Privacy policy

The site publisher, a private individual acting on a non-commercial basis (see the legal notice). For any question about your data: contact@gist-list.fr.

Gist only collects what the service needs:

• Your account: e-mail address, first name, language, password if you set one (only stored as an irreversible hash, never in plain text), creation and last activity dates.
• Sign-in with Google: if you choose it, Google sends us, with your consent, your Google account id, your e-mail address (verified by Google) and your first name. We receive neither your Google password, nor your contacts, nor any other data from your Google account.
• Your gift lists: titles, occasion, date, description, wishes (name, link, price, details, picture).
• Your guests' reservations: the first name and email address the guest enters, and the date. The email is only used to send them the confirmation, with a link to find or cancel their reservation. Guests need no account. The list owner never sees reservations, nor the guests' first names or emails.
• Your Secret Santas: groups, participants (first names), exclusions, draw result and your letter to Santa. Only your secret Santa reads your letter, and nobody knows anyone else's draw result, not even the organizer.
• E-mail invitations: the address entered by the organizer is only used to send the invitation; it isn't kept.
• Product links: when you paste a link, our server reads the shop's page to get the product name, picture and price.
• Technical data: IP address used temporarily to limit abuse (10 minutes at most, in memory) and the host's technical logs.

• Providing the service (account, sign-in with a password or with Google, lists, sharing, reservations, Secret Santa, reservation confirmation, draw and password reset e-mails): performance of the contract formed by the terms of use (GDPR article 6.1.b).
• Securing the service (sessions, anti-abuse limits, fraud prevention): legitimate interest (article 6.1.f).
• Letting guests reserve a gift without an account: legitimate interest of the guests and the list owner in coordinating.

Gist shows no ads, sells no data and uses no audience measurement or advertising tracking.

• Account, lists, reservations and Secret Santas: until the account or the content is deleted.
• Inactive accounts: an account without any sign-in for 3 years is deleted automatically, with all its data. An e-mail warns you 30 days before; just sign in to keep it.
• Sign-in session: 30 minutes without activity, 30 days at most.
• Password reset links: 30 minutes, single use.
• IP address for abuse limits: 10 minutes at most.
• Reservations (guest's first name and email): until they are cancelled, or the gift or the list is deleted. A reserved gift the owner removed stays until the guest cancels it or the list is deleted.

Your data is never sold. It is accessible to the publisher and its technical providers, only to run the service:

• Hosting: Infomaniak Network SA.
• E-mail delivery: Infomaniak Network SA (Suisse).
• Sign-in with Google (if you choose it): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts for this step under its own privacy policy.

Data is hosted in Switzerland, a country recognised by the European Commission as providing an adequate level of protection (adequacy decision). Should another provider process it outside the European Union, it would be with the safeguards set by the GDPR (adequacy decision or standard contractual clauses).

Other users only see what the service shows them: a shared list is visible to anyone with its secret link; the first names of a Secret Santa's participants are visible to the other participants.

Product pictures are loaded directly from the shops' sites: your browser then contacts these sites, without them knowing which list you're viewing.

Gist only uses strictly necessary cookies, which need no consent:

• gist_session: keeps you signed in (30 days at most, unreadable by scripts).
• NEXT_LOCALE: remembers your language (1 year).

Your browser also keeps, on your device only: the cancel tokens of your reservations and your guest first name and email (gist:reservations, gist:guest-name, gist:guest-email), your last activity (gist:last-activity) and the Secret Santa draws you already discovered. You can clear them in your browser settings.

You have the right to access, rectify, erase, restrict, port and object to the processing of your data.

From the “My account” page, you can download all your data (JSON file) and delete your account yourself, immediately.

For any other request, write to contact@gist-list.fr from your account's address. We answer within one month.

You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), 3 place de Fontenoy, 75007 Paris, France, or with your local authority.

Passwords hashed with a strong algorithm (scrypt), secret links stored as fingerprints, Google sign-in following the OpenID Connect standard (PKCE), protected session cookies, encrypted connections (HTTPS), protections against abuse and requests to internal addresses.

The service is meant for people aged 15 and over. Below that age, a parent's consent is required.

This policy may change with the service. The update date is shown at the top of the page; users will be notified of significant changes.