Privacy Policy

There is no account

Secret Xmas has no signup, no password and no profile. A party is a six-character code, and the only thing that proves you are you inside it is a secret stored in an httpOnly cookie set when you join. That cookie is required for the app to work and is not used to track you anywhere else.

What we store

• The party name, budget and status the host sets.
• The display name and avatar each person picks when joining.
• The wishlist text and optional wishlist link each person writes.
• Who drew whom, once names are out.
• Pairs the host marks as never-draw-each-other.
• Gift suggestions generated for a wishlist, cached so a reload does not re-bill.
• If the host upgrades, the email address used at checkout. It is the only link between a party and a payment. It is not an account and the party works without it.

We never ask for a real name, a postal address, a phone number or a date of birth, and nothing in the app has a field for one.

How long we keep it

Every party is created with an expiry 45 days out. A scheduled job deletes expired parties outright, and the participants, wishlists, draw results and exclusions belonging to them go with them. There is no archive and no backup copy we keep afterwards.

Who else sees it

• Vercel hosts the site and the database, and provides the page-level analytics counts (visits and page views, no cookies, no profile).
• Groq receives a wishlist when gift suggestions are generated for it, and nothing else.
• SparkPay and its payment processor handle the upgrade. Card details are entered on their checkout and never reach us.
• Sparkbrain powers the in-app support chat, which loads only on the live site.

We do not sell your data, and we do not serve third-party advertising.

Secrecy inside a party

The point of the app is that nobody can peek. Assignments are only ever sent to the person they belong to; the participants list does not carry anyone else's match, and a wishlist is shown to the person who drew it.

Your rights

Before the draw, the host can remove anyone from a party, which deletes that person's name, avatar and wishlist from it. Everything else goes on its own when the party expires.

To have something removed sooner, or to ask what a party holds, use the contact form and tell us the party code. The code is the only handle we have: without it there is no name, email or account we could look you up by.

Contact

Questions about this policy go to the same contact form.