Privacy policy

Last updated November 10, 2026

Gidgit helps you plan, budget, and keep track of gifts. To do that, it holds personal information about you and about the people you buy for. This page explains what we keep, why, who can see it, and what you can do about it. We've tried to write it in plain language. If anything is unclear, email support@gidgit.app.

The short version: we use your information only to run Gidgit for you. We don't sell it, show ads, use tracking or analytics tools, or send your information to AI services. Names, addresses, contact details, and notes about people are encrypted in our database. You decide what gets shared, and you can ask us to delete everything.

1. Gidgit is in private testing

Gidgit is an early version shared with a small group of invited testers. That means:

Features may change, break, or be removed, and this policy may change with them (see Changes to this policy).
We back up the database every night, but please don't keep anything in Gidgit that only exists there. Gidgit is provided as is, without guarantees of availability or that data will never be lost.
We may contact you by email about your experience as a tester. You can ask us to stop at any time.

2. What we collect

Your account

Sign-up details: username, email address, password, and time zone (detected from your browser so reminders arrive at the right local time). We never store your password itself, only a one-way scrambled version (a bcrypt hash) that can check it but can't be turned back into it.
Your profile, if you fill it in: phone number, birthday, anniversary, and clothing sizes, plus your choices about which of these connected people can see.
Settings: your Quick Actions, reminder timing, list sorting, and the last page you visited (for "Jump back in").
How you joined: if you signed up with someone's personal invite code, which code it was, and so who invited you.

What you add

Recipients: the people you buy for, with any name, email, phone, address, birthday, anniversary, clothing sizes, and notes you enter.
Occasions, lists, and gifts: names, dates, times, locations, budgets, gift ideas, links, stores, prices, what you paid, order status, promo codes, tags, and notes.
Reminders: what to remind you about, when, and any notes.
Connections: who you're connected with, notes you include with a connection request or invite link, and anyone you've blocked.
Share links: the links you create, their names and settings, and claims shoppers make on them.
Invite codes: the codes you create to invite people, their limits, and which accounts were created with them.

From people using your share links

Someone you send a share link to doesn't need an account. If they claim a gift, we store the name they give (or their Gidgit account, if signed in), when they claimed it, and, if they choose to enter it, what they spent. The list's owner may see these (see Who can see it).

Collected automatically

Signed-in devices: for each device you sign in on, its IP address and a description of the browser or app (the "user agent"). This lets you stay signed in and helps us spot misuse.
Server logs: each request to Gidgit is logged with its time, the page or action requested, and the IP address it came from. Form fields with personal details, passwords, and the invite code are replaced with "[FILTERED]" before anything is written. Share and invite links contain their secret code in the address itself, so those addresses can appear in the logs.
Error reports: when something breaks, we record technical details about the failed request so we can fix it.

We don't use analytics, advertising, or social media trackers, and we don't load fonts or scripts from other companies when you use Gidgit.

3. Information about other people

Much of what's in Gidgit describes people other than you: family, friends, and coworkers, who may never have heard of Gidgit. When you add someone, please:

Add only what you need to shop for them, and only information you have a right to use.
Don't add sensitive information such as health conditions, financial account numbers, government ID numbers, or passwords. Gidgit isn't designed for it.

Information you add about someone is visible only to you, unless you put it on a share link (see Who can see it). If you believe someone has added your information to Gidgit and you want it removed, email support@gidgit.app. We'll work with the account holder to remove it.

4. How we use it

To run Gidgit: show your lists and budgets, calculate spending, sync claims, and keep you signed in.
To send emails you've asked for or need: password resets and reminders.
To keep Gidgit secure: limiting repeated attempts, investigating misuse, and fixing errors.
To improve Gidgit, using feedback you give us and the error reports described above.

We don't sell or rent your information, use it for advertising, build marketing profiles, or use it to train AI models.

People you share a list with

Anyone who has a share link can see what that link allows, without signing in, so share links only with people you trust. A share link shows the list's name, the names of the recipients on it, and each gift's name, expected price, store, product link, and any promo code that hasn't expired. Unless you turn it off for that link, it also shows recipients' ages and clothing sizes.

Share links never show your budgets, what you paid, notes, or anyone's address, email, or phone number. You can make a link expire, or stop it working at any time.

Shoppers can see that a gift has been claimed, but not who claimed it. The list's owner can see the claimer's name and what they said they spent, unless the list is set to keep claims a surprise.

People you're connected with

Connections are mutual and only exist after both people agree. A connected person can see the birthday, anniversary, and clothing sizes from your profile, depending on your sharing settings. They never see your recipients, lists, gifts, budgets, or reminders, and your profile details never appear on their share links.

When you send a connection request, the other person sees your username, email address, and any note you include. Connection lookups give the same response whether or not an account exists, so they can't be used to find out who uses Gidgit.

People who invited you, or whom you invited

If you sign up with someone's personal invite code, the sign-up page shows their username, and afterwards they can see your username in their list of people who joined with that code. They can't see anything else in your account. If you share your own code, anyone who has it sees your username when they open it.

Us

The people who run Gidgit can access the database to keep it working, investigate problems, or respond to your requests. During testing, that includes seeing who invited whom. We only look at your information when we need to for one of those reasons.

When the law requires it

We may disclose information if required by law, such as by a valid court order, or to protect someone's safety. Where we're allowed to, we'll tell you first.

If Gidgit changes hands

If Gidgit is ever sold or merged, your information would move with it, under this policy's protections. We'd tell you beforehand and give you the chance to delete your account.

6. Companies that help us run Gidgit

A few service providers handle data on our behalf. They may only use it to provide their service to us:

Server hosting runs the app and database.
Email delivery sends password reset and reminder emails, so it handles your email address and those emails' contents.
Backup storage stores nightly database backups. They're encrypted before they leave our server, so the storage company can't read them.
Cloudflare handles Gidgit's domain name. It points browsers to our server but doesn't see the pages you view or what you enter.
Monitoring services check from outside that Gidgit is up and that backups ran. They receive no personal information.

Email us if you'd like the current list of company names.

7. What's in our emails

Email isn't encrypted the way our database is, so we keep emails short:

Password reset emails contain a link that works for a limited time.
Reminder emails contain the reminder's text, and the name of the person or thing it's about. Promo code reminders include the code. Reminder notes are never emailed: if a reminder has notes, the email says so and links to them in Gidgit.

We don't send marketing emails. Testers may hear from us about the test (see section 1).

8. Cookies

Gidgit uses only the cookies it needs to work. None are used for tracking or advertising.

Sign-in cookie: keeps you signed in on that device until you sign out. It's signed so it can't be forged, and scripts on the page can't read it.
Session cookie: remembers short-term things, such as your list sorting choice, the page to return to after signing in, or an invite link you opened.
Shopper cookie: on share links, remembers which gifts you claimed and the name you gave, so you can change or release a claim later. It's stored only in your browser until you clear it.

9. How we protect it

Every connection uses HTTPS, and browsers are told never to connect without it.
Encrypted in the database: your email address, username, and phone number; recipients' names, addresses, emails, phone numbers, and notes; birth and anniversary years; reminder text and notes; and notes on connection requests and invites. The encryption keys are kept separately from the database.
Protected but not individually encrypted: other details, such as gift and list information, gift notes, budgets, birthday months and days, and clothing sizes. These are protected by access controls and are never shown to anyone you haven't shared them with.
Passwords are stored only as one-way hashes. App sign-in tokens are stored only in scrambled form.
Nightly backups are encrypted before they leave the server. The key that unlocks them is never stored on the server.
Repeated attempts at sign-in, sign-up, and share links are rate limited, and pages are protected against common web attacks.

No system is perfectly secure, and we can't guarantee that information will never be accessed without permission. If a breach affects your personal information, we'll tell you without undue delay, explain what happened, and tell you what we're doing about it, as the law requires.

10. How long we keep it

Your account and everything in it: until you ask us to delete it. Archiving a recipient or list hides it but keeps it, so your budget history stays accurate. To erase something permanently, ask us.
Signed-in devices: until you sign out on that device.
Server logs: overwritten automatically once they reach a fixed size. At our current, small amount of traffic, that can take a few months.
Error reports: deleted after 30 days.
Backups: each one is kept for 30 days. Information you delete can remain in older backups until they expire.

11. Your choices and rights

See and correct: you can view and edit almost everything directly in Gidgit.
Control sharing: choose what connections see on your profile, end connections, block people, and stop share links working at any time.
Get a copy: email us and we'll send you a copy of your information in a common format.
Delete your account: email us from the address on your account. We'll delete your account and everything in it within 30 days, and it will be gone from backups within 30 days after that. Claims you made on other people's lists will be removed too.
Stop emails: delete a reminder, or skip an automatic one, to stop its email. Password reset emails are only sent when someone requests one.

Depending on where you live, you may have more rights under laws such as the California Consumer Privacy Act or the GDPR. We'll honor any request you make under these laws. We won't treat you differently for using any of these rights.

12. Children

You must be 18 or older to create a Gidgit account. We don't knowingly collect information from children. If you think a child has made an account, email us and we'll delete it.

Parents and other adults often add details about children they buy for, such as ages and clothing sizes. That information is used only to help you shop, is protected as described above, and is shown on a share link only when you include it.

13. Where it's stored

Gidgit's servers and backups are in the United States. If you use Gidgit from elsewhere, your information is sent to and stored in the US, where privacy laws may differ from those where you live.

14. Changes to this policy

We'll update this page when how we handle information changes, and update the date at the top. If a change is significant, such as a new use for your information or a new kind of company receiving it, we'll email you before it takes effect.

15. Contact us

Questions, requests, or concerns about privacy: email support@gidgit.app. We aim to reply within a few days, and to complete requests within 30 days.