Privacy Policy

1. What we collect

When you use GiftBack, we collect the following information:

• Account info: Your display name and optional profile photo.
• Wallet address: Your BASE-compatible wallet address, used to process USDC escrow payments.
• Wishlist items: Product URLs, names, and notes you add to your wishlist so your match can choose a gift.
• Gift selections: The item you choose to send your match.
• Shipping address: Your mailing address so gifts can be delivered. We never store this beyond what's needed for fulfillment.
• Notification preferences: Whether you want email or push notifications and what kind.
• Usage data: Pages you visit, features you use, and how long you spend on the platform — to help us improve.

2. How we use it

• Match you with other participants in a gift exchange.
• Process and track gift purchases and deliveries.
• Hold and release USDC escrow payments on BASE.
• Send you notifications about your exchange status.
• Improve the platform based on how people use it.
• Detect fraud and prevent abuse.
• Comply with legal obligations.

We don't sell your data. We don't run ads. We make money through a 4% platform fee on each exchange and optional affiliate commissions on product links — not by monetizing your personal information.

3. Who we share with

We work with a small number of trusted third parties to run the platform:

• Supabase — our database and authentication provider. Your account data and wishlist items are stored here. Supabase is SOC 2 certified.
• Zinc / Amazon affiliate API — used to purchase and fulfill gifts on your behalf. Your shipping address is passed to Zinc to place orders.
• AI providers (Gemini, Claude) — used to power gift matching suggestions. We send limited profile information (interests, wishlist summaries) to these services. We do not send your wallet address, shipping address, or payment details to AI providers.
• BASE blockchain — USDC escrow transactions are recorded on a public blockchain. Wallet addresses and transaction amounts are publicly visible.
• Legal and safety: We may share data if required by law or to protect the safety of users.

4. Cookies & analytics

We use a minimal set of cookies and local storage:

• Session cookie: Keeps you logged in while you're using the app.
• Wallet preference: Remembers which wallet you connected last.
• Preference cache: Stores UI preferences like notification settings locally.

We may use basic analytics (page views, feature usage) to understand how the platform is being used. We don't use third-party ad trackers. You can see our full cookies list here.

5. Your rights

Depending on where you live, you may have the following rights:

• Access: Request a copy of the data we hold about you.
• Deletion: Ask us to delete your account and personal data.
• Export: Get your wishlist, profile info, and exchange history in a portable format.
• Correction: Update any inaccurate information.
• Opt-out: Turn off marketing emails at any time via your account settings or the unsubscribe link in any email.

These rights apply under GDPR (European users) and CCPA (California residents), among other laws. To exercise any of them, email privacy@giftback.app. We'll respond within 30 days.

Note on blockchain data: Transactions recorded on BASE are permanently public and cannot be deleted — this is a property of blockchain technology, not a policy choice.

6. Children's privacy

GiftBack is for adults only. You must be 18 or older to participate in a gift exchange or use USDC escrow. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, please email privacy@giftback.app and we will delete the account promptly.

7. Data retention

We keep your data for as long as your account is active. When you delete your account:

• Your profile, wishlist, and preferences are deleted within 30 days.
• Completed exchange records (amounts, dates, gift types) are kept for up to 7 years for financial and legal compliance purposes — but not linked to your identity after deletion.
• Blockchain transaction records cannot be removed.

8. Contact

Questions, requests, or concerns? Email us at privacy@giftback.app. We're a small team and we genuinely read every message.