Effective Date: 2026-09-13
At ByteJoy LLC, we respect your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use secretsanta.app (the "Service"). ByteJoy LLC is the data controller for that information.
In short: we collect your name and email address so that we can run your gift exchange, and we use them for nothing else. We do not sell, rent, lease, trade, or share your personal information with anyone, and we do not use advertising, analytics, or tracking of any kind. A plain-English version of this policy is at Cookies & Your Data.
_secret_santa_key, a session cookie that keeps you logged in and protects our forms against cross-site request forgery, and _secret_santa_web_user_remember_me, which is set only if you choose "keep me logged in" and lasts 14 days. We use no tracking, advertising, or analytics cookies, and no other browser storage. See Cookies & Your Data for details.
We do not collect or store your date of birth, your postal address, your phone number, or any payment information. We do not use your IP address or your browser's user agent for analytics, tracking, profiling, or advertising, and we do not retain them in our server logs. The single exception is the consent record described above, where they are stored as evidence that you agreed to these documents.
We use your information solely to provide and improve the Service:
We do not use your information for marketing, advertising, profiling, or automated decision-making, and we do not send promotional email.
We do not sell, rent, lease, trade, or otherwise share your personal information with third parties for their own purposes, and we never have. We use two service providers, which process data only on our instructions and only so that the Service can function:
We use no analytics providers, advertising networks, content delivery networks, social media embeds, or externally hosted fonts. We may disclose information if we are legally required to do so, or if it is necessary to protect our rights or the safety of others.
We implement reasonable security measures to protect your information, including encryption in transit and passwordless sign-in (we never store a password, because we never ask for one). However, no online service is entirely secure, and we cannot guarantee absolute security.
We keep your account, your event history, and your consent record for as long as your account exists, so that you can refer back to previous events and so that we have a record of what you agreed to. If you ask us to delete your account, we will delete it and the personal information associated with it within 30 days, except where we are required to retain something by law. An invitation that is never accepted expires after 7 days and is not used for any purpose after that.
The Service is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18, and if we learn that we have, we will delete it. If you believe someone under 18 has given us personal information, please contact us.
With respect to our own users, ByteJoy LLC is a "business" as that term is used in the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have no financial incentive programs and we do not collect sensitive personal information. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" link; there would be nothing for it to do.
California residents have the right to know what personal information we collect and how we use it, to request deletion of that information, to request correction of inaccurate information, and not to be discriminated against for exercising any of these rights. To exercise them, contact us using the details in Section 11. We will verify your request by reference to the email address associated with your account and respond within 45 days.
If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation and the UK GDPR apply to our processing of your personal information. ByteJoy LLC is the controller of that information; our contact details are in Section 11.
Legal bases. We process your account and event information to perform our contract with you — that is, to provide the gift exchange you signed up for (Article 6(1)(b)). We process an email address supplied by an event organiser in order to send that person an invitation, on the basis of our legitimate interest, and the organiser's, in inviting them to the event they were asked to join (Article 6(1)(f)). Where we ever rely on your consent, you may withdraw it at any time.
Your rights. You have the right to access your personal information; to have it corrected; to have it erased; to restrict or object to our processing of it; to receive it in a portable, machine-readable format; and to withdraw consent where we relied on it. We extend these rights to all of our users, wherever they live. To exercise any of them, email us at the address in Section 11. This is free of charge and we will respond within 30 days.
International transfers. ByteJoy LLC and both of our service providers are located in the United States, so your personal information is transferred to and stored there. These transfers are made subject to the safeguards in our data processing agreements with those providers, including the European Commission's Standard Contractual Clauses where applicable.
Complaints. You have the right to lodge a complaint with your local supervisory authority. In the United Kingdom, this is the Information Commissioner's Office. We would appreciate the chance to address your concern first.
Automated decision-making. We do not carry out profiling or automated decision-making that produces legal or similarly significant effects. The assignment of gift givers to recipients is a random draw subject to the restrictions participants themselves set.
We may update this Privacy Policy periodically. Any changes will be posted on this page with an updated effective date. Your continued use of the Service constitutes acceptance of the revised policy.
If you have any questions about this Privacy Policy, or wish to exercise any of the rights described above, please contact us at:
ByteJoy LLC
Email: support[at]bytejoy[dot]com
By using the Service, you acknowledge that you have read and understood these Terms of Service and Privacy Policy.