Privacy Policy

Summary

We do not ask you to create an account or give us your email address. The tools on this site store your lists, budgets and preferences in your own browser, not on our servers. The Secret Santa group feature stores first names and group details on our server for a limited time, as described below. Third-party advertising providers, including Google, may use cookies and similar technologies to show ads, and you can control that through the cookie choices on this site and the opt-out links below.

Information we collect

Information you give us. If you email us, we receive your email address and message and use them only to reply. We do not sell this information.

Information collected automatically. Like most websites, our hosting provider and service partners may receive technical information such as your IP address, browser type, device type, pages visited, referring page and time of visit. We use it to operate the site, understand which pages are useful and prevent abuse.

Information stored in your browser. Our tools use your browser's local storage so your work is there when you return. Keys include jl_gf_saved (saved gift ideas), jl_returns_v1 (tracked purchases and return dates), jl_plan_ (budget planner and gift list data), jl_wish_v1 (your wish list), jl_quiz_v1 (your last quiz answers), jl_adv_open (opened Advent doors), jl_ss_groups (Secret Santa links you have used on this device) and jl_consent_v1 (your cookie choice). This data stays on your device. You can delete it by clearing site data in your browser or with the reset buttons in the tools. Shareable links for the quiz, wish list and instant Secret Santa draw encode their content in the link itself, and we do not store them.

Secret Santa groups

If you create or join a group at /secret-santa/, we store on our server: the group name, budget range, dates and notes the organizer enters; participants' first names (or nicknames) and any optional interests, sizes, wish-list link or note they enter; the draw result; and optional anonymous messages between matched participants. We do not ask for or store email addresses or phone numbers, and we ask that you use first names only. Access is controlled by long random links: only people who hold a link can see what that link allows. The organizer cannot see who drew whom. Group data is deleted automatically after 120 days. We keep short-lived counters of requests per IP address, hashed and expiring within an hour, to limit abuse. If you want a group deleted sooner, email us with the group name and your organizer link.

Advertising and cookies

We use Google AdSense to display advertising. Google and its partners, including DoubleClick, use cookies and similar technologies to serve ads based on your visits to this and other websites, to measure ads and to prevent fraud.

You can opt out of personalized advertising:

• Google Ads Settings: adssettings.google.com
• Network Advertising Initiative: optout.networkadvertising.org
• Digital Advertising Alliance (US): optout.aboutads.info
• European Interactive Digital Advertising Alliance: youronlinechoices.eu
• How Google uses data from partner sites: policies.google.com/technologies/partner-sites

You can also manage cookies in your browser settings and use the "Cookie settings" button in the footer to change your choice on this site. If you reject personalized ads, you may still see ads, but they will not be tailored to your interests. Third-party vendors, including Google, may place and read cookies on your browser or use web beacons as a result of ad serving on our site. We do not control those cookies.

Visitors in the EEA, the United Kingdom and Switzerland

If you are in these regions, we ask for your consent before loading advertising that uses cookies or similar identifiers. Consent is optional and you can withdraw it at any time from the footer. Our legal bases are your consent (advertising cookies), our legitimate interest in operating and securing the site (technical logs and rate limiting) and, for emails, our legitimate interest in replying. You have the right to access, correct, delete or restrict use of your personal data, to object to processing, to data portability and to complain to your data protection authority. Email us to exercise your rights.

California residents (CCPA and CPRA)

If you are a California resident, you have the right to know what personal information is collected, to request deletion, to correct inaccurate information and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. Advertising technology may count as "sharing" under California law. You can opt out by rejecting personalized ads in our cookie settings, using the opt-out links above and enabling a Global Privacy Control signal in your browser. We do not sell personal information for money, and we will not discriminate against you for exercising your rights.

California Online Privacy Protection Act (CalOPPA)

You may visit our site anonymously. We do not currently respond to browser "Do Not Track" signals because there is no uniform standard, but we treat Global Privacy Control as an opt-out request where our consent tools can detect it. This policy is linked from every page.

Children's privacy

The site is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact us and we will delete it.

Affiliate links

Some links to retailers may include an affiliate tag, as described in our affiliate and ad disclosure. If you click one and buy, the retailer may set its own cookies and tell us that a purchase happened. We do not receive your payment information.

Sharing features

Share buttons are plain links to Facebook, X, Pinterest, WhatsApp, Reddit, email and SMS, plus your device's native share sheet where available. We do not load any social network scripts, so those networks learn nothing about you until you click a button. Links we create carry UTM parameters that identify the share channel.

Data retention and security

Technical logs are kept by our hosting provider for a limited period. Secret Santa data is deleted after 120 days. Emails are kept as long as needed to respond and keep records. Data in your browser is under your control. We take reasonable steps to protect the information we handle, but no system is perfectly secure.

Third-party links

The site links to other websites, such as carriers and retailers. We are not responsible for their privacy practices.

Changes to this policy

We may update this policy. When we do, we will change the effective date above.

Contact

Questions or requests can be sent to hello@thejollylist.com or through the contact page. See also our cookie policy.