Privacy policy

Last updated: October 19, 2026

GiftCrew ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, website, and browser extension (collectively, the "Service").

GiftCrew is run by Emanuel-Alin Răileanu as Răileanu Emanuel-Alin PFA, a sole trader (persoană fizică autorizată) registered in Romania, who is the controller of your personal data. For anything about your data, write to support@giftcrew.app.

1. Information we collect

Account information

When you create an account, we collect:

• Email address - Used for account identification and communication
• Name - Your display name shown to other users
• Profile picture - Optional, provided through your authentication provider
• Birthday - Month and day, used to show your birthday and send reminders in your groups. The birth year is optional: if you add it, your groups also see your age, and we use it to check that you're at least 13. You can remove it anytime in Settings.

User content

When you use the Service, you may provide:

• Wishlist items - Titles, descriptions, links, and images of items you want
• Chat messages - Messages sent in gift chats, event chats, and Secret Santa anonymous chats
• Images - Photos uploaded for wishlist items
• Group information - Group names, descriptions, and membership
• Wishlist update requests - When you ask someone to update their wishlist: who asked whom, from which group, when, and when it was answered

Automatically collected information

We automatically collect:

• Device information - Browser type, device type for push notifications
• Service logs - Standard technical logs kept by our authentication, database and hosting providers (Clerk, Convex and Vercel) to run and secure the Service, such as sign-in activity and error logs. We do not use analytics or advertising trackers.
• Push notification tokens - If you enable notifications

Payment information

We do not directly collect payment information. Payments are processed by:

• Stripe (via Clerk) for web subscriptions
• Google Play Billing for Android app purchases

We receive confirmation of your subscription status but do not have access to your full payment details.

2. How we use your information

We use your information to:

• Provide, maintain, and improve the Service
• Create and manage your account
• Enable you to create wishlists and share them with groups
• Facilitate Secret Santa name draws and anonymous gift assignments
• Facilitate group communication through chat
• Send push notifications (with your consent)
• Process subscription payments
• Display birthday reminders to your group members
• Respond to your inquiries and support requests
• Generate personalized AI gift suggestions using your wishlist data (Pro plan only)
• Protect against fraudulent or unauthorized activity

3. Legal bases for processing

If you're in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases under the GDPR:

• Our contract with you (Art. 6(1)(b)) - Your account, wishlists, groups, claims, chats, reminders, AI gift ideas you ask for, and Pro subscriptions
• Your consent (Art. 6(1)(a)) - Push notifications, and details you choose to add, such as your birth year and interests. You can withdraw it anytime by turning notifications off or removing those details in Settings; this doesn't affect what happened before.
• Legitimate interests (Art. 6(1)(f)) - Keeping the Service secure, preventing abuse, keeping service logs, and answering your emails
• Legal obligations (Art. 6(1)(c)) - When the law requires us to keep or disclose information

4. Information sharing

Within groups

When you join a group, other group members can see:

• Your name and profile picture
• Your birthday (month and day), and your age only if you added your birth year
• The items on the wishlist you show in that group
• Your chat messages within that group

Gift claims are hidden from the person whose wishlist it is (and from the people being celebrated in an event group) to preserve surprise, but visible to other group members to help avoid duplicate gifts. In Secret Santa groups, other members see that an item is claimed but not who claimed it. Chat about a wishlist is never shown to the person whose wishlist it is.

In Secret Santa groups, name draw assignments are private — each participant can only see who they were assigned to gift. Anonymous chat messages are visible only between the assigned gifter and their recipient.

Wishlist update requests never show the person whose wishlist it is who asked(for an event's shared wishlist, its honorees): they only see how many people asked. Other members of the group a request was made from can see who asked; members of other groups see only a count. In Secret Santa groups, nobody sees who asked.

Third-party service providers

We share information with service providers who help us operate the Service:

• Clerk - Authentication, user management, and web billing (payments processed by Stripe)
• Convex - Database and real-time data synchronization
• Vercel - Hosts the website and app, and handles the technical data every website receives, such as your IP address, to deliver pages
• Hetzner and Google - Emails you send to support@giftcrew.app arrive on our mail server, hosted by Hetzner in Germany, and are read in Gmail
• Payment processors - As described above
• Firebase Cloud Messaging - Delivers push notifications to the Android app if you enable them
• Browser push services - If you enable notifications in your browser or the installed web app, notifications are delivered through your browser's push service
• Perplexity AI - AI-powered gift suggestion generation. When you use the AI Suggestions feature, your wishlist item titles, descriptions, and selected interest categories are sent to Perplexity AI to generate personalized gift recommendations. This data is used solely for generating suggestions and is not used by Perplexity for model training purposes. See the AI Gift Suggestions and Data Processing section below for details.

Legal requirements

We may disclose your information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Where your data is stored and how long

Location

Your account and everything you add to GiftCrew are stored by Convex and Clerk in the United States. Our other providers, listed above, may also process data outside your country. When your data leaves the European Economic Area, it's protected by the safeguards in each provider's data processing terms, such as the European Commission's Standard Contractual Clauses.

Security

Your data is stored securely using industry-standard encryption and security practices. We use Convex for data storage, which provides:

• Encryption in transit (TLS/SSL)
• Encryption at rest
• Regular security audits

While we implement safeguards to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

Data retention

We keep your account, wishlists and groups until you delete them or your account. Some data is kept only for a limited time:

• Chat messages - Each chat keeps its newest 1,000 messages; older messages are deleted once they are also more than 60 days old
• Birthday gift claims - Deleted 3 months after the birthday
• Event gift claims - Deleted 14 days after the event
• Wishlist update requests - Deleted about a month after they are answered
• AI suggestion credit history - Kept for 12 months

6. Third-party services

Our Service integrates with third-party services, each with their own privacy policies:

• Clerk Privacy Policy
• Convex Privacy Policy
• Vercel Privacy Policy
• Google Privacy Policy (for Google Play and Firebase Cloud Messaging)
• Stripe Privacy Policy
• Perplexity AI Privacy Policy (for AI gift suggestions)

Some links to shops in the guides on our website are affiliate links. When you click one, you go to the shop (for Etsy, through Rakuten Advertising, which runs Etsy's affiliate program), and the shop may set its own cookies to credit the purchase to GiftCrew. That happens on the shop's site, under its own privacy policy. We do not share your personal data with these shops, and they tell us which items earned a commission, but not who bought them:

• Amazon.com Privacy Notice
• Etsy Privacy Policy
• Rakuten Advertising Services Privacy Policy

7. Cookies and browser storage

GiftCrew stores only what it needs to work and to remember choices you make. We don't use analytics, advertising or social media tracking cookies, so there's nothing to accept or reject.

Cookies

• Signing in - Clerk's cookies keep you signed in and protect your account, and its sign-in service sets short-lived cookies to tell people from bots. They last until you sign out or your session ends.
• Payments - When you open the checkout to subscribe on the website, Stripe sets cookies to prevent fraud: one lasts 30 minutes, the other a year.

Browser storage

• Your settings - Your theme, whether your wishlists and groups show as a list or a grid, and which kind of group you filter by. They stay on your device until you clear your browser data.
• What you're in the middle of - For example an invite link you opened before signing in, or where you were on a long page, so you can pick up where you left off. Cleared when you close the tab.
• Notifications - If you turn on notifications, your browser keeps a push subscription and a small background script that shows them. Turning notifications off removes the subscription.

Shops you visit from GiftCrew

Shops you reach through links on GiftCrew, including the affiliate links described under Third-party services, set their own cookies on their own sites, under their own policies.

You can delete cookies and site data in your browser settings at any time. You'll be signed out, and your settings will go back to their defaults.

8. AI gift suggestions and data processing

Feature availability

AI gift suggestions are a Pro feature that suggests items for your own wishlist. Pro subscribers receive 3 credits for each calendar month in which they use AI suggestions (added the first time they use the feature that month); months without use add no credits. Unused credits remain valid for 12 months. Users who cancel or downgrade their subscription can keep using any credits they still have until those credits expire.

Data shared with Perplexity AI

When you use AI suggestions, the following data is transmitted to Perplexity AI's API:

• Your wishlist item titles and descriptions (to understand your interests)
• Selected interest categories (if you choose them instead)
• Your birthday month (to provide seasonally relevant suggestions)
• Previously generated suggestion titles (to avoid duplicate recommendations)

Data NOT shared

Your email address, full name, profile picture, group information, chat messages, and payment details are never sent to Perplexity AI.

Purpose limitation

Data sent to Perplexity AI is used exclusively for generating gift suggestions in real-time. It is not stored by Perplexity beyond the duration of the API request.

No training use

Your data is not used by Perplexity AI for training, fine-tuning, or improving their models. We use the Perplexity Sonar API, which operates under a Zero Data Retention Policy — no prompt or response data is stored by Perplexity beyond processing your immediate request.

Opt-out

You can choose not to use the AI suggestions feature. The feature is entirely optional and does not affect any other functionality of the Service.

9. Adding products from online shops

Fill in from a link

When you paste a product link into Fill in from a link, our servers open that link to read the product's name, description, and photos, and download up to two photos to store with your item. The shop sees a request from our servers, not from your device. Links to private addresses, such as devices on your home network, are never opened.

Browser extension

The GiftCrew browser extension (for Chrome, Edge, Firefox, and Safari) only works with a page when you ask it to:

• Reading a page - When you open GiftCrew from your browser's toolbar or menu, or use its keyboard shortcut, the extension reads that page in your browser to find the product's name, description, photos, and link. It does not read pages you don't use it on, and it does not track your browsing.
• Adding an item - Nothing from the page is sent to GiftCrew until you click Add to wishlist. Then the name, description, and link, and the photos you chose, are saved as a wishlist item like any other; our servers download those photos from the shop. Before saving, the extension removes tracking codes and personal details from the link, such as email addresses or session codes.
• Your account - To show its form, the extension loads your GiftCrew name, profile picture, plan, groups, and wishlist items from our servers, so it can offer the event wishlists you're celebrated in and tell you if a product is already on your wishlist. We also record when you first use the extension, so the website stops suggesting it.
• Sign-in - You connect the extension to your GiftCrew account through Clerk, after confirming on our website. The extension keeps its sign-in tokens in your browser's extension storage on your device and sends them only to Clerk and Convex to keep you signed in. Disconnect this browser, in the extension's account menu, deletes them from your device and cancels them.
• Settings - The theme you choose in the extension is saved on your device only.

The extension contains no analytics or advertising, and we don't sell or share what it reads. It runs by itself on only two pages of our website: the one that finishes connecting your account, and the browser extension page, where it only lets the page show that it's installed. See the permissions it asks for on the browser extension page. The add-on store you install it from handles its downloads and updates under that store's own privacy policy and shows us only aggregate statistics, such as the number of installs.

10. Your rights

Depending on your location, you may have the following rights:

Access and portability

You can see most of your data directly in the app (your profile, wishlists, and messages). For a copy of all of it in a portable format, email support@giftcrew.app and we'll send it within one month.

Correction

You can update your profile information, wishlist items, and messages at any time through the app.

Deletion

You can:

• Delete individual wishlist items and messages
• Leave groups
• Delete your account directly from the account menu (select your profile picture, then Manage account)

When you delete your account, your personal data is removed, including your profile information, wishlist items, images, wishlist update requests you made or received, notification subscriptions, billing records, and AI suggestion data. Messages you previously sent in group chats are retained in a de-identified form (displayed as "Deleted user") to preserve conversation context for other group members. Chat threads about your wishlist are deleted along with your wishlist items. Groups where you are the only member are deleted. Groups with other members remain active, and ownership is automatically transferred to another group member.

Push notification control

You can enable or disable push notifications at any time through your device settings or the app's notification settings.

GDPR rights (European users)

If you are in the European Economic Area, you also have the right to restrict or object to processing, to withdraw consent at any time, and to lodge a complaint with a data protection authority, such as the one where you live, or Romania's ANSPDCP (dataprotection.ro).

CCPA rights (California users)

California residents have the right to know what personal information is collected, request deletion, and opt-out of the sale of personal information. We do not sell personal information.

11. Children's privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@giftcrew.app and we will delete such information.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we may also notify you through the app or by email.

13. Contact us

If you have questions about this Privacy Policy or our privacy practices, please contact us at: