Privacy Policy

Last updated 10 October 2026

The short version

We collect what it takes to run your lists and deliver gifts: mainly names and email addresses.
We never see or store your card number, bank details or ID. Payments and payouts go through Stripe.
We only hold a delivery address if you add one to a list. Only givers who are buying you something from that list can see it. We never ask givers for theirs.
On surprise lists you can’t see who gave what until you open your gifts. Then you see givers’ names and what they gave, never their email addresses.
We don’t sell your personal information, and we don’t use advertising trackers.
You can ask for a copy of your data, or for it to be deleted, at any time.

Who we are

The Gift Guide is run by The Gift Guide (“we”, “us”). We are responsible for the personal information described here (the “controller”, in GDPR terms). Contact us at hello@wantlist.app or by post at [postal address — to be filled in].

What we collect

If you have an account

Your email address, which is how you sign in.
Your display name and @handle, plus anything you choose to add to your profile, such as a short bio, a photo link, or your birthday (month and day only, never the year).
Your lists and what’s on them: gifts, notes, prices, links to shops, cash funds, and any screenshots you upload to add a gift.
What you search for when adding a gift.
If you choose to add one, a delivery address for a list: the name on the parcel, street address, town, region, postcode, country and any delivery notes.
Whether, and when, you opened your gifts on a surprise list.
If you take Plus or set up payouts, the identifiers Stripe gives us for your Stripe customer and payout accounts, your plan, and whether your payout account is ready.

If you give a gift, with or without an account

The name and email address you enter, and any note you write to the list’s other givers.
What you claimed or gave, how much, and when.
For cash gifts, the fee you paid and Stripe’s reference for the payment, so we can match it to your gift and handle refunds.

From everyone who visits

Network information. Your IP address is used briefly to stop abuse, such as too many sign-in attempts. Our hosting providers keep standard request logs for a short time.
Clicks out to shops. We count these using a one-way scrambled code made from your IP address, browser type and the date. It changes every day, so we can count unique clicks but can’t follow you over time.
Signed-in devices. For each signed-in session we keep your browser’s description (its “user agent”), so you can recognise your sessions.

Card, billing and address information

Cash gifts and Plus subscriptions are paid on a checkout page run by our payment processor, Stripe. Your card number, expiry date, security code, and any billing name or address Stripe asks for are sent straight to Stripe. They never pass through our servers and we don’t store them. We keep only the amount, the fees, the payment status and Stripe’s reference number.

To receive cash gifts, you set up a payout account with Stripe. Stripe collects the details the law requires to pay you, such as your legal name, date of birth, address, tax ID or the last digits of it, ID documents, and your bank account. That information is held by Stripe under its own privacy policy. We learn only whether your account can receive payouts.

Plus subscribers manage their card and billing details in Stripe’s billing portal. Stripe may use your billing country or address to work out sales tax or VAT.

Delivery addresses. A list owner can choose to add a delivery address to a list, so that givers can have gifts sent straight to them. It’s never shown on the list. Only a giver who has an active claim on a gift from that list can see it, under that gift. If they let the gift go, they lose access. On a public list, that means anyone who claims a gift; the settings page says so before you save. The owner can change or remove the address at any time. We don’t put the address in emails, and we never give it to shops: a giver types it into the shop’s own checkout. We never ask givers for their addresses. When you buy from a shop, the shop handles delivery under its own privacy policy.

How we use it, and why we’re allowed to

To provide the service you asked for: sign you in, host and show your lists, record claims and gifts, process payments and payouts, show your delivery address to the givers you’ve chosen to share it with, and send you sign-in links, gift receipts, and a note when a gift people chipped in for is fully funded. Legal basis: performing our contract with you.
To keep it safe and working: prevent fraud and abuse, enforce our Terms, fix problems and understand how features are used. Legal basis: our legitimate interests in running a secure service.
To meet legal duties: keep financial records, answer lawful requests, and handle tax reporting. Legal basis: legal obligation.
To earn money without tracking you: count clicks to shops and sponsored picks so we can be paid for them (see our disclosures). Legal basis: legitimate interests.

We send only emails you need, such as sign-in links and receipts. We don’t send marketing email. If that ever changes, we’ll ask first and every message will have an unsubscribe link. We don’t make decisions about you by automated means that have legal or similarly significant effects.

Who can see what

Public lists can be seen by anyone, and your name, @handle, bio and public lists appear on your profile and in people search. Link-only lists can be seen by anyone with the link, and don’t appear in search or on your profile. Private lists are visible only to you.
The surprise. With surprise mode on (the default), a list’s owner can’t see who claimed, chipped in on or bought anything, until they choose to open their gifts, usually after the occasion. For cash funds the owner sees the total received, because it’s their money, but not who gave it. If a gift they chipped in on becomes fully funded, we tell them so by email, but not which gift, until they’ve opened their gifts.
When the owner opens their gifts (or on a list with surprise mode off), they see the name you gave, what you claimed or bought, and how much you gave. That includes anything given after they open them. They never see your email address, or the notes you wrote to the other givers. Opening is permanent.
Delivery addresses are visible only as described above, to givers with an active claim on that list.
Other givers on the same list can see your first name next to what you claimed, so nobody buys the same thing twice. They never see your email address.

Who we share it with

We share personal information only with these companies, only so they can provide a service to us, and under contracts that limit what they can do with it:

Stripe: payments, payouts, Plus billing, fraud prevention, and identity checks for people receiving money.
Resend: sends our emails.
Anthropic: reads screenshots you upload to work out which product is in them. Under its commercial terms, Anthropic doesn’t use this data to train its models.
Hosting, database and storage providers (currently Vercel, Neon and Cloudflare): run the service and store its data.
Product search providers (such as eBay, SerpApi and Best Buy): receive the words you search for, but nothing that identifies you.

Shops and affiliate networks. When you follow a link to a shop, you leave The Gift Guide. The shop, and affiliate networks such as Amazon Associates, eBay Partner Network, Impact and Skimlinks, may set their own cookies under their own policies, as with any link on the web.

We may also disclose information when the law requires it, to protect people from fraud or harm, or as part of a merger or sale of the business. In a sale, this policy would continue to apply to your information.

We don’t sell your personal information or share it for cross-site targeted advertising, as those terms are defined in US state privacy laws, and we haven’t done so in the past twelve months.

Cookies

We use three strictly necessary cookies: two keep you signed in, and one remembers gifts you’ve claimed as a guest. There are no advertising or analytics cookies. Details are in our Cookie Policy.

How long we keep it

Your account, profile and lists are kept until you delete them or ask us to.
A delivery address is kept until you remove it from the list, or delete the list or your account. It’s then deleted, not archived.
Sign-in links expire after 15 minutes. Sign-in sessions end after 60 days without use.
Uploaded screenshots are kept until you ask us to delete them or close your account.
Records of payments, refunds and payouts are kept in our Stripe account for as long as tax and financial laws require, usually up to seven years, even after an account is closed.
Rate-limit counters last minutes. Click records hold no IP address.

When you close your account, we delete your profile and your lists, including the record of gifts given on them. Gifts you gave on other people’s lists stay on those lists under the name you gave, because their owners and givers depend on them. They’re no longer linked to your account, and you can ask us to remove your name and email from them.

Security

All traffic is encrypted (HTTPS). There are no passwords to steal. Sign-in links and session tokens are stored only in scrambled form, and sessions live in cookies that page scripts can’t read. No system is perfectly secure, though. If a breach affects your information, we’ll tell you, and the authorities, as the law requires.

Your rights

Wherever you live, you can ask us to:

give you a copy of the personal information we hold about you, in a portable format;
correct it (you can also edit most of it yourself);
delete it, apart from what the law requires us to keep;
stop using it for a particular purpose.

Email hello@wantlist.app from the address you use with The Gift Guide, so we can confirm it’s you. We’ll reply within 30 days, or sooner if your local law requires it. Exercising your rights is free, and we won’t treat you differently for it.

EU, EEA and UK. You also have the rights to restrict processing, to object to processing based on legitimate interests, and to complain to your data protection authority (in the UK, the ICO).

California and other US states. You have the right to know what we collect and how we use it, to delete and correct it, and to opt out of its sale or sharing, which we don’t do. You can use an authorised agent; we’ll ask them for proof that you authorised them. In the last twelve months we collected these categories: identifiers (name, email, handle, and a postal address if you add a delivery address to a list), commercial information (gifts claimed and given, Plus subscriptions), internet activity (clicks to shops, device descriptions), and content you provide (lists, notes, screenshots). We use it only for the purposes above. We don’t use sensitive personal information to infer things about you.

Where your data is processed

The Gift Guide and its providers are based mainly in the United States, so your information is processed there. When we move information out of the EU, EEA or UK, we rely on legal safeguards such as the European Commission’s Standard Contractual Clauses, or the provider’s certification under the EU–US Data Privacy Framework.

Children

The Gift Guide isn’t meant for children under 13, or under the minimum age to consent in your country if it’s higher, and we don’t knowingly collect their information. If you think a child has given us their information, tell us and we’ll delete it. You must be 18 to receive cash gifts.

Changes to this policy

If we change how we use your information in a meaningful way, we’ll tell account holders by email before the change takes effect, and update the date above.

Contact

The Gift Guide · hello@wantlist.app · [postal address — to be filled in]