Privacy policy
Last updated 29 September 2026
This site is run by [TODO: company legal name], whose full identity and address are on the legal notice. We are the data controller for everything described here. Write to [TODO: privacy@domain] about any of it.
[TODO: if a DPO has been appointed, name them and give their contact here.]
What we collect
Because you have an account. Your email address, your display name, and your profile picture if you upload one. There is no password: you sign in with a code sent to your address, and we store the sign-in session in a cookie.
Because you write a wishlist. The lists you create, their occasion and date, the gifts on them, whatever you write about them, the pictures you upload, and the links you paste.
Because a gift gets reserved. That a gift is reserved, when, and whether it was later bought or released. A reservation is stored against the gift, not against a person: someone who reserves without an account is remembered only by a token in their own browser. If they ask for a reminder, we store the address they gave for it.
Because the site has to run. Your chosen language, the state of the sidebar, and — in server logs — the IP address, the browser's user agent, the address requested and the time. Emails we send produce delivery events at our email provider: sent, delivered, bounced.
Why, and on what legal basis
| What for | Legal basis |
|---|---|
| Creating your account, signing you in, showing and sharing your lists, holding reservations | Performance of the contract these terms of use form |
| Sending sign-in codes, reservation reminders and notices about your account | Performance of the contract |
| Keeping the site up, preventing abuse and fraud, rate-limiting, debugging from logs | Our legitimate interest in a service that works and is not abused |
| Measuring traffic and advertising performance with cookies, once such tools are in place | Your consent, given in the cookie banner and withdrawable at any moment |
| Keeping records we are legally required to keep, answering a lawful request | Legal obligation |
We do not sell your data, we do not rent it, and we do not build advertising profiles from your lists. We do not read your lists to market anything to you.
Cookies and what is stored in your browser
What is strictly necessary is there today, without asking, because the site cannot work without it:
- the sign-in session, so that you stay signed in;
- your language, so that the site opens in the one you read;
- the reservation token, so that whoever reserved a gift without an account can cancel it;
- the sidebar's open state and width, so the layout stays as you left it.
Analytics and advertising cookies are not in place yet. We plan to add audience measurement and advertising measurement — Google Analytics and the Meta pixel. When they arrive they will load only after you have agreed to them in a consent banner, never before, and you will be able to change your mind from the same place at any time. Until that banner exists, those tools are not on the site.
Affiliate links and click tracking
When you follow a link to a shop, that shop or its affiliate network may set their own cookie or identifier in your browser to record that the visit came from us, which is how a commission is attributed. That happens on their site, under their privacy policy, and what comes back to us is a count and an amount — not who you are or what you bought. The affiliate disclosure explains the arrangement itself.
Who processes data for us
| Who | What for | Where |
|---|---|---|
| [TODO: hosting provider, e.g. Scaleway / OVH] | Hosting the application and the database | European Union |
| [TODO: Resend and/or SMTP provider] | Sending sign-in codes, reminders and account emails | [TODO: EU / US] |
| UploadThing | Storing the pictures you upload | United States |
| Zyte | Fetching the public page of a link you paste, to read the product's name, price and picture | [TODO: EU / US] |
| OpenAI | Tidying up what that page said, and drafting editorial text | United States |
| logo.dev | Showing a shop's logo next to a gift | United States |
| [TODO: error monitoring, e.g. Sentry] | Recording errors so they can be fixed — includes IP address and user agent | [TODO: EU / US] |
Two of these deserve a word. Zyte and OpenAI receive the link you pasted and what the shop's own page says at that address. They are not told whose list it is for; nothing about you travels with the request. And none of these providers may use what they process for us for anything of their own — each is bound by a processing agreement that says so.
Sending data outside the European Union
The application and its database are in the EU. Some of the providers above are in the United States, so a transfer takes place; it rests on the European Commission's standard contractual clauses, and on the EU–US Data Privacy Framework where the provider is certified under it. Ask us and we will tell you which applies to which.
How long we keep it
- Your account and your lists: while the account exists. After three years without a single sign-in we email you, and if you do not come back we delete the account and everything attached to it.
- When you delete something: the list, the gift or the account goes from the live database at once, uploaded pictures with it, and disappears from backups as those expire — within [TODO: 30] days.
- Reservations: with the gift they are attached to.
- Server and error logs: 12 months.
- Email delivery events: 12 months.
Your rights
You can ask for a copy of your data, have it corrected, have it deleted, have its use restricted, object to a use that rests on our legitimate interest, ask for it in a portable form, and withdraw a consent you have given — withdrawing it does not undo what was done while it stood.
Write to [TODO: privacy@domain]. We answer within one month. If what you ask for would expose somebody else's data, we may need to be sure you are who you say you are before we act.
If you think we have handled your data badly, tell us first and then, if you are still unsatisfied, the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or cnil.fr.
Children
The site is not for children under 16, and we do not knowingly keep an account for one. If you believe a child has created one, write to us and we will delete it.
Security
Connections are encrypted. There are no passwords to leak: signing in is a one-time code sent to your mailbox. Reminder links carry a signature rather than giving access to an account, and a reservation's links stop working the moment that reservation ends. Access to the production database is limited to the people who run the service.
Automated decisions
We do not make any decision about you automatically, and we do not profile you.
Changes to this policy
When this policy changes, the date at the top changes with it, and if the change matters to you we will say so by email or on the site before it takes effect.