The short version
- We only collect what's needed to run your gift lists: your sign-in details, the lists you make, and the names people give when they pick gifts.
- No adverts, no analytics trackers, and we never sell your data.
- The person receiving the gifts can't see your list. Guests only see gifts that are still free to pick.
- You can delete your account and everything in it at any time from the app.
Who we are
GiftSprout (giftsprout.co.uk) is run by David, an independent developer based in the UK. For this policy, David is the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Contact: hello@giftsprout.co.uk
What we collect
| What | When | Why |
|---|---|---|
| Email address, display name and profile picture link from Google or Apple, and an account ID | When you create an account or sign in | To sign you in and sync your lists between devices |
| Your events and gift lists: names, dates, budgets, gift ideas, prices, links, pictures and notes | When you add them | This is the service itself |
| Purchase details: price paid, shop, order numbers and notes | When you mark a gift as bought | For your budget and purchase log. Only the list's organisers can see these. |
| Guest pickers: the name you type and a random guest ID | When you open a picker link | So the organiser can see who's getting which gift, and so only you can un-pick your picks |
| Who a list is shared with, and the invite links created for it | When you share a list or join one | To control who can see and change each list |
| Technical data such as IP address and browser type | When your browser talks to our hosting and database | Handled by Google to deliver and secure the service (see below) |
If you use GiftSprout without signing in, your lists stay in your browser on your device and are never sent to us.
Please don't put sensitive information (for example health details) in gift notes.
Our legal basis
- Providing the service you asked for (contract): your account, lists, sharing and picks.
- Legitimate interests: keeping the service secure, preventing abuse and fixing problems.
Who we share it with
We don't sell your data or share it for advertising. We use these service providers, who process data on our behalf:
- Google (Firebase): hosting, sign-in and the database. Google may store data in data centres outside the UK. Where it does, transfers are covered by Google's data processing terms and the UK's approved safeguards (such as the UK International Data Transfer Addendum).
- Google Fonts: our typefaces are loaded from Google, which receives your IP address when the page loads.
- Google and Apple: if you choose "Continue with Google" or "Continue with Apple", they handle that sign-in under their own privacy policies.
- Cloudflare: manages our domain name.
People you share a list with can see what that list lets them see. Organisers and collaborators see the whole list, including who picked what. Guest pickers only see the event name and gifts that are still available.
We may disclose information if the law requires it.
Shop links and Amazon
As an Amazon Associate, GiftSprout earns from qualifying purchases. Amazon links in the app marked "(ad)" include our affiliate tag. We don't send Amazon any of your list data. When you click a shop link you leave GiftSprout, and that shop's own privacy and cookie policies apply, including any cookies Amazon sets to record the referral.
Cookies and storage on your device
GiftSprout doesn't use advertising or analytics cookies. It stores a few things in your browser that are needed for it to work, so they don't need consent:
- Your sign-in session (kept by Firebase Authentication)
- Lists you make without signing in (
gift-tracker-v1) - Your guest name, and the lists you've joined as a guest
You can clear these at any time through your browser settings. Doing so will remove any lists you saved without signing in.
How long we keep it
- Your account and lists are kept until you delete them.
- Deleting a list removes its gifts, purchases, members and invite links.
- Deleting your account removes your sign-in details and every list you created, and takes you off lists you joined. Your name may still appear next to gifts you picked on someone else's list, as part of their record. Contact us if you'd like it removed.
- Guest picker details stay on the list until the organiser removes you or deletes the list.
Your rights
Under UK data protection law you have the right to:
- get a copy of your personal data
- have inaccurate data corrected
- have your data deleted. You can do this yourself in the app: Account → Delete account.
- restrict or object to how we use it
- receive your data in a portable format
To use any of these rights, email hello@giftsprout.co.uk. We'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or call 0303 123 1113. We'd appreciate the chance to sort it out first.
Security
Data is sent over encrypted connections (HTTPS). Database rules make sure each person can only see and change what their role on a list allows. No system is perfectly secure, so please use a strong password and keep invite links to the people you mean to share them with.
Children
GiftSprout is for adults organising gifts. You must be 13 or over to create an account. Lists are often about children (for example "Mia's birthday"), so please keep details about them to what's needed to plan gifts.
Changes to this policy
If we change how we use your information, we'll update this page and the date at the top. For significant changes, we'll also let you know in the app.