Privacy policy

What we record

To understand which pages are useful, the site records anonymous usage events: a page being viewed, a tool being used, or a link to another website being clicked. Each event carries a random identifier created in your browser tab when you arrive. It is kept in session storage, disappears when you close the tab, and is not linked to your name, email address or device. We also record the address of the page, the website that referred you and any campaign tags in the link.

We also use Cloudflare Web Analytics to count page views and measure page load times. It does not use cookies, does not use local storage to identify you, and does not collect personal information; it only reports aggregate figures such as which pages were viewed and how quickly they loaded.

Secret Santa draws

When you create a draw we store what you type: the event name, budget, exchange date and notes, and the participants' names. When participants open their private link they can add a wishlist, likes and dislikes, sizes and an optional shipping address. Those details are shown only to the person who drew that participant. The organizer page shows who has opened their link and whether they added a wishlist, but not what it says and not who drew whom.

Private links contain random keys that we store only in hashed form. We do not ask for or store email addresses, and we never send marketing email.

Everything about an event is deleted automatically 30 days after the exchange date, or 60 days after the event was created if no date was set. The organizer can delete the event at any time from the organizer page, which removes all of it immediately.

To prevent abuse, creating an event includes a Cloudflare Turnstile check, and we count requests per network for rate limiting using a keyed hash of the IP address and the date. The IP address itself is not stored. If the check can’t run in your browser (for example because a content blocker stops it), the event is still created, with a lower limit per network. We keep daily totals of how often the check passed or failed: just numbers, nothing about you.

Answers you type into the questionnaire stay in your browser's local storage until you clear them. They reach us only if you add them to your wishlist.

White elephant tool

The white elephant order tool runs entirely in your browser. The names you type are not sent to us or stored.

What we never collect

We do not use cookies for tracking, we do not build profiles, and we do not store your IP address, browser fingerprint or any other personal information alongside these events. We do not sell or share data with advertisers.

Hosting

The site is served by Cloudflare. Like any web host, Cloudflare processes technical request data such as IP addresses to deliver pages and protect against abuse, under its own privacy policy.

Affiliate links

Some pages contain affiliate links. If you follow one, the merchant may set its own cookies to attribute a purchase to us. Those pages carry a disclosure at the top.

Contact

Questions about this policy can be sent to hello@secretsantagenerator.xyz.