Home

Privacy policy

Last updated 2026-10-27. We keep as little as possible.

What we store

• Draw data: participant names you enter, exclusion rules, budget, date, the draw result, and wishlist text participants add. Wishlists can contain personal data, for example a delivery address, so only add what your giver needs.
• Usage events: anonymous page and button events (for example "draw created") with country and device type. No names and no tracking cookies. We don't store IP addresses in our own storage.

Processor

The site runs on Cloudflare, which acts as our processor for hosting, storage and delivery. Cloudflare processes IP addresses and request data to deliver the site and protect it from abuse, under its own privacy policy and data processing terms. Data may be processed in the United States and other countries where Cloudflare operates; transfers from the EU/UK rely on Cloudflare's Standard Contractual Clauses and its Data Privacy Framework certification.

Cookies

We don't use tracking or advertising cookies. One technical cookie, _qa, is set only when our own team opens a test link (with ?_t=1) so test visits are excluded from statistics. Regular visitors never receive it.

Legal basis (GDPR)

• Draw data: to provide the service you request (contract, Art. 6(1)(b)). The organizer is responsible for having the participants' agreement to enter their names.
• Anonymous usage statistics and security: our legitimate interest in running and improving a reliable service (Art. 6(1)(f)).

Your rights

If you are in the EU, UK or a similar jurisdiction, you can ask for access, correction, deletion, restriction, or portability of your data, and object to processing. You can also complain to your data protection authority. The quickest way to delete a group is the "Delete group" button on the organizer page; a participant can clear their wishlist from their private link.

California (CCPA/CPRA)

We don't sell or share personal information, and we don't use it for cross-context behavioral advertising. California residents may request to know, correct or delete their personal information. Send requests to privacy@secretsantaname.com; we won't discriminate against you for using these rights.

Retention and deletion

Groups are deleted automatically 120 days after creation. The organizer can delete a group immediately from the organizer page. Anonymous usage statistics are kept in aggregate.

Advertising and affiliates

We may later show ads or affiliate links on guide pages, never on private reveal or organizer pages. If ads are enabled, this policy will be updated first and any consent required by law will be requested.

Children

The service isn't directed to children under 13, and we don't knowingly collect personal information from them. Children can take part in a draw run by an adult: the adult organizer enters a child's first name or nickname with the parent's consent. We don't collect any contact details for children. Please don't enter a child's full name, school or address in a wishlist. Reveal pages never show ads.

Changes

If we change this policy, we'll update the date above and describe material changes on this page.

Contact

Privacy requests: privacy@secretsantaname.com. Anything else: hello@secretsantaname.com.

Updated October 27, 2026