mark someone else’s gift as claimed or bought. You can do this without an account, in which case the claim is tied to a random identifier stored on your device rather than to you. If you later create an account, claims made on that device are moved onto it.

Feedback

The message you write, the reply address you optionally give, and the app version you sent it from.

A count of your uploads

How many pictures you upload each month, so we can see what image hosting costs. It is a number, not a record of the pictures.

What Giftlist does not collect

No location. No contacts or address book. No advertising identifier. No analytics or crash-reporting SDK of any kind — the app contains none, so there is no background collection to disclose. No payment details; there is nothing to pay for.

What is public, and what isn't

Giftlist is for sharing, so some things are deliberately visible to others. Please read this part rather than assuming.

• Your username, display name and profile photo appear on your public profile page at your @username.
• Lists you set to public are visible to anyone. Lists set to friends are visible to your friends. Anyone holding a share link to a list can open that one list, without an account.
• Pictures you upload are stored in public buckets. That means the image address works for anyone who has it, whether or not they have an account and whether or not the list is public. Don't upload a picture you would not be comfortable being seen.
• Your birthday is shown to your friends as a day and month only. The year is never shown to anyone.
• Gifts you mark as hidden are visible only to you. Claims are hidden from the list's owner, so the surprise survives.

Why, and on what legal basis

To run your account and the app

Performance of our agreement with you. Without an account there is nothing to sign in to and nothing to save.

To show your lists to the people you chose

Performance of our agreement with you — it is the feature you came for.

To answer your feedback

Our legitimate interest in fixing the app and replying to you.

To keep the service working and affordable

Our legitimate interest — this covers the monthly upload count and nothing more.

Your date of birth

Stored so friends can see the day and month. The year is kept for one reason: if advertising is ever added, it lets us keep age-restricted advertising away from users under 18. If we cannot tell your age, we treat you as under 18.

Who else sees your data

Giftlist does not sell personal data, and does not share it for advertising. Two service providers process data on our behalf:

• Supabase hosts the database, the sign-in system and the uploaded pictures. Your data is stored in their EU (Ireland) region.
• Resend delivers the email that notifies us when you send feedback. It is based in the United States, so that one message leaves the EEA.

We may also disclose data where the law requires it. Nothing else, to nobody else.

Advertising and affiliate links

Giftlist currently shows no advertising and earns no affiliate commission. Nothing in the app tracks you for advertising purposes, and no advertising SDK is included.

Both may change — the app has to pay for itself somehow. If advertising is added, it will not be personalised using the contents of your lists, and age-restricted or adult advertising will not be shown to users under 18. If affiliate links are added, some links to shops will carry a tag that tells the shop the visit came from Giftlist. Either change will be described here and reflected in the Play Data safety section before it goes live.

Links to shops

When the app reads a title, price or picture from a shop link you paste, the request is made by your phone, directly to that shop. The shop may see your IP address and device details in the same way it would if you opened the page in your browser. Giftlist never receives that information. The shop's own privacy policy applies to it.

Age

Giftlist is for people aged 16 and over. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child under 16 has an account, write to general@usegiftlist.com and it will be deleted.

How long we keep it, and how to delete it

Your data is kept while your account exists. There is no separate retention clock ticking in the background.

You can delete your account from inside the app under Settings → Account, or on this site at /mobile/delete-account, without installing anything.

Deletion is immediate and permanent. Your profile, lists, gifts, uploaded pictures, friendships, follows, blocks and claims are removed straight away. The account is not deactivated, frozen or held in reserve, and nothing can be restored afterwards. We hold no backup copies from which deleted data could be recovered.

Two things outlive the delete, and you should know about both:

• Cached copies of pictures. Deleted files stop being served from our storage, but copies already sitting in content delivery caches can persist for up to 7 days, and copies saved by the app on a phone that previously viewed them for up to about 30 days. We cannot reach into either.
• Feedback you sent will be kept. Your account link is removed from it, so it no longer identifies you, but the message itself is retained so that bug reports and suggestions don't vanish. If you also gave a reply address it stays attached to the message; ask us and we will remove it.

A username you have previously changed away from stays reserved so that nobody can take it and pose as you. The username you were using when you deleted your account is released and can be claimed again.

How it's kept safe

Everything travels over HTTPS. Passwords are hashed by Supabase Auth and never stored in readable form. Every table in the database has row level security switched on, so a signed-in user can only reach the rows the rules allow, and the check happens in the database rather than in the app. The one operation that runs with elevated privileges — account deletion — identifies you from your signed session and can only ever delete the account that made the request.

No system is perfectly secure. If a breach affects your data and poses a risk to you, we will tell you and the Romanian supervisory authority as the GDPR requires.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, have it deleted, restrict or object to how it's used, and receive it in a portable form. Most of this you can do yourself in the app: your profile is editable, and account deletion is one screen away in both the app and this site.

For anything else, write to general@usegiftlist.com. You have the right to complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) if you think your data has been mishandled.

Changes to this policy

If what we collect, who we share it with, or how long we keep it changes, this page changes first and the date at the top moves. For anything significant you'll be told in the app rather than left to notice.