Privacy policy

1. Who runs GiftLoom

GiftLoom is run by Jay Stants, an individual, and is currently in a free trial (invite-only for now). In this policy, “GiftLoom”, “we”, and “us” mean the service and the person who runs it.

2. What we collect

• Your account: your name, email address, password (stored only as a one-way hash, never in readable form), optional profile photo, notification preferences, and the invite code you signed up with.
• Your plans: the events, people, gift lists, gifts, wishlist items, budgets, prices, links, notes, dates, and photos you add. This can include information about other people, such as the names of friends and family you’re buying for.
• Sharing activity: email addresses of people you invite to an event or list, who has accepted, and the name a visitor types when they claim an item on a shared wishlist.
• The waitlist: if you join the waitlist on our home page, we store the email address you enter, which of the page’s sign-up forms you used, and when. If you arrived by a link that names where it was posted (such as our Instagram profile) or from another website, we also store that label and the website’s name, never anything about you. Nothing else is asked for, and it isn’t linked to a GiftLoom account.
• Abuse protection: to limit repeated sign-in, sign-up, waitlist, and assistant requests, we keep a running counter tied to an email address or network (IP) address. It records a count and a time window, not a history of what you did.
• Sign-in records: each time you sign in, the browser and kind of device you used, your network (IP) address and the approximate place it points to (such as “Rochester, NY, US”, worked out by our host from the address, not from your device’s location), when that sign-in was last used and how it ended. We also keep a short log of sign-ins, sign-outs, sign-in codes and password changes. You can see where you’re signed in under Settings.
• Your activity and feedback: which days you’ve used GiftLoom (one entry per day, made the first time you open a page that day while signed in), the date you last used it and how many days you’ve used it. We use these to see whether people come back as their occasions get close. If you send feedback from the app, we keep your note and the page you sent it from. A private reporting tool that only GiftLoom’s founder sees reads these counts, along with new sign-ups and waitlist requests, so we notice who might need a hand.
• Usage and errors: anonymous page-view counts (which pages are visited, from what kind of device and country) and, if something breaks, technical error reports. Neither uses cookies, and error reports are configured not to include your IP address, cookies, or form contents.

3. How we use it

• To run GiftLoom: save your plans, show them across your devices, and share them with the people you choose.
• To send account email you ask for or need, such as password resets and invitations you send.
• If you ask us to set up your account from a gift list you send us, to add those people, dates and gifts to your account for you. We use the list for nothing else.
• To email waitlist members about the GiftLoom trial, such as when their spot is ready. Each request is also emailed to our support inbox so we can reply. We don’t use a waitlist address for anything else.
• To keep your account safe: slowing down repeated sign-in attempts, emailing you a code when you sign in on a device we don’t recognize, showing you where you’re signed in, and checking that a new password hasn’t appeared in a known data breach.
• To understand, in aggregate, which parts of GiftLoom get used, and to find and fix bugs.
• To see whether trial members keep coming back, and to read and answer the feedback you send. Feedback is also emailed to our support inbox so it gets a reply.

We don’t sell your data, share it with advertisers, or use it to train AI models.

4. Services that handle your data for us

GiftLoom relies on a few providers to operate. Each only receives what it needs for its job:

• Vercel hosts the app, stores uploaded photos, and provides the anonymous page-view counts.
• Neon hosts the database where your account, your plans, and waitlist sign-ups are stored.
• Resend delivers email, such as password resets, sign-in codes, invitations, and emails to the waitlist.
• Anthropic will power the in-app assistant, which is not switched on yet. When it is on and you use it, your messages and the matching gift and event names it looks up are sent to Anthropic to generate a reply. If you don’t use the assistant, nothing is sent.
• Sentry receives technical error reports when error monitoring is turned on.
• Have I Been Pwned (its Pwned Passwords service) checks whether a new password you choose has appeared in a known data breach. Only the first five characters of a one-way hash of the password are sent, never the password itself, so the service can’t tell what it is.

When you paste a product link, GiftLoom’s server visits that page to fill in its title, price, and image. The store sees a request from GiftLoom, not from your device.

We may also disclose information if the law requires it.

5. Who else can see your plans

• People you invite to an event or list can see and, depending on the permission you give them, edit it. If you link a collaborator to a person on that event, gifts for that person stay hidden from them.
• Anyone with a shared wishlist link can see that person’s name and the items on the list, including prices and notes. Turn the link off at any time to stop sharing.
• Photos you upload are stored at hard-to-guess web addresses. Anyone who has one of those addresses can open the photo, so avoid uploading anything sensitive.

6. Cookies and browser storage

GiftLoom sets a few cookies of its own and none from anyone else: one keeps you signed in, two short-lived ones protect the sign-in form, and one remembers for a year whether you folded the agenda column. When you sign in, one remembers for 90 days that this browser has signed in to your account before, so it isn’t asked for a sign-in code (it isn’t set when you tick “shared or family computer”), and two more last only a few minutes while you finish signing in. Your light or dark theme choice is saved in your browser. If you arrive by a tagged link or from another website, your browser also keeps that label and the website’s name for 30 days, so a waitlist request made later says how you found us; it isn’t sent anywhere unless you join the waitlist. There are no advertising or cross-site tracking cookies.

7. How long we keep it, and deleting it

We keep your data while your account exists. Deleting your account in Settings permanently removes your account, your events, people, lists, gifts, wishlists, invitations, and the photos you uploaded. Copies may remain for a limited time in routine backups and logs before they’re overwritten.

Sign-in records are kept for 12 months after that sign-in ends, and a remembered device for 90 days after it’s forgotten or expires. Then they’re deleted automatically. They’re also deleted when you delete your account.

We keep a waitlist request for 12 months and then delete it automatically, or sooner if you leave the waitlist. Because a waitlist entry isn’t linked to an account, deleting an account doesn’t remove it and the Settings export doesn’t include it. You can leave the waitlist at any time (see sections 8 and 12).

8. Your choices

• See and edit your information anywhere in the app, including your profile in Settings.
• Export everything in your account (your profile, plans, sharing records, notifications and sign-in records) as a file from Settings.
• Delete your account and its data from Settings.
• Leave the waitlist with the “Leave the waitlist” link in any waitlist email, starting with the confirmation we send when you join. Your address is deleted straight away. You can also email privacy@giftloom.app from the address you signed up with.

9. Keeping it secure

Connections to GiftLoom are encrypted, passwords are stored only as hashes, and password-reset links are single-use and expire after an hour. Signing in on a device we don’t recognize needs a code sent to your email, and you can sign out any device from Settings. No system is perfectly secure, but we work to protect your data and limit who can reach it.

10. Children

GiftLoom isn’t meant for children under 13, and we don’t knowingly collect their information. If you believe a child under 13 has created an account or joined the waitlist, it will be deleted once we learn of it.

11. Changes to this policy

GiftLoom is still changing during the trial, and this policy will change with it. When it does, the “last updated” date above changes too; for significant changes, we’ll let account holders know in the app or by email.

12. Contact

For privacy questions and requests, including leaving the waitlist, email privacy@giftloom.app. You can also see, export, and delete your account data yourself from Settings.