Privacy policy

secretsanta.online is run by me, Berker Katipoğlu, as a private person. I decide what happens to your data: I'm its "controller", in the words of the GDPR, the EU's data protection law.

To reach me about anything on this page, write to hello@secretsanta.online.

• Your email. To sign you in, with a link I email you or with Google. It's the one thing I need: without it, you can't sign in. Nobody in your parties sees it.
• Your name. So the people in your parties know who you are. It starts as the first part of your email, or your name at Google, and you can change it any time. In each party you can go by another name.
• Your sessions. One for each device you're signed in on, so it stays signed in.
• Your parties. Each party's name, its gift day and the details its host adds (budget, join-by date, place, note), who's in it, its exclusion groups, and the draw: who gifts whom.
• Chats. What you write in the party chat and in giftee chats, so the people in them can read it.
• Your wish list. The links, titles and prices you add, so your Secret Santa knows what you'd like.
• Wish list clicks. When a santa opens an item on a wish list, I note who clicked, and the item's shop, link, title and price. That shows which shops people buy from, so I learn which shops are worth asking for a deal. Who clicked tells many santas apart from one santa clicking often. When an item is added, changed or removed, I note the same about the item, but not who did it.
• Feedback. What you write when you send me feedback, with your user-id, so I know whom to reply to. If you leave "Send debug info" ticked, it adds which version of the app you have, your browser and device as your browser names them, the last 3 screens you opened, and the last 5 errors the app hit. That helps me find bugs. To reply, I look up your email; the feedback doesn't keep it.
• Log lines. A short line for each thing the app does: what happened, when, and whether it worked. It holds your user-id and the party's id, and the country a request came from, nothing finer. Never your email, your name, what you write, or your IP address. They help me fix what breaks, set fair limits, spot abuse, and see how the app is used.
• Sign-in limits. So nobody can flood an inbox with sign-in links, I keep the network a request for a link came from, for an hour. It's never logged.
• From Google. If you continue with Google, Google tells me your verified email address and your name. The name only starts your name in the app.

Your user-id and a party's id are random codes that stand for you and the party inside the app. I don't build profiles of you, and nothing decides anything about you on its own: the draw is random.

• The people in a party with you see your name in that party, what you write in its chats, and your wish list.
• Your giftee chats with you without learning who you are.
• Nobody in the app sees your email.
• I read feedback and log lines, to run the app.
• I never sell your data, and nobody else gets it unless the law requires it.

The GDPR asks for a reason in law, a "legal basis", for each use. Mine:

• To give you the service you signed up for (a contract): your account, signing in, your parties, chats and wish list, and the feedback you send me.
• My legitimate interests: log lines and debug info, to keep the app working, fair and safe; wish list clicks, to learn which shops are worth a deal; keeping what you wrote in a party after you delete your account, so the other members' chats and draw still make sense; and security, such as the sign-in limits. None of these holds your email, your name or what you wrote in a chat, and you can object to them (see Your rights).

Nothing here rests on your consent.

While your account exists, I keep everything for good: your parties with their chats, groups and draw, your wish list, your feedback and the log lines. That holds for an account that's no longer used, too. Past parties are your history, and the other members' chats stay readable.

A few things go sooner: a session no device has used for 90 days ends, and a sign-in link works for 15 minutes and is gone within the hour.

You can delete it any time, from the Account sheet. At once:

• Your email, your name and your sessions go, for good, and every device you're signed in on is signed out. Your name goes from every party too.
• What you wrote in parties stays, without a name: it shows as "Ex-member", so the others' chats still make sense.
• Your wish list stays, tied to no one, and nobody sees it any more.
• Your user-id stays in feedback and log lines, but points to nobody: nothing ties it to you any more.
• A party with nobody else in it is deleted whole.

Signing in again with the same email starts a new, empty account.

Two companies process data for me, each only for its part:

• Cloudflare runs the app: hosting, storage, the log lines and their analytics, the sign-in emails, and forwarding what you write to hello@secretsanta.online.
• Google signs you in when you choose Continue with Google, and holds my inbox (Gmail), where your emails to me arrive and my replies come from.

Your data is stored wherever Cloudflare places it, which can be outside the EU, the United States included. Transfers to the US are covered by the EU-US Data Privacy Framework.

A wish list link takes you to the shop's own site, where the shop's privacy policy applies.

Only what the app needs to work, in your browser's storage:

• your session: your user-id and sign-in token, so you stay signed in (never your email);
• a random code that ties a sign-in link to the browser that asked for it;
• the currency you last picked for a wish list price, to offer it again.

No cookies to track you, no ads, no trackers, and nothing loaded from other sites. That's why there's no cookie banner.

In the app, from the Account sheet, you can change your name and delete your account. You can change your name in a party in that party.

Write to hello@secretsanta.online to ask me to:

• send you a copy of your data, as a file you can take elsewhere;
• correct something that's wrong;
• stop a use of your data you object to;
• hold back a use of your data while something is sorted out.

I answer within a month.

If you think I got something wrong, you can complain to a data protection authority, such as the one where you live.

If you're under 13, a parent or guardian needs to agree before you sign in. They can delete the account any time.

When this policy changes, so does the date at the top.