Privacy Policy

This Policy explains how gifftme ("gifftme", "we", "us", or "our") collects, uses, and shares information when you use the gifft.me website and related services (collectively, the "Services"). We do not sell your personal information.

You can opt out of optional browser-based Google Analytics tracking:

Information we collect

Depending on how you use the Services, we collect the following categories of information:

Account information: Firebase user ID, name, email address, profile photo, authentication provider, language, country, account preferences, and account activity.
Gift and communication content: gift messages, names, images, audio, style choices, comments, replies, shared links, and other content you choose to submit.
Gift activity: gifts created or saved to a feed, gift views, comments, notification status, challenge progress, trophies, and Premium Gift status or balance.
Payment information: Stripe checkout and transaction identifiers, product, amount, currency, payment status, country, and fulfillment records. Stripe processes payment-card details; we do not receive or store complete card numbers.
Device and usage information: IP address, approximate country or region, browser and device information, pages and features used, referral and campaign information, analytics identifiers, and diagnostic or security events.
Notification and email information: push-notification tokens and subscriptions, email delivery, bounce, unsubscribe, open, and link-interaction information when provided by our email service.
Locally stored information: consent choice, profile cache, gift drafts, language and region, notification preferences, experiment variants, and other settings stored in your browser.

You can use some features without creating a permanent account. Firebase may create an anonymous identifier so that guest-created gifts and related activity can function and later be associated with an account if you sign up.

How we collect information

We collect information directly from you, automatically from your browser or device, and from services involved in authentication, payments, analytics, advertising, email delivery, moderation, embedded media, and hosting. For example, Google may provide account information when you choose Google Sign-In, Stripe provides payment status, and IPify and ip-api.com help determine an approximate country or region from an IP address.

How we use information

We use information to:

create and secure accounts and restore authenticated sessions;
create, store, deliver, display, and manage virtual gifts and User Content;
process and fulfill Premium Gift purchases and prevent duplicate or fraudulent fulfillment;
provide comments, gift-view information, feeds, email, and push notifications;
moderate content and protect users and the Services from abuse, fraud, and security threats;
remember settings and provide language, regional, and experimental product experiences;
measure usage, diagnose errors, improve the Services, and evaluate marketing campaigns;
display and measure advertising where applicable; and
comply with legal obligations and enforce our agreements.

Legal bases

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, compliance with legal obligations, our legitimate interests in operating, securing, and improving the Services, and your consent where required. You may withdraw consent for optional browser-based analytics through the control above. Withdrawal does not affect processing performed before withdrawal or processing based on another lawful basis.

Content moderation

Text submitted through supported creation or communication features may be sent to OpenAI for automated safety classification. We use the moderation result to help identify content that may violate our rules. Automated tools may make mistakes, and we may review or act on content where necessary to protect users and the Services.

How we share information

We share information only as needed to provide the Services, complete transactions, comply with law, protect users or the Services, or with your direction. Our principal service providers include:

Google Firebase and Google Cloud: hosting, authentication, databases, storage, security, remote configuration, and push notifications;
Google Analytics: product and campaign analytics;
Google AdSense: advertising and advertising measurement;
Stripe: payment processing, tax calculation, fraud prevention, and purchase confirmation;
Postmark: transactional and promotional email delivery and engagement reporting;
OpenAI: automated text moderation;
YouTube API Services: music-video search, selection, and playback; and
IPify and ip-api.com: IP address lookup and approximate country or region detection.

We may also disclose information when reasonably necessary to comply with law, respond to lawful requests, investigate fraud or abuse, protect rights and safety, or complete a merger, financing, acquisition, or sale of assets subject to appropriate safeguards.

YouTube API Services

Features that search for or play YouTube videos use YouTube API Services. YouTube and Google may process information under the Google Privacy Policy. Your use of those features is also subject to the YouTube Terms of Service.

Cookies and local storage

We use an essential session cookie to keep signed-in users authenticated. We also use browser local storage for consent, cached profile information, gift drafts, preferences, notification tokens, and experiments. Google Analytics, Google AdSense, and YouTube may use cookies or similar technologies when their features are enabled. See our Cookie Policy for details.

Email and push communications

We send transactional messages related to accounts, gifts, replies, views, security, and purchases. Where offered, you can change promotional email preferences in Settings or use the unsubscribe link in an email. You can control browser push notifications through the Services and your browser or device settings.

Retention and deletion

We retain information while your account or gift remains active and as needed to provide the Services. Retention also depends on the type of information and our needs for payment and tax records, fraud prevention, security, dispute resolution, legal compliance, and enforcement. Account deletion removes the active profile and marks owned gifts for deletion; some payment, security, moderation, email-suppression, and backup records may remain for the applicable legal or operational period. Browser-stored information remains on your device until you clear it.

International transfers

We and our service providers may process information in countries other than the country where you live. Where required, transfers are made using recognized legal safeguards or another lawful transfer mechanism.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, withdraw consent, or appeal a response. You may also have the right to complain to a local data-protection authority. You can update certain account and communication settings or delete your account from Settings. Other requests may be sent to info@gifft.me. We may need to verify your identity before completing a request.

We do not sell personal information. If applicable law treats personalized advertising or certain analytics disclosures as "sharing" or targeted advertising, you may use the available consent controls or contact us to exercise applicable rights.

Children

The Services are not directed to children under 13, and children under 13 may not create an account or submit personal information. If you believe a child under 13 has provided personal information, contact info@gifft.me so we can investigate and take appropriate action. A higher minimum age may apply where required by local law.

Security

We use reasonable administrative and technical safeguards intended to protect information. No online service can guarantee absolute security, so you should protect your account and avoid including sensitive information in shared gift links.

Changes

We may update this Policy as the Services or legal requirements change. We will update the date below and provide additional notice where required by law.