Privacy policy
Last updated 13 November 2026
Giftlisted is a wish list app for families and friends. You make a wish list, see everyone else's in your group, and mark what you're buying so nobody gets the same thing. This page explains what we collect to make that work, who else handles it, and how to get it deleted.
Giftlisted is run by Leo Sjöberg. Questions or requests about your data go to privacy@giftlisted.app.
What we collect
- Your account. Your email address and the name other people in your groups see. If you sign in with Google, we get your name, email address and profile picture from Google. We store your email and display name, and you can change the name in the app.
- What you add. The groups you create or join, invite links, your wish lists and the items on them (title, link, price and notes), and the items you mark as reserved or bought.
- Sign-in records. Our sign-in provider keeps a record of when and how you signed in.
- Request logs. Like most websites, our hosting provider records requests to the app, including IP address, browser type, the page requested and the time. We use these to fix problems.
We don't use advertising, analytics or tracking cookies. Your browser stores your sign-in session and the email you last signed in with, so you stay signed in.
How we use it
- To sign you in and keep you signed in.
- To show your wish lists to people in your groups, and to show you theirs. People in a group see each other's names and lists.
- To let people coordinate gifts. When someone marks an item on your list as reserved or bought, the others in the group can see it. You can't: that's the point, so whatever's bought for you stays a surprise.
- To fix bugs and keep the service running.
We don't sell your data, use it for ads, or share it with anyone beyond the providers below.
Google user data
If you sign in with Google, we only ask for your basic profile: your name, email address and profile picture. We use it only to sign you in and show your name in the app. We don't use it for ads, don't sell it, and don't share it with anyone except our sign-in provider, which receives it directly from Google. Giftlisted's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Who else handles your data
| Provider | What for |
|---|---|
| Descope | Sign-in and account management. Your account is held in Descope's EU region. |
| Cloudflare | Hosting and the database. The database is stored in the EU. Requests pass through Cloudflare's global network. |
| Only if you choose to sign in with Google. |
How long we keep it
We keep your account and what you've added for as long as you have an account. If you remove an item from your list, it's hidden from you, but kept so anyone who already bought it can see it was removed. Request logs are kept for a short period set by Cloudflare. When you ask us to delete your account, we delete your account and everything you added within 30 days.
Your rights
You can ask us for a copy of your data, to correct it, or to delete it, by emailing privacy@giftlisted.app. We process your data because you asked us to provide the service. You can also complain to the UK's Information Commissioner's Office (ICO), or, if you're in the EU, to your local data protection authority.
Children
Giftlisted isn't meant for children under 13 to sign up on their own.
Changes
If we change this policy, we'll update it here and change the date at the top.
See also our terms of service.