Last updated: October 25, 2026
Gyftly is operated by Limelight Software SRL, the controller responsible for the personal information described in this policy. You can contact us at [email protected].
This policy covers the Gyftly website and our mobile apps, including Android and iOS where available. The same account and gift-list information supports the service across these platforms. Device features depend on the app and operating system.
This policy explains our handling of personal information. Reading it or using Gyftly does not, by itself, give consent to every use of your information or to nonessential cookies.
When you create or use an account, we process your email address, first and last name, sign-in method, profile image, country, language, timezone, account status, and creation and update dates. For email-and-password accounts, we receive your password to authenticate you and store a password hash. We also process confirmation, password-recovery, and sign-in verification information.
If you choose Google, Facebook, or Apple sign-in, we receive the identity information and verification credentials needed for that sign-in. Depending on the provider, this includes your email address, name, profile image, and provider identifier. Apple sign-in requires sharing your email address: we reject sign-in attempts using Apple's Hide My Email private relay addresses. Choose Share My Email with Apple or use another sign-in method. The provider does not give us your Google, Facebook, or Apple password. We may download and store a provider profile image or generate an initials image for a local account.
We use the email address supplied through sign-in to find an existing Gyftly account. Choosing a different sign-in provider with a matching email address can therefore give you access to the same account and its lists. Signing in can also update profile information supplied by the provider, such as your name or profile image. A different accepted email address can result in a separate account; Gyftly does not automatically merge accounts simply because they belong to the same person.
An email address and the information required by the selected sign-in method are necessary to establish an account. Local registration also requires first and last names and a country. Without the required information, we cannot complete registration. Language and timezone information help us display the service and schedule events and reminders.
We also store your confirmation of the Privacy Policy and Terms, your confirmation that you meet the account age requirement, and your analytics preference. These confirmations are required before continuing to account features after sign-in if they have not already been recorded. The age confirmation is a declaration, not independent age verification. The analytics choice is optional and can be changed in Settings.
We store list names and icons; the recipient's name, birthday, gender, and derived age; event and closing dates; timezone; guest-viewing and gift-addition settings; and the account that created the list. This may include information about someone who does not have a Gyftly account, including a child.
For gifts, we process product links, titles, prices, currencies, store names, image links, downloaded images, creation dates, and the users who added or agreed to handle each gift. Required list and gift fields must be supplied to save the corresponding entry.
We also store contribution amounts and currencies, contribution changes, reported transfers, receipt or settlement confirmations, related dates, and reminder activity. These are coordination records supplied by users, rather than bank-verified payment records.
We store list-chat messages, links and mentions within them, sender identities, message dates, and read positions. We also record lists you recently accessed and activity needed to display contributions, gift handling, unread messages, and notifications. Lists visited as a guest can be remembered in your session and added to your recent lists after sign-in.
When you submit a report, we store its reason, optional explanation, report reference and time, and an evidence snapshot. Depending on the report, this includes account IDs, names and email addresses; relevant lists, gifts, messages, recorded visits and participation; and contribution amounts, status and original recipients. The report is sent to our support address through our email providers. The evidence sent to support excludes account password, authentication/session/push token fields. Free-text messages and explanations remain part of the evidence. Reports and private contribution archives are available to support, not other users.
Reporting another user's gift can hide it for every viewer when that gift was not added by the list owner. Blocking a user prevents that account from accessing any of your existing or future lists, hides their gifts and activity in your lists, and requires everyone to sign in to view your lists even if anonymous viewing was enabled. Affected contributions without either a sent or received confirmation are cancelled. Sent or received records are removed from normal activity and balances and preserved privately for support with their original recipient; handling assignments are released. These changes do not reverse external payments or erase independent obligations. Contact support about unblocking or archived records. Account deletion also removes associated moderation evidence and archives from the application; support handles report emails under the deletion and limited-retention process below.
We process IP addresses, browser and user-agent information, sign-in and session records, request dates, and diagnostics used to operate and protect the service. Product-import records can include your account, requested URL, IP address and a derived IP identifier, outcome, document size, processing time, and extraction-quality information.
We use an IP-based lookup against a local database to estimate location, such as country, region, city, and timezone, and to suggest a currency or country. This is approximate network-location information, rather than GPS location. Your browser or app can separately supply its timezone.
For notifications, we store preferences, reminder timing, list mutes, app installation identifiers, push tokens, permission state, account/session associations, notification content and recipients, and delivery information. The Android app also keeps push-registration and language information in local app storage. A push token can be obtained and registered before permission to display notifications is granted; display permission controls whether notifications can be shown.
If you contact us, we also receive the information you include in your message and our correspondence with you.
We use information for the following purposes:
Where we rely on consent for a particular activity, you have the right to withdraw that consent. Choosing an optional feature or accepting our Terms does not supply blanket consent for unrelated processing.
Gift suggestions use a product catalogue and recipient age and gender information. They are recommendations for you to review. Gyftly does not make solely automated decisions about you that produce legal or similarly significant effects.
Lists are accessed through their links. If the owner enables anonymous viewing, someone with the link can view the list without signing in. If anonymous viewing is disabled, visitors must sign in to view the list, although the login notice can still show its title. Requiring sign-in does not restrict the list to individually approved invitees. Someone who receives a link can forward it.
People who can view a list can see its displayed gift and event information, participant names and images, who added or handles gifts, contributor identities and activity, and aggregate contribution progress. The list page displays individual contribution amounts to the owner. Amounts and payment-status details can also appear in balances and notifications sent to relevant users. Signed-in users with the list link can access its chat.
Signed-in users with your profile link can see your name, profile image, and last-contribution activity. If you have blocked someone, their last-contribution activity is hidden when you view their profile. On the profile page, your email address and country are shown only to you when signed in to your own account. Other visitors see a private-profile notice in place of these details. Your name and image can also appear on lists visible to guests.
If you share contact or payment details yourself in chat, list content, or external messages, their visibility follows that sharing.
When you share a list through another app or service, that service and the recipients receive the message and link you share. Link-preview services may also receive and display page metadata, such as a list title, event information, or preview image. Other people may copy or keep information they have already received.
When you import a product in the Android app, it can load the selected product page in a separate browsing view on your device, capture its rendered HTML, and upload that HTML to Gyftly to extract gift details. The captured document can contain information included by the merchant's page beyond the product title and price. Loading it also makes requests to the merchant and resources used by that page, which can receive your IP address and browser information and use their own storage.
We store your device gift import preference with your account. In Settings → Other, “Import gift data using the device” is enabled by default when no preference has been saved. Change the switch and select “Save settings” to save your choice. This setting only applies to imports in the Android and iOS apps where the feature is supported; the saved choice applies when the gift-list page is next loaded.
When disabled, this import flow skips loading the merchant page on your device and uploading captured HTML, and uses Gyftly's server-side extractor directly. This can reduce the information sent from your device to the merchant and the page's resource providers during import, but it does not stop server-side processing or requests you make by opening a product link yourself. The product URL, import diagnostics, extracted information, and gift details or images you save can still be processed. Importing titles, prices, currencies, or images may be less complete or unsuccessful for some stores.
This capture is limited to the page selected for import and the document reached through its navigation or redirects. The import feature does not give Gyftly general access to your browsing history or to unrelated pages open in other apps.
Uploaded HTML is processed temporarily, including request-upload handling, and is not retained as a saved document. This does not mean that all information connected with an import disappears: the URL, import diagnostics, extracted information, and gift details or images you save are handled separately. Gyftly can also fetch a product page through its server-side extractor, including when device-side capture is unavailable or unsuccessful. Gyftly's server-side HTML cache has a configured lifetime of one hour.
The app restricts the capture view and uses separate browsing storage where supported, but merchant cookies and storage are not guaranteed to be cleared on every device. Use public product pages and avoid links containing private account, order, or access information. Review the imported details before saving a gift.
Equivalent import features in an iOS app, where available, are covered by this policy; platform-specific browsing and permission behavior may differ.
Gyftly sends service messages about account creation and confirmation, password recovery and changes, list and gift activity, chat and mentions, event and closing reminders, contributions, reported transfers, and settlement confirmations. Email and push availability and defaults differ by notification type.
You can change optional email and push preferences and reminder timing in Settings. Required account emails, including confirmation, recovery, and password-change messages, cannot be disabled. Muting a list suppresses certain list-activity notifications; it does not suppress every message about your account, mentions, handling changes that affect you directly, or contributions and transfers.
Push display also depends on the app, operating-system permission, and device notification settings. You can use those settings to disable display. Signing out revokes the session's push association; it does not delete your account or every device-registration record.
Emails and notification previews can contain names, list and gift details, amounts, and activity information. Their visibility on your device depends on your device settings and who has access to it or your email account.
We use browser cookies and local storage for these purposes:
GYFTLYSESS cookie keeps you signed in and maintains security and navigation information across requests. Its configured cookie lifetime is 14 days. This browser-cookie lifetime is separate from the retention of account or activity records on the server.gyftly_language cookie remembers a language you select, with a configured lifetime of one year from when it is set.__Secure-gyftly_apple_callback cookie temporarily maintains continuity when the sign-in callback returns to Gyftly. It is set for up to ten minutes and is cleared when the callback is handled.gyftlyPendingImport:<list-hash> hold the selected product URL, import-attempt identifier, and timestamp so an interrupted app import can resume. The application accepts an entry for resumption for 30 minutes and removes it when the import flow clears it or when a subsequent check finds it expired. Local storage does not automatically disappear at the 30-minute mark; an entry can remain until the application checks or clears it, or you clear the site's storage.The first-party cookies support Gyftly's own features; they are not affiliate cookies. They can be replaced or cleared before their configured expiry, and browser or device settings can shorten their lifetime. Cookie expiry or removal does not itself delete your account, saved lists, or contribution records.
Signed-in users can choose whether to allow Google Analytics during the required confirmation step and can change that choice in Settings by saving the Analytics switch. Analytics is enabled by default when no preference has been saved, and the confirmation step initially reflects that setting. When disabled for your signed-in session, Gyftly does not load its Google Analytics script on subsequent page loads. The preference is stored with your account and applied when you sign in; it does not control signed-out visits or other browsers that are not signed in to your account. Pages using the shared layout still load Analytics for signed-out visitors. Disabling Analytics does not remove cookies already stored or data previously sent to Google.
The page information Gyftly configures for Analytics uses a general route and page title instead of account names, list hashes, or query strings, and sends an empty page-referrer value. Google Signals and advertising-personalization signals are disabled in that configuration. These limits do not make all Analytics data anonymous: Google can still receive identifiers, cookies, and technical request information.
The account preference is separate from accepting the Terms or confirming your age. You can block or remove cookies through browser settings and use Google's Analytics opt-out browser add-on, where supported. These external controls may not be available in every browser or app. Blocking cookies or clearing site storage can sign you out, reset preferences, or interrupt imports; browser controls are not a Gyftly consent mechanism.
Gyftly does not participate in affiliate programs.
We do not sell personal or sensitive user data. The disclosures described in this policy support the service, sharing you request, and lawful purposes explained here; accepting our Terms does not authorize unrelated uses or disclosures.
The following services receive information when their features or resources are used:
We also disclose information where required by law, in response to valid legal requests, or where necessary and lawful to protect people, investigate misuse, or handle legal claims. The purpose and information involved determine whether an external service acts on our behalf or handles information for its own purposes.
Account and collaboration information remains available to support the service while the account and corresponding records are maintained. We assess retention by the purpose of the information, whether it is still needed for the requested features, and any applicable legal requirement or need to handle a claim. Closing a list, signing out, or uninstalling the app does not automatically erase its server-side information.
Ordinary gift editing and removal also affect shared records. When an authorized user deletes a gift, its associated contribution records are deleted, including any unsettled contributions. Changing a gift's currency clears its existing contribution records. These actions are separate from account deletion and do not settle or reverse payments outside Gyftly. Keep independent records of payments and agreements you need to retain.
Account and data deletion: To request deletion of your Gyftly account and associated data, email [email protected] with the subject "Delete my Gyftly account" and identify the email address used for your account. You can make this request without signing in or reinstalling the app. Do not send your password.
This is handled by us rather than through a self-service account-deletion button. We may ask for information reasonably necessary to verify that the request concerns you. The response periods in the privacy rights section below also apply to these requests.
Requesting account deletion is separate from ordinary list deletion. Unsettled contributions do not prevent you from requesting account deletion, and signing out, uninstalling the app, or disabling an account is not a substitute for deleting it and its associated data.
The account-deletion process removes associated account records and profile files, owned lists, gifts you added, contributions, messages you sent, recent-list associations, and associated session, notification, and import records. It can therefore remove shared information from other people's lists, remove contributions by other people to your lists or gifts, and release gift-handling assignments.
Other users' content may contain references to you that are not identified by the account-deletion process, such as your name in someone else's message. Tell us about such information so we can assess and address it as part of your request. Independent copies held by other users or merchants are outside our direct control; this does not exempt information held by service providers acting on our behalf. Where those providers hold associated personal data for us, we request its deletion as part of handling your request.
If specific information must be retained for security, fraud prevention, compliance with a legal obligation, or establishing, exercising, or defending legal claims, we limit retention to the information and period necessary for that purpose. We explain any such retention and the applicable period or criteria when responding to your request, unless the law prevents us from doing so. Removing a financial coordination record does not cancel an obligation or transfer made outside Gyftly.
Subject to the conditions in applicable data-protection law, you can ask us to:
You can also withdraw consent where processing relies on it, without affecting processing lawfully carried out before withdrawal. Some rights have exceptions, and we will explain our decision if we cannot fulfil a request. You can edit available account fields yourself; other requests can be sent to [email protected], including requests about recipient information supplied by someone else.
We respond without undue delay and normally within one month of receiving a request. Where the law permits an extension because of the complexity or number of requests, we will explain the reasons within that month; the extension can be up to two further months. Requests are normally free of charge. We may request proportionate identity-verification information and apply only the exceptions or charges permitted by law.
Gyftly accounts are intended for people aged 18 and over. This is an account-eligibility rule, rather than a claim that we verify every user's age. Adults can organize gifts for children, so the service may contain a child's name, birthday, gender, and gift information supplied by an adult.
If you enter information about another person, use only information you are entitled to share, respect their privacy, and make them or their parent or guardian aware of its use where appropriate. Avoid adding sensitive or unnecessary information to lists or chat. This does not remove our responsibility for how Gyftly processes that information.
If you believe a child has an account, or you are concerned about information about you or a child on Gyftly, contact [email protected] so we can assess the matter and any correction, restriction, or deletion request.
The Android app uses HTTPS for connections to Gyftly, including sign-in, product-page HTML uploads, and push registration. We use account authentication, password hashing for local accounts, access checks, request restrictions, and other measures to protect the service. No online service or method of storage can guarantee absolute security. Shared lists and chat are not end-to-end encrypted communications. Protect your credentials, check who can access your devices and email, and consider the visibility described above before sharing information.
We publish revisions to this policy on this page and update the date above. Where a change requires a separate notice or consent under applicable law, that requirement still applies. A revised policy does not itself authorize a new use of information that requires consent.
For privacy questions or requests, email [email protected] or write us at Sos. Mihai Bravu 204, bl. 105, 030316 Bucharest, Romania attn Limelight Software SRL.