Last updated: September 23, 2026
GiftJar ("we", "us") is a mobile app for managing personal wish lists and coordinating gifting among friends and family. This policy explains what personal data we collect, why, who else handles it, and what rights you have over it.
GiftJar is operated by Vladislav Gorceac, acting as the data controller for the purposes of GDPR. You can reach us at the email address at the bottom of this page for any privacy question or request.
| Data | Why |
|---|---|
| Name, email address | Account creation and login. We email you only sign-up and password-reset codes — no newsletters or marketing |
| Password (email/password sign-up only) | Authentication — stored hashed by our identity provider, never in plain text and never by us |
| Account identifiers (our user ID; your Google or Apple account ID if you sign in with one) | Linking your sign-in to your GiftJar account |
| Birth date | Birthday reminders for your friends and age-related badges. Friends see the day and month; the year and your age only if you turn on "Show my age to friends" |
| Username (@name), profile photo, short bio | Optional — shown on your profile to friends. You can switch off being found by your @name |
| Wish list items (title, photos, price, description, link, how much you want it) | The core feature — items you want, shown only to the friends you choose, item by item |
| Friend connections, group labels, and your private settings about friends (how important a gift for them is, when to remind you) | Controls who can see what and when you get reminded. Your settings about a friend are never shown to that friend |
| Gift ideas (title, photos, price, link, note, which friends they are for) | Your private notes about gifts for friends. Only you can see them — the friends they are about never do |
| Reservations and group contributions (who reserved what, contributed amounts) | Lets friends coordinate gifts without duplicating them |
| Gift history (confirmed handovers: who gave what to whom, when) and achievements | Your gifting statistics and badges |
| Invite links you create | Adding a friend by sending them a one-time link |
| Reports and blocks. A report stores who sent it, the reason, an optional comment, and a copy of the reported wish or profile as it looked at that moment | Moderation, and keeping unwanted people away from you |
| Push notification token, device language, notification settings | Sending you notifications, in your language, only of the kinds you left on |
| IP address | Limiting repeated sign-up attempts and code requests to stop automated abuse. Used at the moment of the request, not stored in your profile or in our logs |
| Technical error logs (may contain your user ID) | Finding and fixing faults. Kept for 30 days |
Your name, email address and birth date are needed to create an account — without them we can't provide the service. Everything else is up to you.
We never process real payments. Amounts shown for a group contribution are only a record of what people intend to chip in — GiftJar does not move money, store payment card details, or act as an escrow or payment service in any way. Arranging the actual payment is entirely between you and your friends, outside the app.
We do not use analytics or advertising trackers, and we do not access your phone's contacts, location, camera or microphone.
Directly from you: when you register (by email/password, or by signing in with Google or Apple), fill in your profile, add wishes or gift ideas, or connect with friends. If you sign in with Google, we receive your name, email address and profile photo from Google. If you sign in with Apple, we receive your name and email address — or, if you chose "Hide My Email", a relay address from Apple instead of your real one. We never see your Google or Apple password.
When you paste a link to a product, our server opens that page to fill in the title and price, and copies the product picture into our own storage. The shop sees our server's request, not you.
We don't make decisions about you by automated means that have legal or similarly significant effects. The one automatic check is at sign-up: an email address on a known disposable-inbox domain, or on a domain that can't receive mail, is refused — you can register with another address.
The only people who see your data are the friends you've explicitly connected with, and only the parts of your profile and wish list you've chosen to make visible to them. Friends who aren't connected to you directly see your contribution to a shared gift without your name or photo.
We use a small number of providers to run GiftJar ("sub-processors"). None of them are permitted to use your data for their own purposes.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, photo storage, authentication | Frankfurt, Germany (EU) |
| Resend | Delivering sign-up and password-reset emails (your email address and the code), and notifying our moderators of a new report (the report, including its copy of the reported content) | United States |
| Google (Gmail) | Our support and moderation mailbox: emails you send us, and report notifications | Global |
| Expo (650 Industries) | Delivering push notifications (your device token and the notification text, which may include a friend's name) | United States |
| Google (Firebase Cloud Messaging), Apple (Push Notification service) | The final delivery step of push notifications to your Android or iOS device | Global |
| Google, Apple (Sign-In) | Optional sign-in methods, only if you choose them | Global |
Where data leaves the EU, the transfer is covered by the European Commission's Standard Contractual Clauses in the provider's data processing terms. We do not sell your data, and we do not share it with advertisers.
Push notifications (friend requests, group gifts, gift handovers) are sent by our server through the providers above. You can switch each kind off in the app under Profile, or turn notifications off entirely in your phone's settings.
Birthday reminders are different: they are scheduled on your phone itself and never leave it.
We keep your data for as long as your account is active. A gift idea you delete is removed right away. A wish you delete disappears for everyone immediately, but stays in our database until you delete your account, so that reservations friends had made on it can still be resolved. A report, including its copy of the reported content, is kept for as long as the account that sent it exists, so that repeated abuse can be recognised. The email notifying our moderators of a report is permanently deleted from the moderation mailbox 30 days after it arrives. Error logs are kept for 30 days. Deleted data can remain in our encrypted database backups for up to 30 days, after which those backups are overwritten.
In the app: Profile → Delete account. Deletion happens immediately and cannot be undone.
Without the app: email us from the address you registered with at giftjarappsupport@gmail.com with the subject "Delete my GiftJar account". We'll confirm and delete it within 30 days.
What happens when your account is deleted:
Under GDPR and similar laws, you have the right to:
To exercise any of these, use the in-app option where available, or contact us at the email below — we'll respond within 30 days.
You must be at least 16 years old to use GiftJar, and you confirm this when you sign up. GiftJar is not directed at children under 16. If you believe a child under 16 has created an account, contact us and we'll delete it.
Data is encrypted in transit (TLS/HTTPS) and at rest (our database and its backups are stored encrypted). Passwords are never stored by us directly — authentication is handled by our identity provider, which stores only a salted hash. Our database is not reachable from the internet, our server accepts only web traffic from outside (plain HTTP is redirected to HTTPS), and administrative access to both is limited to the operator.
If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, notify you in the app.