Privacy Policy

Effective date: June 3, 2026

GiftingMachine LLC (“GiftingMachine,” “we,” “our,” or “us”) operates the GiftingMachine mobile application and website at giftingmachine.com (the “Service”). This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights in relation to it.

By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information you provide

• Account information. When you sign up via Google, we receive your name and email address from Google. We store your email address to identify your account.
• Profile data. During onboarding you provide your age and how you identify (gender). You also select interest categories (e.g. hiking, coffee, gaming). This data is used solely to personalise your gift recommendations.

1.2 Information we collect automatically

• Swipe data. Each time you swipe on a product card we record the product, direction (like or pass), your age, and your gender identity as they were at the time of the swipe.
• Usage data. We collect standard server logs including IP address, browser type, pages visited, and timestamps when you use the website or API.
• Device push token. If you grant notification permissions on a mobile device, we store the Expo push token for that device to send you relevant notifications. You can revoke this at any time in the app.

1.3 Information from third parties

• Google OAuth. We use Google Sign-In for authentication. Google provides your name, email address, and profile photo. We do not receive your Google password or payment information.
• Amazon Associates. When you click a product link and make a purchase on Amazon, Amazon may share aggregate commission data with us. Amazon governs that interaction through its own privacy policy.

2. How We Use Your Information

• To create and maintain your account.
• To generate your personalised daily deck of gift cards based on your age, gender identity, and interests.
• To compute crowd-validated Top Picks rankings using anonymised, aggregated swipe data.
• To send push notifications you have opted into. You can change your preferences or revoke permission at any time in the app.
• To improve the recommendation algorithm and expand the product catalogue.
• To monitor Service performance and diagnose technical issues.
• To comply with applicable law and enforce our Terms of Service.

We do not use your personal information to serve third-party advertising, sell your data to data brokers, or make automated decisions that produce legal or similarly significant effects about you.

3. Legal Bases for Processing (EEA / UK)

• Contract — processing necessary to provide the Service to you.
• Legitimate interests — improving recommendations, preventing fraud, and maintaining security, where those interests are not overridden by your rights.
• Consent — sending push notifications, which you may withdraw at any time.

4. Sharing Your Information

We do not sell your personal information. We share limited information only with:

• Clerk — authentication and session management.
• Neon / Supabase — our hosted PostgreSQL database, servers in the United States.
• Expo — push notification relay service.
• Sentry — error monitoring with limited technical context.
• PostHog — product analytics, configured to anonymise data where possible.
• Amazon Associates Program — affiliate tracking when users click through to Amazon.

We may disclose your information if required by law or to protect the rights and safety of GiftingMachine, our users, or the public.

5. Data Retention

• Active accounts: Retained for as long as your account is active.
• Deleted accounts: Soft-deleted immediately; permanently purged within 30 days.
• Aggregate data: Anonymised, non-identifiable swipe data may be retained indefinitely.
• Push tokens: Removed on uninstall and within 30 days of account deletion.

6. Cookies and Tracking

The GiftingMachine website uses cookies strictly necessary for authentication (set by Clerk). We do not use third-party advertising cookies. Analytics cookies (PostHog) are first-party and anonymised. You can disable non-essential cookies in your browser settings without affecting core functionality.

7. International Transfers

GiftingMachine is based in the United States. If you access the Service from outside the US, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

8. Children's Privacy

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has used our Service, please contact us at privacy@giftingmachine.com.

9. Your Rights

• Access — request a copy of the data we hold about you.
• Correction — ask us to correct inaccurate information.
• Deletion — delete your account from the Profile screen in the app, or email us.
• Portability — request your data in a structured, machine-readable format.
• Objection / restriction — object to or restrict certain processing activities.
• Withdraw consent — turn off push notifications at any time in the app settings.

To exercise any of these rights, email privacy@giftingmachine.com. We will respond within 30 days.

10. Security

We implement industry-standard security measures including TLS encryption in transit and encrypted storage at rest. However, no method of transmission over the internet is 100% secure. Report suspected security issues to privacy@giftingmachine.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new effective date and, where appropriate, by email or in-app notice.

12. Contact Us

Questions about this Privacy Policy? Contact us or email privacy@giftingmachine.com.