Privacy Policy

What we collect

When you join the GiftABook waitlist, we collect your email address, your city, and — optionally — a list of your favorite books. When you visit the site, our servers also log your IP address for abuse-prevention purposes only. The IP address stored with your waitlist entry is automatically erased about an hour after you sign up; the rate-limiting and analytics records that remain contain only hashed IP addresses, which are kept separate from each other and never merged with your entry.

If you have an account

To take part in book exchanges you sign in with Google. For your account we keep your email address, your name and profile picture (as shared by the sign-in provider, or as you edit them), your bio, your birth year — only the year, never your full date of birth — and when you confirmed you're 18 or older. We also keep your book lists and the notes you add to them, the exchanges you RSVP to or queue for, your matches, whether you reported meeting your partner, any strikes (a confirmed no-show, or cancelling after your partner was revealed) and the notifications we send you.

Before the reveal your match sees only your book lists and notes. After the reveal they also see your name, bio and profile picture — never your email address.

Why we collect it

We use this information to gauge chapter demand in your city — so we know where to launch first — and to prevent spam and abusive signups. We do not use your data for advertising, and we do not sell it to anyone. Account data is used to run exchanges: matching you with a partner, telling you about it, and keeping meetups reliable (strikes).

Referral tracking

If you refer friends to the waitlist, we keep a private count of how many people you've referred. In plain terms: your referral count is private, visible only to you, never a public leaderboard. We do not publish rankings or compare your referral count to anyone else's.

How long we keep it

We retain your waitlist data until you self-delete your account using the emailed deletion link, or until a chapter decision is made for your city (at which point we either invite you to onboard or remove your data as part of standard housekeeping).

Match and attendance records — who you were matched with and whether you took part — are removed automatically 12 months after each exchange's meetup, together with the in-app notification that told you your match's name. The exchange itself (its name, city and date) is kept as public event information. Strikes stay on your account after the match they came from is removed; a strike an admin clears no longer counts against you but is kept as history. Everything else in your account, including strikes, is kept until you delete your account.

Deleting your data removes it from our live database straight away. We also keep nightly encrypted backups, stored in the EU, so we can recover from data loss. Older backups can still contain your data for up to 3 months after you delete it, until they expire. Nobody can read them in normal use, and we only open one to recover from a disaster. If we ever have to restore one, we delete again any data whose deletion was requested after that backup was made.

If GiftABook changes hands

GiftABook may one day be incorporated as a company, become part of a parent organization, merge with or be acquired by another organization, or be restructured in some other way. If that happens, the data described in this policy (including our encrypted backups) may be transferred to the organization that takes over running GiftABook, its legal successor.

A successor may only use your data to keep running GiftABook, for the purposes in this policy, and must keep honouring this policy, including your right to delete your data instantly. Before any transfer, we will email you to say who the successor is, and you can delete your data before it happens using the link in any email we've sent you. If a successor later wants to use your data in a materially different way, it must update this policy and tell you first, and ask for your consent where the law requires it.

Analytics

Our analytics are cookieless and self-hosted, storing only hashed IP addresses — never your raw IP, and never a persistent cookie or fingerprint tied to you as an individual. We use no analytics or advertising trackers: no Google Analytics, no tracking pixels, no ad networks. Like most websites, our pages load some fonts and images from third-party content delivery networks and providers (for example Google Fonts, and book cover or profile images from the services that host them). Those providers receive your IP address and browser details when your browser fetches those files. Our scripts and stylesheets are served from our own domain.

Your rights

You have the right to instant self-service erasure of your data at any time, via the deletion link included in every waitlist email we send you — no request needed, and no waiting on us to process it. Deleting your data removes your waitlist entry immediately.

If you have an account, your profile page has two self-service buttons:

• Download my data gives you a file with everything we hold about you: your profile, book lists and notes, RSVPs, matches (a partner appears only by the name revealed to you, never their email), notifications and strikes. It never contains anyone else's personal details.
• Delete my account asks you to confirm first, then deletes your account and personal data straight away. Any upcoming match is cancelled and your partner is told their match can't make it (not who you are). People you've already been matched with keep their own history, in which you appear only as "deleted user", and we remove your name from the in-app notification that introduced you to them (where it still reads as it was sent — e.g. not if you or the exchange were renamed since). Emails we already sent them can't be recalled.
• If you have two or more active strikes when you delete your account, we keep a one-way scrambled code of your Google sign-in (not your name, email or any other detail) and the number of strikes, for up to 12 months. If you sign up again with the same Google account within that time, the strikes apply to the new account, so the block on joining exchanges can't be avoided by deleting and re-registering. Our basis is our legitimate interest in keeping meetups reliable for other members. Staff can clear these strikes like any other, and the code is deleted once they apply or expire.

Contact

If you use our contact form, we receive the name, email address and message you type and use them only to reply. To limit spam we keep a counter against a hashed form of your IP address for about an hour.

Questions about this policy? Reach out at [email protected].