How HintDrop handles your information

1. Information we collect

We collect information you provide directly, information collected automatically when you use HintDrop, and information received from third parties where you choose to connect them to your account.

• - Account information such as your name, email address, profile details, preferences, and login details.
• - Information you add to HintDrop, including birthdays, interests, reminders, contacts, gift ideas, saved links, notes, circles, invite details, and contribution-related information.
• - Technical and usage information such as device type, browser type, IP address, pages viewed, clicks, log events, access times, and performance data.
• - Information provided by third-party sign-in providers, such as Google, if you choose to use social sign-in or contact search features.

2. How we use information

We use information we collect to operate, improve, secure, and support HintDrop.

• - Create and manage your account.
• - Authenticate users and keep accounts secure.
• - Provide core features such as hints, reminders, contacts, circles, invite flows, gift planning, and saved content.
• - Personalise your experience and show more relevant prompts, reminders, and recommendations.
• - Analyse usage, troubleshoot problems, improve performance, and develop new features.
• - Communicate with you about support, service changes, security, or product updates.
• - Send optional marketing or promotional messages where permitted by law and where you have not opted out.
• - Comply with legal obligations and enforce our terms.

3. Google sign-in and Google Contacts data

If you choose to sign in with Google, we may receive basic Google account information such as your name, email address, and profile image. We use this information to authenticate your account, create or maintain your HintDrop profile, and support the features you choose to use inside the product.

If you choose to use contact search features, we request read-only access to your Google Contacts using thecontacts.readonlyandcontacts.other.readonlyscopes. We use this Google user data only to help you find and add people you already know to HintDrop, for example by displaying matching names and email addresses so you can select a contact and send an invite.

We do not sell Google user data. We do not use Google user data for advertising, profiling, data brokering, or any unrelated purpose. We do not use raw or derived Google user data obtained through Google Workspace APIs to develop, improve, or train generalised AI or machine learning models, and we do not transfer Google user data to third-party AI services for model training.

We do not store your full Google Contacts address book on our servers or sync your entire Google Contacts account into HintDrop. Contact search results are used only in connection with the search or selection flow you initiate. If you choose to add or invite a person, we may store the limited contact details you select, such as a name or email address, as part of your HintDrop account data so the feature can work as expected.

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Phone contacts, calendars and birthday import

If you use the HintDrop app (iPhone or Android) and choose to search your phone's contacts to find and add people you know, we ask for read-only access to your phone's contacts. This is separate from Google Contacts, described above, and only applies to the app.

We use this access only to help you find and select a contact by name during that search, so you can add them to HintDrop or send an invite. We do not upload, store, or sync your entire address book to our servers. If you select a contact, we store only the limited details you chose to share, such as a name or email address, as part of your HintDrop account data.

If iOS grants HintDrop access to only some of your contacts (limited access), we search within that same limited set. You can change this access at any time in your device's Settings app.

Importing birthdays from your phone's calendar. If you choose Import, then This phone's calendar, the app asks for read-only access to your calendars. It looks for birthdays and other yearly events on your phone and shows you the list. Only the people you tick are saved to your Circle (their name and birthday). The rest of your calendar is never uploaded or stored, and HintDrop never adds to or changes your calendar.

Importing from a calendar link or file. If you paste a calendar link (for example a Google Calendar or Apple Calendar address), our server fetches that calendar once, only from Google, Apple, Microsoft or Yahoo calendar addresses, picks out the birthdays and yearly events, and sends that list back to you. We don't keep the link or the calendar. A file you attach (.ics, .csv or .vcf) is read in your browser. In both cases only the people you tick are saved. On the web, if you signed in with Google, you can also load your Google contacts' birthdays using the read-only Google Contacts access described in section 3.

Asking friends for their birthday. You can share a link that lets friends add their own birthday to your Circle without an account. A friend who uses it gives their name and birthday (day and month only), which is saved as a contact in your Circle and nowhere else. They can ask you to remove it, or email support@hintdrop.app.

5. How we share information

We may share information in the following situations:

• - With service providers who help us run HintDrop, such as hosting, infrastructure, analytics, authentication, communications, and customer support providers.
• - With other users where this is part of the product experience, such as accepted contacts, shared circles, or contribution flows that you choose to participate in.
• - If required by law, legal process, regulation, or government request.
• - To protect the rights, safety, security, and integrity of HintDrop, our users, or the public.
• - In connection with a merger, acquisition, financing, restructuring, sale of assets, or similar transaction.

The main service providers we use are: Supabase (database and sign in), Vercel (website hosting), Resend (email), Expo, Apple and Google (app updates and phone notifications), Google (Google Tag Manager and Google Analytics on the website, and Firebase Analytics in the app), and Skimlinks and the affiliate networks of the shops we link to (to track commission when you buy through our links). They handle information only on our instructions and to provide their service to us.

We do not sell your personal information in the ordinary meaning of that term. We do not sell or transfer Google user data to advertisers, data brokers, or other third parties except as necessary to provide or secure the user-facing features you request.

6. Group gifts and payments

HintDrop lets people plan a gift together and chip in (group gifts). When you take part in a group gift as an organiser or contributor, other people in that group gift can see your name, profile and whether you have paid your share. Pledge amounts may be visible to the organiser.

HintDrop does not process payments or store payment card information for group gifts. Contributions are arranged directly between members outside of the platform. We may retain group gift records, pledge amounts, and contribution data for operational, support, and record-keeping purposes.

7. Visibility and sharing choices

HintDrop is designed to help people coordinate around gifting and important moments, so some information is visible to other people. The rules are:

• - Your name, profile picture, username, bio, interests and public lists can be seen by other HintDrop members, so friends can find gift ideas.
• - Private lists and private hints are only visible to you. They never show on your profile and can't be shared by link.
• - Your birthday is only shown to people in your Circle (people you have added who added you back). Everyone else only sees your star sign.
• - Your email address, account settings and sign up details are never shown to other members. Only you and HintDrop's own systems can read them.
• - When someone taps "Dibs" on your hint, you are not told who it is.
• - People taking part in a group gift you join can see your name and whether you have paid your share.

8. Cookies and similar technologies

On the website we use a small number of strictly necessary cookies and browser storage to keep you signed in, remember your settings and remember your cookie choice. These don't need your consent.

With your consent only, we also load Google Tag Manager and Google Analytics (to understand how people use HintDrop) and Skimlinks (to earn a small commission when you buy through a link on HintDrop). You can accept or reject these in the cookie banner, and change your mind at any time with "Cookie settings" at the bottom of any page. HintDrop works the same either way. We also count page views on our own servers without cookies and without anything that identifies you.

In the phone app we use Firebase Analytics to understand which screens are used, and phone notifications if you allow them in your phone's settings. You can turn notifications off at any time in your phone's settings.

9. Browser extensions and the share button

The HintDrop browser extensions (for Chrome, Edge, Firefox and Safari) only read the current page when you click the icon. They do not run in the background or watch your browsing otherwise. When clicked, it looks for a product's title, image, and price on that page (using the same kind of structured data many shopping sites already publish for search engines) so you can save it as a hint without leaving the page.

To know which HintDrop account to save to, the extension reads your existing sign-in session from hintdrop.app if you're already signed in there in the same browser, or lets you sign in directly. That session is stored locally in your browser's own extension storage, not shared with any third party, and is used only to save hints to your account and show you which lists you can save them into.

The extension does not collect, transmit, or sell your general browsing activity, and does not read any page unless you actively click the extension to do so.

The same applies to the HintDrop option in your phone's Share menu: it only receives the link or page you choose to share, reads the product's name, picture and price from it, and saves it to the list you pick.

10. Data retention and deletion

We keep personal information for as long as reasonably necessary to provide HintDrop, maintain records, resolve disputes, enforce our agreements, and comply with legal obligations.

Google Contacts search data is not stored by us as a synced address book. If you select a contact or send an invite, we may retain the specific contact details you chose to add as part of your account data until you delete that contact, remove the related data, or delete your account, subject to any limited retention required for legal, security, fraud-prevention, or operational reasons.

If you try HintDrop without signing up (for example by adding an item on our homepage, or through a Secret Santa invite), what you add is kept on a temporary guest account. It is deleted automatically 7 days after your last visit, or 90 days after your last visit if you are taking part in a Secret Santa. If you sign up before then, it moves into your account instead.

11. Data security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, or alteration. These measures may include access controls, authenticated systems, encrypted transmission, and restrictions on who can access personal information within our systems.

No method of internet transmission or electronic storage is completely secure, so we cannot guarantee absolute security.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to certain uses of your personal information, and to withdraw consent where processing depends on consent. You may also opt out of marketing communications at any time.

We use your information to provide the service you signed up for (the contract between us), for our legitimate interests in running, securing and improving HintDrop, with your consent (for example optional cookies, marketing emails and phone notifications), and where the law requires it.

If you are unhappy with how we handle your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk.

If you connected Google to HintDrop, you can also revoke HintDrop's access from your Google account permissions settings.

To make a privacy-related request, contact us at support@hintdrop.app.

13. Children's privacy

HintDrop is not intended for children under the age of 13, or any higher minimum age required by local law to use the service independently. We do not knowingly collect personal information from children in violation of applicable law.

14. International users

HintDrop may process and store information in countries other than the one where you live. By using the service, you understand that your information may be transferred to and processed in places where data protection laws may differ from those in your jurisdiction.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version here and update the "Last updated" date above. Your continued use of HintDrop after those changes become effective means you accept the updated policy.

16. Contact us

If you have questions about this Privacy Policy or our privacy practices, contact us at support@hintdrop.app. HintDrop LTD is the data controller responsible for your personal information under this Privacy Policy.