Privacy policy

1. Google user data we access

You sign in with Google. Christmas List requests only the basic sign-in permissions openid, email and profile, which give it:

• your Google account ID (to recognize you when you sign in again),
• your name,
• your email address and whether Google has verified it,
• the link to your profile picture.

Google also returns sign-in tokens, which are stored with your account record. Christmas List does not use them to call any Google service: it cannot read your Gmail, contacts, calendar, Drive files or anything else in your Google account.

2. How we use Google user data

• To create your account and sign you in.
• To show your name to the members of groups you belong to (you can change the name shown at any time on the Account page).
• To send you service emails at your email address: sign-in links you ask for, a welcome message, a notice when you are added to a group, and Secret Santa messages. No marketing or newsletters.

3. Other information we collect

• What you add: your display name, your language (English or Spanish), the gifts on your list (name, link, image link, price, priority and which of your groups can see each one), the groups you belong to, and which gifts you have claimed for others.
• Sessions: for each signed-in session, the IP address and browser type it started from, used to keep you signed in and to spot misuse.
• Link previews: when you add a gift with a link, the app visits that page once to read its product name and preview image address. The image is shown by loading it directly from the shop's website in the viewer's browser.

4. How information is shared

• With your groups: members see your display name and the gifts you make visible to that group. They can see that a gift on someone else's list has been claimed (and by whom, if the group's admin turns that on); you are never shown what has been claimed from your own list. Group admins can see the names and email addresses of people who have signed up, so they can add them to groups.
• With the services that run the app, only as needed to operate it: Vercel (hosting), Neon (database) and Resend (email delivery), all in the United States.
• If required by law, for example a valid legal request.

We do not sell your information, share it with advertisers or data brokers, use it for advertising, or use it to train AI or machine-learning models.

5. Google API Services: Limited Use

Christmas List's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we protect your information

• All traffic to and from the app uses HTTPS (TLS encryption).
• Data is stored in a managed Postgres database (Neon) that encrypts data at rest. Access is limited to the app itself and its single operator.
• Access inside the app is checked on the server: people only see the groups they belong to, and claim information is never sent to a list's owner.

7. How long we keep it

• Your account and the information above are kept while your account exists.
• Signed-in sessions expire after 7 days of inactivity.
• When you ask us to delete your account, your account, Google sign-in link, sessions, list and claims are deleted within 30 days. Gifts you claimed for others are released.

8. Your choices

• Change the name shown to others and your language on the Account page.
• Hide any gift from any of your groups, or delete it, on My list.
• Ask for a copy of your information, a correction, or deletion of your account by emailing panduhvka@gmail.com.
• Remove Christmas List's access to your Google account at any time at myaccount.google.com/permissions.

9. Cookies

Only two: one keeps you signed in, the other remembers your language. No advertising, analytics or tracking cookies or scripts.

10. Children

Christmas List is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has signed up, email panduhvka@gmail.com and we will delete the account.

11. Changes to this policy

If this policy changes, the new version will be posted on this page with a new effective date. Significant changes will also be announced in the app.

12. Contact

Questions or requests about your information: panduhvka@gmail.com.