Privacy, plainly
secret.gift is built to know as little about you as possible: no accounts, no emails, no ad trackers. Here is everything we store and why.
What we store
Only what you type in: the group name, description, budget, participants' first names and — if you add them — wishlists and delivery addresses. We never ask for an email, phone number or real identity.
Who sees what
Your wishlist and delivery address are visible only to you and, after the draw, the person gifting to you. Everyone else — the organizer included — sees only whether they are filled in. In secret mode, draw results are hidden from everyone, including the organizer.
Passwords and cookies
Every participant gets a random password. Logging in sets one signed, httpOnly cookie per group so you stay signed in on your device. We use Google Analytics and Vercel Analytics for anonymous visit counts — no cross-site ad tracking, no selling data to anyone.
Where your data lives
In the EU (Supabase, Frankfurt region). The database is not publicly accessible — only the application server can read it, and every request is checked against your group cookie.
One more thing we count
When a group or participant is created we store a two-letter country code taken from the request itself (no geolocation permission involved). It only tells us which language to translate next.
Deleting your data
The organizer can remove any participant, which deletes their wishlist and address. To delete an entire group, send its link through the feedback button and we'll wipe it.
Questions? The feedback button in the corner goes straight to the maker.
Last updated: August 15, 2026