Privacy Policy

Welcome to Gift Buddy. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (giftbuddy.me).

Account and profile: - Email address and name (for account creation, sign-in and notices about your account) - Nickname, country and avatar photo (shown on your profile) - Phone number (optional; lets friends find you from their contacts) - Birthday (optional; shown on your public profile and used for birthday reminders to your followers) - Password (stored only as a one-way hash) or your Apple / Google sign-in identifier Gifts and social activity: - Gift titles, descriptions, prices, links, images, categories and fulfillment status; wishlists and their sharing settings - Thank-you messages and photos - Who you follow, who you block, and reports you submit (reason and description) Contacts (optional): - When you use "Find friends from contacts", the phone numbers from your address book are sent to our server to check which of them belong to registered users. They are used only for that check and are not stored. Contact names never leave your device. Location (optional): - Precise device location, collected only while you run the Nearby search, to match you with other users searching at the same time: within about 300 m, or up to about 10 km when both searches start within the same half minute. Technical data: - Push notification token (if you allow notifications) - Device type, operating system version, app version, IP address and request logs - Error reports (error message, stack trace, app version and your user ID) when something goes wrong in the app

- To create and manage your account and sign you in - To enable gift wishlists, sharing and gift fulfillment between users - To enable social features (following, searching users, finding friends from contacts, Nearby search) - To send emails about your account (verification codes, password reset, account deletion notices) - To send push notifications you have opted into (new followers, gift updates, birthday reminders) - To find and fix errors and keep the service secure - To review reports and enforce our Terms of Service - To comply with legal obligations

We do not sell your personal information and we do not use advertising networks. We share data only as follows: With other users: - Your public profile (nickname, name, country, avatar, and birthday if provided) and the gifts and wishlists you choose to make public or share - In Nearby search, other users searching at the same time see your profile and an approximate proximity band, never your coordinates With service providers that process data on our behalf: - Render (hosting of our servers, database and cache; Frankfurt, Germany, EU) - Cloudflare R2 (storage of avatars and gift images) - Resend (transactional email delivery) - Expo push notification service (delivery of notifications to your device; receives your push token and the notification text) - RevenueCat (subscription management; receives your app user ID and subscription status from Apple or Google) - Sentry (error monitoring; receives error details and your user ID when an error occurs on our servers) - Telegram (our team receives moderation requests, support messages and critical error alerts as messages; these include your user ID, nickname and the text you submitted) With app store platforms: - Apple and Google, for sign-in (if you use it) and for in-app subscription billing With legal authorities: - When required by law or to protect our users and the service

Where your data lives: - Our servers, database and cache run on Render in Frankfurt, Germany (European Union) - Avatars and gift images are stored on Cloudflare R2 and are served from public links - Emails are sent through Resend; push notifications through Expo How we protect it: - All connections use HTTPS - Passwords, sign-in tokens and one-time codes are stored only as cryptographic hashes - Access to user data by our team is limited by role and recorded in an audit log How long we keep it: - Account and profile data, gifts, wishlists and social connections: until you delete your account - Account deletion: a 30-day grace period starts when you request deletion (you can cancel it by signing in again); after that your account, profile, gifts, wishlists, uploaded images, relations and sessions are permanently deleted - Location from Nearby search: deleted within a few minutes after your search ends - Error reports and request logs: up to 30 days - Sign-in sessions: until you sign out, or up to 12 months - Subscription status: for as long as your subscription is active; transaction records are kept by Apple, Google and RevenueCat

Our website (giftbuddy.me) uses cookies to enhance your browsing experience: Essential Cookies: - Cookie consent preference (to remember your cookie choice) - Locale preference (to serve content in your preferred language) We do not use advertising or third-party tracking cookies. You can manage cookies through your browser settings or by using the cookie consent banner on our website. Declining non-essential cookies will not affect your ability to use the website. The Gift Buddy mobile app does not use cookies. For information about data collected by the app, see Section 2 above.

Under applicable data protection laws (including GDPR), you have the right to: - Access your personal data and receive a copy of it - Correct inaccurate data (most profile fields can be edited in the app) - Delete your account and associated data directly in the app (Profile → Delete Account) - Object to or restrict certain processing - Withdraw consent for optional features at any time: contacts, location and notifications are controlled in your device settings; Nearby search can be switched off in the app settings - Lodge a complaint with your local data protection authority To exercise these rights, contact us at app.gift.buddy@gmail.com or use the app settings. We respond within 30 days.

Our service is not intended for children under 16 (or the applicable local digital consent age). We do not knowingly collect data from children under 16 (or the applicable local digital consent age). If we learn that we have collected personal data from a child under 16 (or the applicable local digital consent age), we will delete that data promptly.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on our website and in the app. The "Last Updated" date at the top indicates when the policy was last revised.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at app.gift.buddy@gmail.com or through the app settings.