Privacy
Last updated
When someone sets up a Secret Santa or a wishlist, we store:
We never ask for an email address, phone number, password or payment details. Names can be anything the organizer chooses: first names or nicknames work fine.
Private links work like keys: anyone who has one can open what it unlocks. Share them only with the person they’re meant for.
Each group is deleted automatically 90 days after it was last used. Opening your link, editing a list, marking a gift or redrawing all count as use, so a group that’s still active stays until it goes quiet. There’s no button to delete a group sooner yet: if you’d like one deleted now, email hello@giftmycrew.com with its link and we’ll remove it.
To help you get back to your lists without an account, your browser remembers the groups and lists you make or open on it (the “Your lists” menu), your last few wishlist ideas, and which ideas you’ve already seen. This is kept in your browser’s storage and isn’t sent to us. It includes your private links, so anyone using your device could open them. You can remove an entry with the × in “Your lists”, or clear everything by clearing your browser’s site data.
We don’t use cookies.
When you paste a link into a wishlist, our server visits that page to fetch the product’s name and picture. The store sees our server’s visit, not yours. Pictures are then shown through our own server, so viewing a list doesn’t make your browser contact the store either.
When you click through to Amazon, Target, Etsy or any other store, you’re on their site, and their own privacy policies and cookies apply.
To see how the site is used and how fast it loads, we use Vercel Web Analytics and Vercel Speed Insights, provided by our host. They don’t use cookies and don’t identify you. Before anything is sent, each page’s address is cut down to the kind of page it is (“a reveal page”, not which group’s), and private links are removed, so no names, group IDs or links are recorded. What’s left is general information such as the page type, the referring website, and your browser, device type and country.
Beyond page views, we count a few actions: a group being created, an invite being shared, a reveal being opened, an idea being added, a gift being marked bought, and a page failing to load. Each count carries at most a type or a yes/no (such as “Secret Santa” or “has a link”), never what you typed. Speed Insights measures load times on about a third of page views.
When something breaks on our server, we log the kind of page and the error message, without the page’s address, so we can fix it.
To stop abuse, like someone guessing PINs or flooding the site, we count requests. For a few actions (creating a group, fetching link previews and pictures) that count is kept against your IP address for about two minutes, then it expires. Wrong PIN guesses are counted against the person’s spot for up to an hour.
The site runs on Vercel (hosting) and Upstash (our database). They process this information only to run the service for us. Like most hosts, Vercel may keep standard request logs, which include IP addresses and the addresses of pages visited, for a limited time.
GiftMyCrew is meant to be set up by adults, such as a parent running a family Secret Santa. We don’t knowingly collect information from children beyond the names an organizer types in.
If how we handle information changes, we’ll update this page and the date at the top. Questions? Email hello@giftmycrew.com.