Privacy
Last updated 1 October 2026.
ChristmasGiftSwap is a free tool for running a family gift exchange. It holds children’s names and the things people want for Christmas, so the short version matters: we ask for as little as the product can work with, we do not sell or share it, and there is no advertising or tracking on this site.
This page describes what the application actually does today. Where something is a limitation rather than a promise, it says so.
What you give us
Your account
Your name, your email address, and a password. The password itself is never stored — only an Argon2 hash of it, which cannot be turned back into your password. Your email address is used to sign you in, to verify the address, and to let you reset a forgotten password.
Your family
The family’s name, the display name of each person in it, who is looking after whom, any “these two should not draw each other” rules, and the email addresses of people you invite. When the draw runs we store who drew whom.
Gift profiles
An age band, an optional description, and facts you choose to add — interests, sizes, favorite things, and things you would rather not be given again. Each fact carries a visibility setting that decides who in the family can see it.
We do not ask for a date of birth. An age band is enough to suggest a sensible gift, and a birth date is a much more sensitive thing to hold.
Wishlists
The items someone adds: name, description, a link if they add one, the shop, roughly what it costs, how many, how much they want it, and any note about size or color.
Receipts
If you use the Receipt Vault: the shop, the date, what you paid, an order number, return and warranty dates, your notes — and, if you upload one, the photo or PDF itself.
Receipt files are the most sensitive thing we hold. A photograph of a till slip can show your name, a delivery address, an order number or the last four digits of a card. They are stored on our own server in a private folder that is not part of the website, under a random name that says nothing about you, and they can only be opened by you while signed in. They are never sent to any other company — no scanning service, no AI service, and nothing about them ever reaches a shop you click through to.
We do not remove hidden information that your camera puts inside a photo, such as where it was taken. Nobody but you can open the file, but if that matters to you, turn off location tagging in your camera before photographing receipts.
My Gifts and My Budget
Your private shopping records: who you are buying for, what you plan to give, the shop and link, what you planned to spend and what you actually spent, the status, the dates, and any private notes.
This is visible to you and to nobody else — not the recipient, not your family organizer, not another family member, and not a site administrator.
What we never ask for
- A date of birth. Age bands only.
- A postal address or a phone number.
- Payment details. The site is free and there is no payment system, so no card information exists anywhere in it.
- An email address or password for a child. See below.
Children and managed profiles
A child in a family exchange does not get an account. They are a name on the list with a four-digit PIN, which is stored as a hash, not as the digits. There is no email address, no password and nothing for them to remember beyond four digits.
An adult in the family — a parent or guardian — can look after a child’s gift profile and wishlist for them. The information held about a child is therefore whatever that adult chooses to enter: a display name, an age band, interests, sizes, and wishlist items.
We ask families to use first names or nicknames rather than full legal names for children. Nothing in the application requires a full name.
We describe this design plainly rather than making a legal claim about it. If you are assessing ChristmasGiftSwap against a particular regulation, this section is the factual account of what is collected; it is not legal advice and it has not been reviewed by a lawyer.
What we collect automatically
Web server logs
Like almost every website, our web server records each request: the IP address it came from, the time, the page, the result, the referring page, and the browser’s user agent string. The server keeps the most recent fourteen daily log files and deletes the rest automatically, so in practice these records go back about two weeks. They are used to keep the site running and to investigate abuse.
Application logs
The application writes a structured line for significant events — an account was created, a draw ran, a gift status changed. These lines carry counts and identifiers, never passwords, PINs, session tokens, or who drew whom; the logger refuses to emit those fields at all. They are kept for roughly ten days.
Rate limiting
To stop password guessing we count recent attempts. We store a keyed digest of the address or email address rather than the value itself, so the table records that somebody tried, without recording who or from where. The digest cannot be reversed back to an address.
Cookies
ChristmasGiftSwap sets no cookies at all until you sign in or enter a PIN, and it has no analytics, advertising or third-party cookies of any kind.
| Cookie | Purpose | Lifetime | Type |
|---|---|---|---|
cgs_session | Keeps you signed in to your account. | 30 days | First-party, strictly necessary |
cgs_p_… | Remembers that this browser entered the right PIN for one person in one exchange, so they do not retype it every visit. | 60 days | First-party, strictly necessary |
Both are HttpOnly (unreadable by scripts), Secure (sent only over HTTPS) and SameSite=Lax. Because every cookie we set is strictly necessary to provide something you asked for, there is no consent banner — there is nothing optional to consent to. Signing out deletes the session cookie.
We send email only when the product needs to: verifying your address, resetting a password, invitations you choose to send, and the reminders described below. There is no newsletter and no marketing mail. Mail is delivered through Amazon Simple Email Service, so the recipient address and the message reach Amazon Web Services in order to be sent.
Elf Reminders
We can remind you about things you have already told us: a return date running out, a warranty ending, gifts bought but not yet wrapped, gifts still marked as an idea, that your family’s draw is ready, and that somebody you can shop for has added to their wishlist. Reminders appear in the app, and by email unless you say otherwise.
Only you can see your reminders. Not other family members, not a family organizer, not a site administrator. They are made from your own tracker and your own receipts, and they are as private as those are.
A reminder never says who drew whom. “Your Christmas draw is ready” is the same sentence for everybody in the family, and a wishlist reminder says only that somebody added to their list — never what they added, and never who has claimed it.
Reminder email carries no shopping links, no offers and no advertising, and reminders are only emailed between 8am and 9pm in your timezone. You can turn any category off, in the app or by email or both, and one button turns off every reminder email at once — on the Elf Reminders page once you are signed in.
Turning off reminder email does not stop the mail you asked for: password resets, address confirmations and family invitations keep working.
Your timezone. You can tell us which timezone you are in, and we use it for one thing: deciding which day a reminder counts from and whether it is a reasonable hour to send it. If you do not choose one we assume US Eastern. You can clear it again at any time.
We do not send text messages or push notifications. There is no code in this product that can.
Shopping links
Some gift suggestions link to shops, and some of those links may earn us a commission — that is what pays for the site. Full detail is on the affiliate disclosure page.
A shopping link carries nothing about you. It contains the product or search address and, when the link is one that earns a commission, our own tracking code. It does not contain your name, your account, your family, who you are shopping for, their age, their interests, your budget, or anything from your wishlists or private notes. Two different people looking at the same gift get exactly the same link.
When you click one, your browser goes to the shop directly. The shop will see the request the way it sees any visitor — including your IP address and the fact that you came from this site — and its own privacy policy applies from that point.
How we measure clicks
We count which gift suggestions people find useful. The record is: which gift, which shop, which part of the site, whether the link was a commission link, and when. There is no identifier for you, your family or the person you are shopping for, and the endpoint that receives it discards any other field it is sent.
Who else is involved
| Service | Why | What can reach them |
|---|---|---|
| Hostinger | The server the site and its database run on. | Everything, as the infrastructure it is stored on. |
| Amazon Web Services (SES) | Sending transactional email. | The recipient address and the contents of that email. |
| Amazon.com | Shopping links, as an Amazon Associate. | Only what your own browser sends when you choose to click a link. We send Amazon nothing about you. |
| Let’s Encrypt | The HTTPS certificate. | Nothing about you — the domain name only. |
| Our domain registrar | DNS, and forwarding mail sent to this domain. | Mail you send to an address at this domain. |
The database is on the same server as the application. It is not hosted by a third-party database provider, and it is not shared with any other product.
We do not sell your information, and we do not share it for advertising. There is no advertising network, analytics service or tracking pixel on this site.
How long we keep things
- Your account, family, wishlists, tracker and budgets are kept until you ask us to delete them. Previous years are kept deliberately, so the draw can avoid repeats and you can look back at what you gave.
- Receipts and their files: kept until you delete them or delete your account. Deleting a receipt removes the file from our server straight away.
- Reminders and your reminder settings: kept until you delete your account. Dismissing a reminder hides it from your list.
- Web server logs: about two weeks (fourteen daily files).
- Application logs: about 10 days.
- Rate-limit records: short-lived, and hold no readable address.
- Backups: encrypted backups are kept for up to 35 days, so deleted information — including receipt files — can persist in a backup for that long before ageing out. We would rather say that than promise an immediate erasure we cannot deliver.
What you can do
Everything here is in Account and privacy, once you are signed in.
Download your data
Ask for a JSON file containing what we hold that belongs to you: your account, your families, your own gift profile and wishlist, your private gift tracker and budgets, your reminders and reminder settings, and the profiles of any children you look after. The file is generated when you ask for it, sent straight to you, and stored nowhere — there is no download link left behind and nothing is emailed.
Receipts appear with their details — shop, amount, dates, order number — but the uploaded photos and PDFs are not inside the file; download those individually from the Receipt Vault.
It deliberately excludes other people’s lists, trackers, budgets and profile facts even where you can see them in the app, never says who reserved a gift, and will not tell you who was assigned to buy for you. That last one stays secret; an export must not be the way around it.
Delete your account
You can delete your account yourself. We remove your name, email address and password, every session, your gift profile and wishlist, your entire private gift tracker, budgets and notes, your reminders and reminder settings, and every receipt you saved — including the files, which are erased from our server. Any gift you had claimed on somebody else’s wishlist is released, so your family can see it still needs buying.
Two things deliberately remain, because they are not only yours: your name stays on past Secret Santa draws — an exchange other people took part in would stop making sense without it, though it is no longer connected to any account — and a relative’s private note that they bought you something stays in their tracker, because it is their record.
Sometimes we will ask you to sort something out first: if you are the only organizer of a family, the only adult looking after a child’s profile, the only site administrator, or you are in the middle of an exchange that has already been drawn. You are told exactly which of these applies before you confirm anything, because deleting an account halfway through is not something that can be undone.
Leave a family
You can leave a family without deleting your account. Your private tracker and budget are unaffected.
Smaller changes
- Edit or remove any gift profile fact, and change who can see it.
- Remove wishlist items.
- Archive tracked gifts and recipients, and change or clear a budget.
- Remove a person from a family.
- Choose which reminders you get, and turn off reminder email entirely.
- Set or clear your timezone.
- Sign out, which deletes the session cookie.
If you would rather we did it, or you want a correction, email hello@christmasgiftswap.com from the address on the account.
Security
Passwords are stored as Argon2 hashes and PINs as hashes; neither is recoverable. Traffic is encrypted with HTTPS. Session and PIN cookies are HttpOnly and Secure. The database is reachable only from the server itself, and the account the application uses cannot alter the shape of the database. Private pages check who is asking as part of the database query itself, rather than fetching a record and then deciding — so a record belonging to someone else is never loaded in the first place. Backups are encrypted before they leave the server.
No system is completely secure, and we will not tell you otherwise. What we can say is that the measures above are in place and that we designed the private parts of this product — assignments, reservations, the gift tracker — so that the people who should not see them cannot, including us in the ordinary course of running the site.
Changes
If this policy changes we will update the date at the top. If a change materially affects what we collect or who can see it, we will say so on the site rather than rely on you rereading this page.
Contact
For anything on this page — a deletion request, a copy of your information, a correction, or a question about the shopping links — email hello@christmasgiftswap.com.