Version 1.1.0 · Effective from October 7, 2026

Givym Privacy Policy

Version 1.1.0, effective from 7 October 2026.

This policy explains what data Givym collects, why, who we share it with and what your rights are. It applies to the app (iOS and Android), the website givym.com and the public pages at list.givym.com.

Summary

• We collect only what is needed for lists, friends, groups, events and Secret Santa to work.
• We never sell your data and we do not show third-party ads.
• Whoever reserved or bought a gift stays hidden from the list owner.
• You can export your data and delete your account from within the app.
• Some links are affiliate links: Givym may earn a commission, at no extra cost to you.

1. Who controls your data

The controller of your data is Raphael Freitas, an individual in Brazil responsible for Givym. Givym is the service brand and does not identify an incorporated company.

• General contact: [email protected]
• Privacy and data protection: [email protected]
• Contact for the person responsible for privacy: [email protected]

2. Data we collect

Data you give us

The gift profile may contain health information (allergies). It is optional; by filling it in, you agree that it is shown to the people who can see your list.

When you create an account with Google and the provider supplies a photo, we use it as your initial avatar and store a copy on Givym. You can replace or remove it in settings; later sign-ins do not automatically restore it. Apple supplies your name and email when authorised, but does not supply a profile photo.

Previews may use public product-page data or an authorised store catalogue. We do not access your store account, orders, cookies or session to create a preview. Prices and conditions are informational; the applicable offer is the one displayed by the store when you buy.

Data generated by use

3. Why we use it and on what basis

We do not make automated decisions with legal or similarly significant effects about you. The Secret Santa draw is random and does not use profile data.

4. Who sees what

• Your items are seen by whoever you allow: specific friends, all friends, groups, events, or anyone with the link when you mark them as public.
• Name, avatar and slug are visible to friends, members of your groups and guests of your events. On public pages, they are visible to anyone with the link.
• Date of birth: friends see the day and month for birthday reminders; your age is shown only if you allow it.
• Reservations and purchases: by default, the list owner never sees that an item was reserved or bought. Who reserved it may be shown, hidden or visible only to the organiser, depending on the group or event settings.
• Secret Santa: only you see who you drew. Anonymous messages are visible only to the pair; the organiser cannot read them. If the organiser opens a pair, this is logged and visible to everyone.
• Dependants appear in the groups and events you add them to, and on their public page if you create one.
• E-mail and phone number are never shown to other users.

5. Who we share it with

We do not sell your data. The providers below may receive data according to the features available and used. Optional integrations receive data only when enabled; usage analytics also requires your consent:

We may also share data if required by law, to protect rights, safety or property, or in a business reorganisation (for example, when Givym comes to be operated by a company), always under this policy.

When you open a store, its browser page or app receives a visit to the product address and, where applicable, Givym’s public affiliate identifier. We do not include your name, email, friends, messages or private content in the link. The store may process technical access data under its own privacy policy.

6. International transfers

Your data is stored in Brazil. Some processors are outside your country: Hostinger is in Lithuania (European Union); Cloudflare, Resend, Sentry, Expo, Google, Apple, PostHog and RevenueCat are in the United States and may process data in other regions.

When we transfer data outside Brazil, the European Union or the United Kingdom, we use the safeguards provided by law: standard contractual clauses (ANPD, European Commission, ICO), adequacy decisions or the providers' certification under the EU-US Data Privacy Framework, as applicable. You can request a copy of the safeguards at [email protected].

7. How long we keep it

8. Your rights

Wherever you are, you can:

• access the data we hold about you;
• correct your data (most of it directly in your profile);
• export your data as JSON (Settings → Export data; we send it by e-mail);
• delete your account (Settings → Delete account);
• withdraw consent (usage analytics, newsletters, contacts) in settings or via the unsubscribe link;
• object to processing based on legitimate interest;
• complain to the data protection authority of your country.

To exercise any right not available in the app, write to [email protected]. We reply within 15 days and may ask you to confirm your identity (for example, with a code sent to the account e-mail). Exercising your rights is free.

Rights by region

Brazil (LGPD). In addition to the rights above, you may request confirmation that processing takes place, anonymisation, blocking or deletion of unnecessary data, information about who we share data with, information about the option not to consent and its consequences, and review of automated decisions. Authority: Autoridade Nacional de Proteção de Dados (ANPD), gov.br/anpd. Processing of children's and adolescents' data follows Article 14 of the LGPD.

European Union and United Kingdom (GDPR / UK GDPR). You have the rights of access, rectification, erasure, restriction of processing, data portability, objection and not to be subject to solely automated decisions, and you may withdraw consent at any time without affecting the lawfulness of earlier processing. You may complain to your national authority (for example, CNPD in Portugal, AEPD in Spain, DPC in Ireland, ICO in the United Kingdom). Our legal bases are in section 3.

United States: California (CCPA/CPRA) and states with similar laws. You have the right to know what data we collect and why, to correct, to delete, to limit the use of sensitive information and not to be discriminated against for exercising your rights. We do not sell or share personal data for behavioural advertising, and we do not use advertising identifiers, so there is no "opt-out of sale" to exercise. The categories collected in the last 12 months are those in section 2, for the purposes in section 3 and with the recipients in section 5. Requests: [email protected]. You may designate an authorised agent.

Canada (PIPEDA). You may access and correct your data and withdraw consent, and you may complain to the Office of the Privacy Commissioner.

Argentina, Mexico, Colombia, Chile, Peru and other Latin American countries. You have the rights of access, rectification, cancellation and objection (ARCO) under local law, and you may complain to your national authority (for example, AAIP in Argentina, INAI in Mexico, SIC in Colombia). In Argentina, the AAIP has the authority to handle complaints about breaches of data protection rules.

Australia (Privacy Act). You may access and correct your data and complain to the OAIC.

9. Deleting your account

You can delete your account in the app, under Settings → Delete account, without contacting support. Access ends immediately. Within 30 days we delete or anonymise your personal data, items, dependants, friendships, groups you created without other admins, and notification tokens. Reservations you made on other people's lists are kept without your identity. Backup copies are removed within 14 days after that. If you cannot access the app, write to [email protected] from the account's e-mail address. Instructions are also at givym.com/legal/delete-account.

10. Exporting your data

Under Settings → Export data, we generate a JSON file with your account, profiles, dependants, items, friends, groups, events, Secret Santa participations, reservations, notifications and preferences, and send it to the account's e-mail address.

11. Minors and dependants

• The minimum age to have an account is 13, or the higher age required by the law of your country to consent to data processing (16 in parts of the European Union). We check this using the country and date of birth at sign-up. If we discover an account belonging to someone under the permitted age, it will be deleted.
• Dependants are profiles created and managed by a responsible adult. They have no account, login or e-mail, and we never collect data directly from children. We keep only what the responsible adult enters (name, photo and date of birth) and what results from the adult's use (list items, groups and events). The responsible adult can edit or delete the dependant at any time. In Brazil, processing follows Article 14 of the LGPD and the Child and Adolescent Statute; in the United States, we follow COPPA and do not knowingly collect data from children under 13 without verifiable parental consent, which is given when the dependant profile is created.
• If you believe a child has provided us with data without authorisation, write to [email protected].

12. Affiliate links and stores

Some item links are rewritten with a Givym affiliate identifier (for example, Amazon and Mercado Livre). If you buy through one of these links, Givym may earn a commission from the store, without changing the price for you. We record the click (item, context, date and hashed IP) to measure usage. The store does not receive your name or e-mail from Givym, but may collect your data when you visit it, under its own policy.

13. Notifications and communications

• Push: optional; you control it on your device and, per type, in Settings → Notifications.
• Transactional e-mail: login codes, account notices, data exports and legal changes. It cannot be turned off while the account exists.
• Newsletters and digests: only with your consent; every e-mail has an unsubscribe link.

14. Cookies and analytics

The app does not use cookies. The website uses only strictly necessary cookies (Cloudflare security and session) and Cloudflare Web Analytics, which is cookie-free. Details in the Cookie Policy. In-app usage analytics (PostHog) works only if you turn it on, and never uses advertising identifiers.

15. Security

We use encryption in transit (TLS), short-lived login codes stored only as hashes, least-privilege access control, logging of admin actions, encrypted backups and regular dependency reviews. No system is 100% secure; if an incident affects your data, we will notify you and the competent authority within the legal deadlines (for example, 72 hours in the European Union and the United Kingdom, and within the ANPD's deadline in Brazil).

16. Changes to this policy

If we change this policy in a material way, we will notify you in the app and by e-mail at least 15 days in advance and, where required, ask for renewed acceptance. Minor adjustments take effect on publication. The current version and date are at givym.com/legal/privacy.

17. Contact

Givym (Raphael Freitas) Privacy: [email protected] General: [email protected] Website: givym.com