Privacy Policy

1. Introduction

Welcome to Shneaky Santa (“we,” “our,” or “us”). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about our policy, or our practices with regards to your personal information, please contact us.

When you visit our website and use our services, you trust us with your personal information. In this privacy policy, we seek to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it.

2. Information We Collect

• Organizer accounts. Your email address, and your name and profile picture if you sign in with Google. If you use a password, it’s handled by our authentication provider (Supabase) and stored only as a secure hash.
• Exchange details you enter. Exchange names, budgets, dates, and the names and email addresses of the people you add. Organizers should only add people who expect to hear from the exchange.
• Wishlists. Gift ideas, links, sizes and notes that participants (or list owners) add.
• Purchases. If you buy the Pro Season Pass, Stripe gives us your email address, the amount, and whether the payment succeeded. We never receive your full card details.
• Messages to us. What you send through the contact or feedback forms.
• Usage and technical data. Pages visited and basic device information (via analytics), and IP addresses used briefly for security and rate limiting. When you click an outbound product link we record the link, the page it came from, the time, your browser’s user agent and a one-way hash of your IP address.

3. How We Use Your Information

• To run your exchanges and lists: drawing names, showing wishlists, and sending the invite, match and reminder emails an organizer asks us to send.
• To create and secure your account and sign you in.
• To process purchases, provide Pro access, and handle refunds.
• To prevent abuse (for example, rate limiting email sends).
• To answer your messages.
• To understand how the site is used so we can improve it.

We don’t sell your personal information, and we don’t send marketing emails. Participants’ email addresses are only used for the exchange they were added to.

4. Services We Use (Processors)

We share information only with the services that run the site, only as needed for them to do their job, or when required by law:

• Vercel: website hosting, and Vercel Web Analytics (privacy-friendly page-view statistics).
• Supabase: database and user authentication.
• Google: optional “Sign in with Google”, and Google Analytics (usage statistics, which uses cookies).
• Stripe: payment processing. Card details go directly to Stripe and never touch our servers.
• Resend: sending our emails (invites, matches and reminders).
• Upstash: rate limiting to prevent abuse (stores short-lived counters keyed to an account or IP address).
• Amazon Associates: when you click an Amazon product link and buy something, Amazon knows the purchase came from us so we can earn a commission. What Amazon collects is covered by Amazon’s privacy notice.

When you paste a product link into a wishlist, our server fetches that page to fill in the item name. The store sees a request from our server, not from you.

5. Cookies

We use cookies to keep you signed in. Google Analytics also sets cookies to measure visits. You can block or delete cookies in your browser; you’ll still be able to use participant links, but you’ll need to sign in again as an organizer.

6. Keeping and Deleting Your Data

We keep your data while your account or exchange exists. Deleting an exchange removes its participants, wishlists and matches. You can delete your whole account yourself at any time from your Account page; this permanently removes your account, every exchange you organize (with its people, wishlists and matches) and your own wishlists. To get a copy of or correct your information, email us at support@shneakysanta.com and we’ll take care of it. Participants who want their details removed can ask their organizer or email us directly.

We keep payment records as long as needed for accounting and tax purposes, even after an account is deleted.

7. Children

Organizer accounts are for adults. Kids can take part in a family exchange through an adult organizer, who is responsible for the details they enter.

8. Contact Us

If you have questions or comments about this policy, you may email us at support@shneakysanta.com.