Privacy Policy

Last updated: 8 October 2026

Giftyr is a gift wishlist app built around keeping a surprise intact. This policy explains what we collect, why, how long we keep it, and what you can do about it. It covers both the app and giftyr.app.

Who we are

Giftyr is operated by Johannes Meißner, the controller for your data under the GDPR. You can reach us at contact@giftyr.app; the imprint has our full details and the support page is the fastest route for anything practical.

What the app collects

Your account. When you sign in with Apple we store the account identifier Apple gives us, your display name, and your email address: your real one or, if you choose to hide it, the private relay address Apple creates for us, which forwards to you. Apple decides what to pass on; we never see your Apple ID password. If you add a profile photo, we store that too: a small square copy made on your device, without the original's location or other metadata. Apple never gives us a photo, so there is none unless you add one. It shows only where your name already does in the app, never on a shared web page, and anyone who has seen it can open its web address until you change or remove the photo.

What you create. Wishes, occasions, circles and their memberships, notes, prices, links, and any photos you upload. This is the content the app exists to hold.

Reservations. When someone reserves or marks a gift as bought, we store that against their account so they can see their own reservations. The person an occasion's gifts are for never learns who reserved what — that restriction is built into the database and the API, not just hidden in the interface. There is one deliberate exception: on an occasion you create for someone else, everyone taking part sees who is giving what, because the person being surprised is not there. That includes anyone holding the share link — the page is not restricted to invited people, so whoever the link reaches, or is forwarded to, sees the same attribution. The terms of service explain that case.

Notification tokens. If you turn on notifications, we store the push token Apple issues for your device, along with the platform and whether it is a test or production token. This is what lets us send a reminder; it is deleted with your account, and turning notifications off stops us using it.

Product analytics. This is off by default. If you agree — either on the privacy page the app shows once after you sign in, or later at Profile → Privacy — the app uses TelemetryDeck for usage statistics: which screens get used, which features people reach. We send TelemetryDeck no name, email address or account identifier. The signals do carry a hashed identifier for your installation of the app, so they are pseudonymous rather than anonymous: they don't say who you are, but signals from the same installation can be recognised as such. Like any server the app connects to, it sees your device's IP address when signals arrive. Any identifier we send is hashed twice: once on your device before it is transmitted, and again on TelemetryDeck's servers. You can withdraw at any time (see Your choices).

Crash and error diagnostics. This is off by default. If you turn it on — on the privacy page after you sign in, or later under Profile → Privacy — the app uses Sentry to report crashes and errors so we can fix them: what went wrong, plus the device model, OS and app version. The reports carry no account identifier, no install identifier and none of the web addresses the app requested, and anything that looks like an email address is removed before sending. Like any server the app connects to, Sentry sees your device's IP address when a report arrives. Until you turn this on, Sentry is not started and stores nothing on your device; turning it off again stops reporting and deletes any reports still waiting on the device.

Blocks and reports. If you block someone, we store that you did, so the block can be applied. If you report a comment, a wish, an occasion or a name — in the app or from a shared page — we store the report with a copy of what was reported, so it can still be reviewed if the original is deleted, and send it to our moderation inbox. Reports are kept after they have been dealt with, as the record of what was done. If either account is later deleted, the report is no longer linked to that account, but the copy of the reported content (for a reported name, that is the name itself) and any note stay.

What the website collects

Waitlist. If you sign up, we store your email address and an HMAC-SHA256 hash of your IP address, made with a secret key. We never store the address itself, and the hash is used only to rate-limit abuse. You get a confirmation email and one message when the app launches.

Reserving from a share link. If you reserve a gift from a shared wishlist without installing the app, we store the email address and display name you enter, plus an IP hash, so we can send you the confirmation link and show the reservation as yours when you come back.

This also creates a Giftyr account for you. Reserving by email sets up an account against that address, with a profile holding the display name you gave — that is what lets the reservation be yours, survive the confirmation link, and still be there if you install the app later. You are not asked to choose a password and nothing is charged, but an account exists from that point and it holds your email and display name. If you would rather it did not, email contact@giftyr.app and we will delete it; installing the app and signing in with the same address gives you the in-app deletion route described below.

Event counts. We count a few anonymous events on the share pages — that a reservation was completed, and whether the suggestion to get the app that follows it was shown or tapped. These are counts and timestamps only: no identifier, no wish, no link token, nothing that ties an event to a person.

Reports from a shared page. If you report something from a shared page without signing in, we keep a hash of your IP address, made the same way, for seven days, so that one address cannot flood us with reports. It is stored without any link to the report.

Cookies. giftyr.app sets two cookies of its own, both only on shared pages and only once you use them: one for up to two hours after you ask for a reservation link, so the page can show that the link is on its way, and one for seven days after you confirm (or open a shared page from the app), so the page recognises you when you come back. The second holds your account identifier and, if you confirmed by email, the email address you used; it is signed so it cannot be altered. We use no advertising trackers, no analytics cookies and no third-party cookies anywhere on giftyr.app.

Where your data is held

App data is stored by Supabase in the European Union (eu-west-1, Ireland). The website runs on Cloudflare's network, and the waitlist and share-link records live in a Cloudflare D1 database. Some of our processors are outside the EU; where that is so, transfers rely on the European Commission's Standard Contractual Clauses.

Why we are allowed to do this

No law requires you to give us any data. Using the app needs an account, and the account needs the identifier Apple provides; reserving from a shared link without the app needs an email address. Without these, that part of Giftyr cannot work. Everything else is up to you: what you write and upload, and whether you allow analytics, crash reports, notifications or waitlist emails.

How long we keep it

Your choices

Deleting your account

In the app: Profile → Privacy → Delete account. This is immediate and cannot be undone. It removes your account, your wishes, occasions, circles, uploaded images and notification tokens, and revokes the Sign in with Apple authorisation you gave us.

A reservation deliberately survives: if you reserved a gift on someone else's wishlist, that reservation stops being linked to you but the gift stays marked as taken. If it flipped back to available, the others giving gifts could work out that you had left — which would undo the privacy the app is built to protect.

A few other things stay. A note you wrote on a group gift stays with that gift for the others taking part. A report about something you posted keeps its copy of that content (see Blocks and reports above). Records of notifications sent to other people can keep your account identifier, without your name. Crash reports already sent to Sentry carry no account identifier, so they cannot be found and deleted with your account; they expire at the end of Sentry's retention period.

If you cannot reach the app, email contact@giftyr.app and we will delete your account for you. Deleting your data lists every route, including for people who reserved a gift without installing the app.

Your rights

Under the GDPR you can ask for access to your data, correction, deletion, a portable copy, restriction of processing, and you can object to processing based on legitimate interest. Write to contact@giftyr.app and we will respond within one month.

You also have the right to complain to a supervisory authority, in particular in the EU country where you live or work or where you believe the infringement took place. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA).

Children

Giftyr is not directed at children. You must be 16 or older to create an account, and we do not knowingly collect data from children directly. Wishes for a child are kept by their parent or guardian on that adult's own account.

Who else processes your data

Changes

We will update this page if anything material changes, and the date at the top will tell you when. If a change materially affects your rights we will tell you in the app or by email before it takes effect.