Privacy policy
Last updated: November 3, 2026.
Information we use
We store the activity name, USD budget, exchange date, message, member names, wishlists, optional preferences, exclusion rules, assignments, and whether each member has viewed the current result. We do not require accounts, email addresses, or telephone numbers, and do not sell this data. Avoid sensitive information in wishes and notes.
Group access and personal PINs
The group PIN is shared with the group and visible to an authenticated organizer. Each personal PIN is stored only as a slow derived hash with an independent random salt. Member verification requires the joined name and personal PIN within an entered activity. An organizer token does not provide access to results. Anyone who learns or guesses a member's name and PIN could view that member's result; this is not a promise that PINs cannot be guessed.
Browser memory and invitation links
The page reads the group PIN from the invitation fragment, immediately removes it from the address, and sends it in a request body for verification. Activity entry sessions last 30 minutes and are kept only in page memory. Personal PINs are used only in input and verification requests, never stored in browser persistent storage, cookies, or URLs. Unsaved non-PIN drafts remain in the current page during re-entry, but refreshing or closing the page can lose them.
Private results and downloads
Personal results are excluded from indexing and shared caches. PNG downloads are generated on your device after a fresh name-and-PIN check and current-result lookup. Images include the activity, member and recipient names, budget, date, wishes, and preferences; they exclude PINs, access links, session credentials, advertising, and product listings. Keep downloaded images private. Old screenshots cannot be recalled after a redraw.
Request retries
Create and join submissions use private in-memory retry credentials for up to 30 minutes. A protected temporary response allows the same request to be retried after a network interruption. This cannot recover organizer access from an activity ID or group PIN. Temporary sensitive responses are inaccessible after expiry and cleared by a scheduled maintenance pass. Non-sensitive operation identifiers may remain to prevent duplicate actions; deletion invalidates their responses immediately.
Retention and deletion
Dates use America/New_York. Retention ends 30 calendar days after the midnight following the exchange date. Access stops immediately at that time; the next successful daily cleanup removes the activity and related member data, PIN hashes, sessions, rules, assignments, and operations. Empty and undrawn activities follow the same policy. Redraws, downloads, or lost links never extend retention.
An organizer with their saved link can delete earlier. Before drawing, a member can verify their name and PIN and leave, deleting their profile and related rules. After drawing, removal requires the organizer's atomic remove-and-redraw operation. Cloudflare platform backups may follow Cloudflare's retention policies.
No link or PIN recovery
Lost organizer links cannot be recovered or replaced. Management then requires a new activity. Existing drawn results remain available to members until expiry. Personal PINs cannot be recovered. Before drawing, an organizer may remove a member so they can rejoin; after drawing, the original forgotten PIN cannot be recovered.
Providers, advertising and affiliate links
Cloudflare hosts the frontend, API, and database and may process network information to provide the service. Fonts and photos are served with the website. No advertising platform or analytics tracker is currently connected. Joining, verification, management, and personal result pages do not load advertising scripts. Any future merchant links will be clearly identified when affiliate relationships apply; member data will not be passed to an advertising platform.