Skip to main content
Santa's Sack

Privacy Policy

Version: 2.0.0
Last updated: September 8, 2026

1. Introduction

This Privacy Policy explains how we collect, process and protect your personal data when you use Santa's Sack (https://santassack.app) and Gifts (https://gifts.santassack.app). The two products share one account and one authentication session. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR).

2. Data Controller

The data controller is Tomasz Miller, the author of Santa's Sack and Gifts. You can contact us through our contact page.

3. What Data We Collect

We collect only the data needed to operate the Service:

  • Email address — used to create the shared account, sign in with an e-mail code, and send service messages (invitations, reminders, list activity).
  • Profile fields you save — display name, language, timezone and default currency. We do not require a legal surname, home address or phone number.
  • Santa's Sack content — groups, memberships, exclusions, draws, wish lists and related settings you create.
  • Gifts content — gift lists, item titles, optional links, notes and suggested prices; invitations; reservations (including purchased state); clarifying comments; and contribution declarations (amount, currency and contributor identity for the owner's private ledger).
  • Sharing secrets — Gifts share-link tokens and human access phrases are stored as HMAC hashes for lookup and as AES-256-GCM ciphertext so the list owner can reveal the link and phrase again. Raw tokens and phrases are not kept in logs, analytics or e-mail preview snippets.
  • Technical data for security — as described for Cloudflare Turnstile below, when you submit a contact or support form.

We do not collect payment-card data for Gifts. Transfer declarations record money moved outside the product; they are not payments through Gifts.

4. Purpose of Data Processing

We process your data to:

  • Create and maintain one account for both products.
  • Let you organise Secret Santa groups, draws and wish lists in Santa's Sack.
  • Let you create, share and coordinate gift lists in Gifts (link + access phrase, e-mail invitations, reservations, comments and off-platform transfer records).
  • Send service e-mail (sign-in codes, invitations, optional list-activity notices). List invitations are always sent; activity mail can be turned off in Settings.
  • Protect the Service against spam and abuse.
  • Improve the Service using anonymous usage statistics.

Legal bases:

  • Consent (Article 6(1)(a) GDPR) for optional notifications you can disable.
  • Contractual necessity (Article 6(1)(b) GDPR) for the account and product features you use.
  • Legitimate interest (Article 6(1)(f) GDPR) for security, abuse prevention and service improvement.

5. Gifts sharing, access phrases and contribution privacy

Every shared Gifts list uses an unguessable URL and a human access phrase. The URL alone is not enough to open the list. Recipients who unlock with the phrase can read the list; reserving a gift, declaring a transfer or posting a comment requires a signed-in, verified account. Recipients never edit list content through share access.

Contribution amounts: only the list owner sees who declared how much. Everyone else, including other givers, sees only an aggregate budget bar (fill ratio and/or remaining amount). This applies while the list is in use, not only after account deletion.

Sign-in requests started in Gifts are handled by the Santa's Sack authentication issuer. Signing in or out on either trusted product affects the current browser in both.

6. Data Storage

Data is stored on Amazon Web Services (AWS) in the eu-central-1 region (Frankfurt, Germany). We use encryption at rest and in transit.

Data is kept while the account is active. After deletion, visible sharing data is removed immediately as described in section 8; the account row may be retained for up to 30 days for billing or defence against claims unless you request earlier deletion where the law allows.

7. Anti-Spam and Bot Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile on contact and support forms to prevent spam and automated abuse.

Data collected by Cloudflare: IP address; browser information (User Agent, device type, operating system); interaction patterns with the widget; technical telemetry; response time and behavioural analytics.

Cookies set by Cloudflare: cf_clearance (1 year); __cf_bm (30 minutes).

Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Data may be transferred to the USA with GDPR-appropriate safeguards.

More information: Cloudflare Privacy Policy

Objecting to this processing may prevent you from submitting contact forms.

8. Account deletion

Deleting the account from Santa's Sack or Gifts signs the browser out of both products. Gifts share links and invitations stop working immediately. Memberships are removed. Unpurchased reservations are released; purchased gifts stay claimed without the deleted person's name. Contribution amounts remain on the owner's private ledger without the giver's identity. Comment text remains with an anonymised author label. Owned lists are kept and return as private lists if the user later signs in again (account restore). Santa's Sack groups you own remain subject to the 30-day retention in section 6.

9. Data Sharing

We do not sell your personal data. We share it only as required by law or as needed to provide the Service (for example AWS infrastructure providers bound to confidentiality, and Cloudflare for form protection).

Gifts list content is shown to people the owner invites or who unlock a share with the access phrase, under the redaction rules in section 5.

10. Your Rights

Under GDPR you may request access, rectification, erasure, restriction of processing, data portability, and object to certain processing. Contact us through the contact page.

11. Data Security

We implement appropriate technical and organisational measures, including HMAC hashing and AES-256-GCM encryption of share tokens and access phrases. No method of transmission over the internet is 100% secure.

12. Liability Disclaimer

Tomasz Miller assumes no responsibility for content that users store on their accounts. Users are responsible for that content and for complying with applicable law.

13. Changes to this Privacy Policy

We may update this policy. We will notify you of changes via an in-app notice or e-mail.

14. Contact

If you have questions about this Privacy Policy, contact us through the contact page.

Thank you for your trust and for using Santa's Sack and Gifts.