This policy explains what Joshua Taniwha (“GiftMwah”, “we”) collects when you use https://giftmwah.com, why, and the choices you have. Short version: we collect what we need to run gift lists and pay the bills through affiliate commissions, we don’t sell your data, and we don’t run advertising trackers.
1. What we collect
Things you give us
- Account details. When you sign in with Google we receive your name, email address and profile picture from Google. When you sign in by email link we store your email address. We never see your Google password.
- Lists and notes. List names, occasions, dates, the gifts you add, notes, and links you paste.
- Friends. Who you invite and who you accept, and invite emails you type.
- Claims. When you mark an item on someone’s list as “I’ve got this” you can type a name; we store it with the item so others can see it. No account is needed to do this.
- Messages you send us.
Things we collect automatically
- Click records. When you click a “Shop” link we record which product, which list, guide or search it came from, the referring page, your browser type, your approximate country (from your IP address, which we do not store), and the time. This is how we attribute affiliate commissions and learn which guides are useful.
- Server logs. Our host, Cloudflare, keeps standard request logs (IP address, URL, user agent, timestamps) for security and debugging, retained for a short period.
- Privacy-friendly analytics. If enabled, Cloudflare Web Analytics counts page views without cookies and without identifying you.
We do not collect payment details — purchases happen on the retailer’s site.
2. How we use it
- To run the Service: show your lists to you and to the people you choose, send magic-link sign-in emails, connect friends, and show claims.
- To earn affiliate commission: append tracking codes to outbound links and record clicks so retailers can attribute purchases to us.
- To improve the Service: see which guides and searches lead to clicks, fix errors, and prevent abuse.
- To contact you about your account or material changes to our terms. We don’t send marketing email unless you opt in.
Where GDPR applies, our legal bases are performance of a contract (running the Service you asked for), our legitimate interests (security, analytics, earning commission on a free service), and consent where we ask for it.
3. Who can see your lists
You choose per list: only you; your friends (the default for wishlists); anyone with the link; or public. Public lists can be found by search engines and embedded on other sites. Planning lists (“gifts for Dad”) are always private. Friends can see who claimed what on your list; you can’t, unless you turn off “keep it a surprise”.
4. Who we share data with
We don’t sell personal information and don’t share it with advertisers. We use service providers who process data on our behalf:
| Provider | What for | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, security, analytics | All Service data; request logs |
| Google LLC | “Sign in with Google” | Your Google account identity, when you choose it |
| Resend, Inc. | Sending sign-in and account emails | Email address, email content |
| Amazon.com, Inc. and other affiliate networks (e.g. CJ, Awin, Rakuten) | Attributing purchases to us | A click identifier we generate (not your name or email). Once you land on the retailer’s site, their privacy policy applies and they may set their own cookies. |
We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a merger or sale of the Service (we’d tell you first).
5. Cookies and browser storage
We use one strictly necessary cookie to keep you signed in, and your browser’s local storage to remember things like the name you type when claiming a gift and lists you start before signing in. We don’t use advertising or cross-site tracking cookies, so we don’t show a consent banner. Details are in our cookie notice. Retailers you click through to set their own cookies on their own sites.
6. Retention
Account and list data is kept until you delete it or your account. Guest lists that were never claimed by an account may be removed after 12 months of inactivity. Click records are kept for up to 24 months for commission reconciliation, then aggregated. Sign-in tokens expire within 15 minutes; sessions within 30 days of inactivity.
7. Your rights and choices
You can edit or delete any list yourself. Email support@giftmwah.com to access, correct, export, or delete your personal data, or to close your account; we’ll respond within 30 days. Depending on where you live (for example the EU/UK under GDPR, or California under the CCPA/CPRA) you may also have rights to restrict or object to processing, to data portability, and to complain to a supervisory authority. We don’t sell or “share” personal information as those terms are defined in the CCPA, and we honor Global Privacy Control signals. We won’t treat you differently for exercising your rights.
8. Children
The Service isn’t directed at children under 13 and we don’t knowingly collect their data. If you believe a child has created an account, contact us and we’ll delete it.
9. International transfers
We’re based in the United States and our providers may process data there and elsewhere. Where required we rely on standard contractual clauses or equivalent safeguards.
10. Security
Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Sign-in uses one-time links and Google’s OAuth; we never store passwords. No system is perfectly secure, so please use a strong password on the email account you sign in with.
11. Changes
We’ll update the date above when this policy changes and notify account holders of material changes by email or a notice on the Service.
12. Contact
Joshua Taniwha
7 Cornell Dr, Enfield, CT 06082
support@giftmwah.com