Skip to content

Privacy policy

Updated: 23 October 2026

In short

There are no accounts and we never ask for email. In offline mode, names and pairs live only inside the links you generate and in your browser (localStorage).

Live mode

If you turn on live mode, we store on Cloudflare the group name, date, budget, participant names, emojis, wishlists and when each person opened their link. The pairs (who drew whom) are encrypted (AES-GCM) in the organiser's browser before they're sent; the server keeps only the ciphertext, and each pair's key lives only in that person's link, after the “#” (the part browsers don't send to servers). We can't see the pairs, and the organiser only sees who opened their link and when. Access requires the secret tokens inside the links, sent in request bodies, not in the URL. If the organiser runs a new draw, the old encrypted pairs are deleted and the old links stop working. Wishlists, the (optional) shipping address and the anonymous questions between a Santa and the person they're buying for are encrypted the same way, in the browser, with keys that live only in those two people's links: the server keeps only fixed-size ciphertext and doesn't know whose conversation is whose. What we can technically see: how many messages a conversation has and when they were sent, plus the IP address of requests (which we don't store). Data is deleted automatically 60 days after the exchange date.

“Not like last year”

Importing last year's group happens only in your browser: we read the participants and, where possible, the pairs from groups saved locally or from links you paste. The names and pairs from the import never reach us, and you aren't shown the pairs. If you accepted anonymous analytics, we only count that an import happened and how many people and pairs it had (no names). If you tick “Remember the pairs for next year”, we keep cryptographic fingerprints of the pairs in this browser (no names, with a random value). It isn't strong encryption: someone with access to the browser who knows the names could work them out. It's off by default; clear the site's data in your browser to erase it.

Analytics and session replay

Only if you accept, we use PostHog (EU-hosted) for usage analytics, error reports and session replay. Names, text fields and the reveal screen are masked in recordings. You can change your choice any time from “Cookie settings” in the footer.

Shop links

Some eMAG links may become affiliate links: if you buy, we may earn a commission at no extra cost to you.

Payments

The Pro plan will be processed by Stripe. We never see or store card details.

Your rights

You have the right to access, correct, erase and object (GDPR). You don't need to contact us to delete data: the organiser can erase the whole group immediately from the dashboard (“Delete group now”), and each participant can delete their wishlist from their own page (“Delete my data now”). Participant names are entered by the organiser, so they go when the group goes. The dashboard and each person's page show the automatic deletion date. For anything else, contact us via the project's GitHub page.