Privacy at Geftable

Who we are

Geftable is a product of Created by Ty, LLC, 411 N 200 E, Bountiful, UT 84010.

Write to us about anything on this page. A person reads it and answers within 30 days: privacy@geftable.com

No ads, no selling

We don't show ads, and we don't sell what we know about you or share it for advertising. We never have. To see how Geftable is used, our server counts visits: for each page you open, it tells PostHog, the analytics service we use, which kind of page it was (a list's page, say, but never which list), the site that sent you there, if one did, and whether you're on a phone, a tablet or a computer, with which browser and system. With it goes a code made from your internet connection and browser that changes every day, so a visit can be followed from page to page that day and not after, and PostHog can't tell who you are from it. Your name, your email and your internet address never reach PostHog, and nothing is kept on your device for it. Nothing is counted in a shared computer's sign-in, or if your browser sends "Do Not Track" or Global Privacy Control. We also count how many times a day things are done on Geftable, such as lists made and invites taken, with nothing kept of who did them.

If you say yes when we ask to record your visits, PostHog's own script runs in that browser too, until you say no, or for a year, when we ask again. It records what happens on each page as you see it: Geftable's own words and how the page looks, with what people typed shown as stars (names, emails, a list's name and description, a list's own gift day, and anything typed in a field), and pictures and pairings left out whole, so your name, your email, your lists and who gives to whom never leave your browser. It counts each page you open and how long you stay, in place of our server, by the page's kind as our server does. It sends all of it through our server, so your internet address doesn't reach PostHog, and it keeps a random code for your visit in that browser tab, gone when you close it. We don't ask, and nothing is recorded, in a shared computer's sign-in or if your browser sends "Do Not Track" or Global Privacy Control. Change your answer.

What we keep

Your account: your name, your email address and the inbox it reaches, your time zone, the avatar we made for you, your plan and, if it was a gift, the day it was given, and whether you've asked to hear about unlimited lists. If you sign in with Google, which Google account is yours, and nothing else of Google's. If you've told us not to use Google, that you did.

Signing in: a record of each browser you're signed in on, and which browser it is. A sign-in ends when you sign out, or about a month after you last used it. On a shared computer it ends after 15 minutes without a visit.

Passkeys: if you add one, the public half of it, which checks what your device signs and can't sign anyone in on its own, with its number and a count your device keeps of its uses; which password manager keeps it, whether it's copied to your other devices, and how your device can be reached for it (the device itself, a phone nearby, or a key you plug in or tap), where your device says; the kind of device it was made on (a computer, a phone or a key, by what your browser says); and the days it was added and last used. Your face and fingerprint never leave your device. If you press Not now when we offer one after you sign in, we remember that, and don't offer it again.

Counting tries: how often your internet connection has asked for a sign-in link, asked for a passkey's check (which the sign-in pages do each time they're shown) or asked for a place on the waiting list, or, after you said yes to recording a visit, sent its pieces through us, so nobody can ask for hundreds. We keep a scrambled form of its address, never the address itself, and delete it within three hours. The same goes for how many invites your account has sent in a day, kept by a scrambled form of your account, never your address, and deleted within a day and three hours.

The waiting list: if you leave your email to hear when there's room, we keep it once you press the button behind the link we send, or once you ask for a list from Start a new list while you're signed in, with the day you joined and the day you're let in, and whether you ticked the box to hear about unlimited lists. Until you do, we keep nothing. Once you're let in and have an account, the row goes, your account keeps that it can start lists, and a ticked box stays as a yes on your account. We keep it to tell you when there's room, about the paid plan if you ticked the box, and for news of Geftable now and then.

Your lists: each list's name and description, what its gift exchange is for and when, who owns and organizes it, the people on it, who is whose partner, who was a removed person's partner, and who gives to whom each year. For each person on a list: their name, their email address if someone gave it, their avatar, and whether the list may email them about its draw. A list brought in from a file is made from what the file says, its past years included; the file itself is read and not kept.

For the people who run a list: who added each person and when, which only the list's owner sees, for a year from the day, and any two people they've asked the draw to keep apart and who asked, which only the owner and organizers see, but for the exception under Who sees what.

People someone suggests: the name and email they typed and who suggested it, until the owner or an organizer adds that person or says no. If the person is added, who suggested them stays with their name.

If you write to us: your email, so we can answer.

A reminder we haven't sent yet: when a reminder is due, we keep which reminder it is and whose place on the list it's for until it goes. If our mail server can't take it, or we've reached the day's limit on the mail we send, we try again each hour from 8 in the morning to 8 at night. It's deleted when it goes, when it would no longer go to you, or when you leave the list, and otherwise within a day of that reminder's week ending.

When something breaks: the error goes into the site's log, which our host keeps. It can include a name or an email address that was part of what failed.

What's done in a list: a record of each change made to a list: who made it, by their name on the list, what it was, with a list's name before it was renamed, and the person or year it was about, never who gives to whom. Someone taking their invitation is in it, and so are the reminders the list sends, with nobody's name. Only a representative for Geftable sees it, when something goes wrong.

A look by Geftable: when a representative for Geftable opens your account or a list you're on, sees your pages as you see them, or gives your account premium, a record of when, who it was, and the list's name, or the account's, or its address where it has none.

If someone else added you

A list's owner or organizer can add you by typing in your name and email. We send you an invitation that names them and the list. If you do nothing, the link stops working in 14 days. An owner can also bring in a list they keep somewhere else, with your name, your email and who you gave to in past years. Then no invitation goes out until they send one.

To be taken off a list, tell the person who added you, or write to us and we'll do it. With an account, you can leave a list yourself from its Settings, unless you own it: an owner gives the list to someone else or deletes it.

Who sees what

The people on a list see each other's names and avatars. Only the list's owner and its organizers see email addresses, and nobody outside a list sees that it exists, with one exception. When something goes wrong, a representative for Geftable may look at a list, any part of it, who gives to whom included, to find and fix the problem. Each instance is recorded. They may look at an account the same way: its name, its address, when it joined, its plan, its lists, how it signs in and whether its mail is on. And they may see an account's pages as its owner sees them, the same way: its lists, a list's page, its people, its settings and a year's page, and its Account page, nothing more than you see and with nothing there they can press. Those pages show them five things nothing else does: the suggestions waiting on a list you run, which of your lists email you, your passkeys' devices and dates, your time zone, and, if your account was given premium, whether you've pressed Got it on the note that says so. Each page they see is recorded, with the account and the list it was on. A search for an account or a list shows the ones that match what was typed, a name, an address or the code in a list's link, and a deleted list by the name it had, to read the record of what was done in it. A search isn't recorded; opening one is. Addresses on the waiting list are seen only by whoever runs Geftable.

In a secret draw you see only who you give to, and who your partner gives to where the list has couples, until the day after the gift day. The owner and organizers see every pairing from the start, and so may a representative for Geftable, as above. In an open draw everyone on the list sees every pairing. When a list has drawn more than one year ahead, its members are shown the later year only after the earlier gift day has passed.

Email we send

A sign-in link when you ask for one, and an email when a passkey is added to your account, so you'd know if it wasn't you. If you ask for a place from the waiting list's form, a link to confirm it, or a note that your address can sign in already, and a link to come in, or to start a list, when there's room. An invitation when someone adds you to a list. A note when a list you're on draws names or changes who you give to, which never says who anyone gives to. One last email if you delete your account. An email ahead of a change to this page or the terms that takes something away from you, costs you money, or uses what we hold in a new way. Reminders four, two and one weeks before a gift day, and one about ten weeks before it to whoever runs the list and is in its draw, with a switch of their own to turn them off.

You can turn off the notes about a draw from the link in any of them, from your Account page, or from a list's Settings. Every email to the waiting list has a link that takes you off it. We send no advertising, and news of Geftable only to the waiting list.

Cookies

Two keep you signed in: the sign-in itself, and a copy of it that lasts five minutes so pages open faster. One holds a random number that picks the pattern at the top of the page before you sign in. It says nothing about you.

If you tell us a computer is shared when you sign in, three more are set. One remembers that for the next sign-in on it, one marks the sign-in to end when the browser closes, and one holds a number that changes when a page left open there is put away. None says who you are.

When the note on your lists page that says what's new in Geftable closes, because you closed it or after it's been on screen six seconds, one remembers which note it was, for a month, so it stays closed until there's a newer one.

If you press Stop motion at the foot of a page, one remembers that for a year, so the shapes at the top stay still in that browser.

If you sign in with Google, one more is set for ten minutes while Google signs you in.

Each time a page with a passkey's button, or the page where you type your email, is shown, one more is set for five minutes, so that a passkey can answer the moment you ask for it. It holds a random number that ties your passkey's answer to the check we asked for.

If you make or use a passkey in a browser, one more remembers that for a little over a year, so the sign-in page there offers to sign in with it instead of to create one. It holds only that, nothing about you, and it isn't set on a shared computer.

When we ask whether we can record your visits, one remembers your answer, yes or no, for a year, so we ask again only after that. If you don't answer, it remembers that as a no.

If you're one of Geftable's admins, turning admin mode on leaves one more in that browser, which remembers it for 30 days, after you sign out too. It holds which account it was and when, and it isn't set on a shared computer. That's all of them, so there's no cookie banner.

Who helps us run it

A hosting company runs the site and its database on a server in the United States, keeps their backups in the United States too, and runs our email. It sees only what that job needs. PostHog, an analytics company, keeps what's sent about each page you open, and the recordings of visits from a browser that said yes, both described above, in the United States. If you choose to sign in with Google, Google tells us your name and email address. We use no one else.

How we keep it safe

Every page travels encrypted, and there's no password to steal: you sign in with a link we email you, which works once, or with a passkey or Google. Of Google's we keep only which Google account is yours, never anything that would let us into it. Only a representative for Geftable can look at a list they're not in or at someone else's account, and only after a step beyond signing in. Each list or account they open is recorded.

How long we keep it

Your account, until you delete it. When you do, you leave every list you're on, and we email you a link to a copy of what your account held. The link works for a week, or for an hour after the first download. After that the copy is deleted at our next clearing, which runs each hour and when anyone signs in or is invited; on a quiet day it can take a day or more. Your name stays in the past years of lists you were on, and beside the people you added until a year after you added them. It leaves the record of what you did in a list.

A passkey, until you remove it on your Account page or delete your account.

A list, until its owner deletes it, and then all of it goes at once, but for the record of what was done in it and its name in the record of a look by Geftable, both below. If you leave a list or are removed from one, your name stays in its past years and your email is cleared, unless you still own or organize the list.

Your address on the waiting list, until you're let in and have an account, or take it off the list from one of its emails or from Start a new list, any of which deletes it. A link to join whose button is never pressed leaves nothing behind.

The record of what's done in a list: a year, after the list is deleted too. Someone's name leaves what they did when their account is deleted.

The record of each time a representative for Geftable opened a list or an account, or saw an account's pages, with its name, or an account's address where it has none: a year. An account's name leaves the record when the account is deleted.

What's sent to PostHog about each page you open: a year.

A recording of a visit, from a browser that said yes: 30 days.

Invitations, sign-in links, the five-minute checks a passkey is asked for and the records of sign-ins that have ended are deleted at our next clearing once they're 30 days past being used or running out. It runs each hour, and when anyone signs in or is invited, at most once in ten minutes.

The site and its database are backed up regularly, and each backup is deleted within 60 days. Something deleted here can stay in a backup for up to 60 days.

What you can ask for

A copy of your account and of each list you're on, with its people and its years as you're shown them: a plain text file, which you download from your Account page, though not from a sign-in on a shared computer. Who added whom, who is kept apart and the record of what's done in a list aren't in the file. A correction. Your account deleted, which you can do from your Account page. To be taken off a list. To object to how we use your details.

You change your name, avatar and time zone, whether Google signs you in, and add or remove passkeys, on your Account page. For anything else, write to us at the address above. If you live in the EU or the UK, you can also complain to your data protection authority.

We keep your details because we can't run your lists without them. For someone an organizer adds, it's because a family asked us to include them, and they can say no.

Children

Accounts are for people 16 and older. A child can be on a list by name, with no email and no account. If we learn that someone younger has an account, we delete it.

Changes

When what we keep, or who sees it, changes, this page changes the same day and the date at the top changes. What's new lists the changes you'd notice in Geftable, and every change to the terms and the privacy page, with its day.

If we ever want to use something we already hold in a new way, we email everyone with an account before we do.