XmasGoat app privacy policy

Information you provide

We store account details such as your email and display name, exchange participation, wishes and links, and private gift records such as recipients, budgets, prices, status and notes. We use this information to run the service, synchronize your account across devices and send sign-in and exchange messages.

Sign-in supports email codes and passwords. Our authentication provider handles password credentials. Avoid adding sensitive information to wishes or shared list titles.

Who can see your lists

Your gift tracking and notes are private to your account. Creating a sharing link lets anyone holding that link read your wish list without an account. You can stop sharing in Wish Lists. This closes the link, but cannot erase copies someone already saved.

Your personal wish list is shown to your assigned Secret Santa by default. Uncheck the visibility setting in Wish Lists to opt out. Link sharing is a separate choice. Exchange members can see the information needed to participate; draw assignments are shown to the assigned giver.

Other authorized buyers can see that a wish is reserved, without seeing the buyer’s identity. The list owner is not shown reservations. A buyer’s copied gift record can remain after a wish or shared link is removed.

Reporting and blocking

Reports include your explanation and a snapshot of the reported wishes for private administrator review. Your account identifier is attached when signed in. The reported user cannot read the report. Account blocks synchronize across devices; signed-out blocks are saved in a cookie on that device.

Camera and device access

The optional camera permission scans invitation QR codes. You can choose a QR photo instead or type a code. QR images are decoded on your device and are not uploaded for scanning. The app does not request your contacts or location.

Sharing a webpage to XmasGoat keeps a draft on your device until you confirm saving or cancel it. The webpage link is stored in your account only when you save. Google Play’s install-referrer service can pass an invitation identifier to the app after installation so you can continue joining. Network status is used to show connection problems.

Service providers and security

Supabase provides account authentication, database and storage services. Vercel hosts the web application. Email delivery providers process transactional messages. These providers process information needed to provide their services; processing may occur outside your country. Connections use HTTPS and database permissions restrict account access.

Hosting and security systems may process technical request information, including IP addresses and error logs, to operate and protect the service. Google Analytics is disabled in the app. We do not sell your personal information or use it for targeted advertising. External websites, including gift-discovery links to xmasgoat.com, have their own privacy policies.

Retention and deletion

Your saved content remains available until you remove it or delete your account. Account deletion removes your personal lists, gift records and reservations and closes exchanges you organize. Shared records may retain an anonymous former-member placeholder. Operational backups and security or deletion records may persist according to provider retention and legal obligations.

Delete your XmasGoat account in the app or request deletion by email. You can also ask for access to or correction of your personal information.

Children

The app is intended for adults organizing gifts and exchanges. Adults should manage children’s participation rather than creating independent accounts for young children.

Contact

Privacy, access and deletion requests: info@xmasgoat.com.