This privacy policy is applicable to the Gifthax app for mobile devices, together with any related services operated by Gifthax (collectively, the "Application"). Gifthax is hereinafter referred to as the "Service Provider".
Gifthax acts as the Data Controller responsible for the processing of your personal data. Gifthax is currently operated by an individual; the controller named below is that person. This section will be updated if and when the service is transferred to a company.
Name: Kamil Laskowski Address: Konarskiego 4, 07-410 Ostrołęka, Poland Email: contact@gifthax.com
For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.
The Application and related services acquire the information you supply when you download, access, or register for the service. Creating an account asks for your name, username, email address, and password, and optionally your date of birth, gender, and country. Some pages open without an account: public profiles and wishlists (see below), product pages, gift guides, and exchange invitation links.
The Service Provider may also use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.
User-to-User Sharing: Your profile is public. Your name, username, profile picture, bio, follower and following counts, and your wishlist (each item's title, photo and price) are visible to anyone with the link to your profile (gifthax.com/@your-username), including people without an account. Signed-in people can also see who you follow and who follows you. Your email address, date of birth, gender and country are never shown on your profile.
If you add your date of birth, people who follow you see its day and month (never the year) under Celebrations and are reminded a week before. Members of an exchange you join see your name, profile picture and wishlist, and the person who draws you sees who they are buying for. Gift reservations are hidden from the wishlist's owner to preserve the surprise.
Search: what you type into Search is stored, together with your account so the same person is not counted twice, and deleted with your account. A search term can be suggested to other people only after at least two different people have searched for it, and never when it is someone's name or username.
Sign in with Google: if you choose to sign in with Google, Google shares with the Application your Google account's name, email address, profile picture link and a Google account identifier. The email address and identifier are used to create your account and sign you in; the name is used only to pre-fill your name at sign-up, and you can change it. The profile picture link is kept with your sign-in record but is not shown or used. The Application asks Google for nothing else (no contacts, calendar, files or Gmail) and never receives your Google password.
If you change the email address on your Gifthax account, Google sign-in stays connected to the same account. You can disconnect it yourself in Settings → Account management → Sign-in methods. You can also remove Gifthax's access at any time in your Google Account (myaccount.google.com/connections); the Google data already received is deleted together with your account.
The Application's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google user data is not sold, not used for advertising, and not shared with anyone other than the service providers listed in this policy that are needed to run the Application.
Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:
Contract performance: processing necessary to provide the Application or fulfil a contract with you.
Consent: where you have given explicit consent to processing, including for marketing, analytics, or optional features. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
Legitimate interests: where processing is necessary for the Service Provider's specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application's core functionality through analytics, provided those interests are not overridden by your data protection rights or fundamental freedoms.
Legal obligation: to comply with laws or government requests.
The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, and service delivery. Where required by law, the Service Provider will obtain your consent before using non-essential tracking technologies. See the Cookie Policy for the current, concrete list of what's actually stored.
If the Application uses automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review, express your point of view, and contest the decision. Information about the logic involved and the likely consequences of that processing will be provided where required by law.
In addition, the Application may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device's unique device ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, and information about the way you use the Application.
This Application does not gather precise information about the location of your mobile device.
The Application does not use Artificial Intelligence (AI) technologies to process your data or provide features.
Yes, in the limited ways described here. The Application is built on third-party infrastructure, so personal data is necessarily processed by the providers named under "International Data Transfers" below — your account and wishlist data are held in a hosted database, and your email address is passed to an email provider in order to send you a message you asked for. Those providers act as processors on the Service Provider's instructions and may not use the data for their own purposes.
Beyond that, the Service Provider does not sell your personal data, does not share it with advertising networks, and does not use it for cross-context behavioural advertising. Aggregated or anonymized statistics, which no longer identify you, may be used to understand and improve the Application.
The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V:
Adequacy decisions by the European Commission Standard Contractual Clauses (SCCs) approved by the European Commission Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted
Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.
The Application relies on third-party service providers that process personal data on the Service Provider's behalf. Each has its own privacy policy governing how it handles that data. The providers actually used are:
Supabase — database, authentication, and file storage. This is where your account, profile, wishlists, exchanges, and any photos you upload are held. Google — Sign in with Google, if you choose it (see above). Expo (650 Industries) — delivery of push notifications, including the device push token registered for your device. Delivery to the handset itself is carried out by Apple Push Notification service on iOS or Firebase Cloud Messaging on Android. Resend — delivery of transactional email, such as sign-in codes, password resets, and replies to messages you send through the contact form. PostHog (EU cloud) — product analytics in the app and in the web app at gifthax.com, in two modes. By default, anonymous audience measurement only: counts of which screens are opened and what is saved or searched for, with no identifier stored on your device (a new random one each time the app starts), not linked to your account and with no profile of you. If you choose "Allow" when the app asks ("Help us improve Gifthax"; change it anytime in Settings → Privacy & safety → Usage statistics), the same events are linked to an internal account ID together with your gender, country, language and an age band. In neither mode does it receive your name, email address, date of birth or anything you type. Sentry — crash and error reports from the app (the error, the screen, the device type and app version), so bugs can be found and fixed. Cloudflare — hosting and delivery of the Gifthax website, including standard server logs. Google Analytics — website analytics only, and only if you accept it on the cookie banner. It is not used in the mobile application. Apple and Google — distribution of the mobile application through their respective app stores.
The Service Provider may disclose User Provided and Automatically Collected Information:
as required by law, such as to comply with a subpoena, or similar legal process; when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request; with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.
Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose the same data protection obligations on those service providers as described in this Privacy Policy.
You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.
To request deletion of your personal data, withdraw consent, or exercise any of your rights, contact the Service Provider at contact@gifthax.com.
The Service Provider retains personal data based on its necessity for the stated purposes:
User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance or security purposes Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you Data required for legal compliance: Retained as long as required by applicable law
You have the right to request deletion of your personal data at any time, except where retention is required by law. If you'd like the Service Provider to delete User Provided Data that you have provided via the Application, please contact them at contact@gifthax.com and they will respond within the time required by applicable law. Please note that some User Provided Data may be required in order for the Application to function properly.
You can delete your account and your personal data yourself, at any time, from inside the Application — Settings, then Account management, then Delete account. That removes your account and its associated data from the Service Provider's systems directly, with no request and no waiting period.
If you would rather not, or you can no longer sign in to the Application, you can instead request deletion by contacting the Service Provider at contact@gifthax.com, and the request will be handled within the timeframes required by applicable law.
Upon verification of your identity, the Service Provider will delete your personal data from its systems, except where retention is required for legal compliance or legitimate business purposes.
The Application is not intended for children under 13 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.
Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age, or where a higher age of digital consent is established by applicable law, in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (contact@gifthax.com) so that they will be able to take the necessary actions.
The Service Provider is committed to safeguarding the confidentiality of your information. The Service Provider implements physical, electronic, and procedural safeguards to protect information it processes and maintains. For example, access is limited to authorized employees and contractors who need to know that information to operate, develop, or improve the Application. However, no security system can prevent all potential security breaches.
Backups: an encrypted copy of the database is made every night and kept for 14 days with our infrastructure providers (GitHub). It can only be read with a key the Service Provider keeps offline, and anything you delete is gone from these copies within 14 days.
In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.
The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.
Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at contact@gifthax.com.
This privacy policy is effective as of 2026-09-30.
Under the GDPR, you have the following rights:
Right of Access: You can request access to your personal data. Right to Rectification: You can request correction of inaccurate data. Right to Erasure: You can request deletion of your personal data (the "right to be forgotten"). Right to Restrict Processing: You can request that the Data Controller limits how they use your data. Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format. Right to Object: You can object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes at any time. Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time. Withdrawal is as simple as toggling preferences in the Application's settings or contacting the Data Controller. Rights Regarding Automated Decision-Making: You have rights related to automated decisions that affect you.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. Contact details for each country's Data Protection Authority can be found at: https://edpb.ec.europa.eu/about-edpb/members_en
If you are located in the United Kingdom, you may contact the Information Commissioner's Office at https://ico.org.uk
If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:
Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you. Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions. Right to Correct: You can request correction of inaccurate personal information. Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising. Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information to essential purposes. Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.
To exercise any of these rights, please contact the Service Provider at contact@gifthax.com. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.
Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases, including contract performance, legitimate interests, or legal obligations, is carried out as described above.
If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at contact@gifthax.com.
To request deletion of your personal data or to exercise any of your rights, contact the Service Provider using the details provided above. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.