Privacy Policy

The short version

• We collect the minimum needed to run a party page, and we never sell or rent your data.
• The account is always the parent's. Children never sign up, log in, or enter anything.
• Party pages are private links — not public, not searchable, not indexed by search engines.
• Giftic never handles money. Cash-pot payments go straight from guests to the parent via Venmo or PayPal.
• No third-party ads, no ad trackers.
• Email hello@giftic.app to see, export, correct or delete your data. We answer within 30 days, usually much sooner.

1. Who is responsible for your data

The data controller is Nikola Kovačević PR Računarsko programiranje Giftic, Belgrade, Serbia (the operator of giftic.app and giftic.rs). Contact for anything about privacy: hello@giftic.app.

2. What we collect and why

• Parent account: your email address (and your name if you sign in with Google). Used to sign you in and to send messages about your own party (for example, when a guest reserves a gift). Basis: performing our service for you.
• Your party page: what you enter — your child's first name, age, party date, time and place, gifts and links, an optional message and an optional photo. Shown only to people who have the link. Basis: performing the service you asked for.
• Cash pot (optional): your Venmo username and/or PayPal.me handle, shown to guests on your party page so they can pay you directly. We never see card or bank details.
• Guests: when a guest reserves a gift, says whether they're coming, or pledges to the cash pot, we store the name they type (or “Anonymous guest”), an optional email or phone number, the number of kids and adults coming, an optional message, and the pledged amount and payment method. Used to show the parent who is coming and which gifts are taken, and — if the guest gave an email — to send a confirmation and a cancel link. Guests don't need an account.
• Waitlist: if you join it, your email, the country you picked and the page you signed up from, to tell you about Giftic. Reply “remove” to any email and we delete it.
• Usage and security data: pages viewed, approximate country, device and browser type, and technical error reports. Used to keep the service working, prevent abuse and understand which pages help parents. Basis: our legitimate interest in running a safe, working service. We don't store full IP addresses in our analytics.

3. Children's privacy (COPPA and GDPR)

Giftic is a tool for parents and guardians; you must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 13, and the service is not directed at children. Everything about a child on a party page — typically a first name, an age, a wishlist and an optional photo — is entered by the parent, shown only to people who receive the private link, and deleted when the parent deletes the party or the account. Party photos are deleted automatically 90 days after the party. If you believe a child has given us information directly, email hello@giftic.app and we will delete it.

4. Cookies and similar storage

• Sign-in cookies (set by our login provider, Supabase) keep you logged in. Strictly necessary.
• Your reservations are remembered in your browser's local storage, so you can cancel a gift you reserved. Strictly necessary for that feature.
• Measurement without cookies: on giftic.app we don't use any cookie for measurement. A random visit ID is kept only in your browser's session storage and disappears when you close the tab; page views are counted in our own database and are not sent to Google or any other analytics company. No names, emails or party details are ever included. To switch measurement off completely, open any page with ?notrack=1 added to the address.
• We use Vercel Web Analytics and Speed Insights, which don't use cookies.

5. Who else processes your data

• Supabase — database and sign-in, hosted in the EU (Ireland).
• Vercel — website hosting and cookieless analytics (United States and global edge network).
• Resend — sending emails (United States).
• Sentry — technical error reports, without session recording.
• Venmo and PayPal — only when a guest chooses to pay through them; that payment is between the guest, the parent and the payment app, under its own terms.

Each provider processes data only on our instructions. Where data leaves the EU, we rely on the provider's EU-U.S. Data Privacy Framework certification or the EU Standard Contractual Clauses. Nobody else gets your data, and never for advertising.

6. How long we keep it

• Parent account and party pages: until you delete them or ask us to delete your account.
• Guest replies, reservations and pledges: as long as the party page exists; they are deleted with it.
• Party photos: 90 days after the party, then deleted automatically.
• Waitlist emails: until you ask to be removed, or 12 months after launch (September 2027), whichever comes first.
• Analytics events: only as long as they are useful for statistics; we review and delete old events at least once a year.

7. Your rights

Wherever you live, you can ask us what we hold about you, get a copy, correct it, or have it deleted, and you can object to measurement. Email hello@giftic.app; we reply within 30 days. If you are in the EU, EEA or UK, you also have the right to lodge a complaint with your local data-protection authority.

8. Changes

If we change how we use your data, we update this page and the date at the top. For important changes we'll also tell account holders by email.