Last updated: January 1, 2026
This policy explains what personal data GiftHub collects when you use gifthub.gifts, why we collect it, who we share it with, and what rights you have.
GiftHub is responsible for the personal data described in this policy.
To contact us about privacy — including to exercise any of the rights in §8 — email [email protected]. We read every message.
Your email address, and — if you choose to give them — your name and phone number. We never store your password, only a cryptographic hash of it. If you sign in with Google, GitHub, or Apple, we receive your email address, name, and that provider's user ID.
We also store your language preference and your referral code.
For each device you sign in from we store:
We use this to keep you signed in, to let you see and revoke your active sessions, and to detect fraud and abuse — in particular, fake referrals.
The products you bought, the price, and your payment status. If you buy a gift card for someone else, we collect that person's email address — and for some products their phone number — so we can deliver the code to them (see §7). Some products need an extra identifier, such as a game account ID.
The date and time, the document and version you accepted, your IP address, and your browser user-agent. We keep this as proof of your agreement.
The content of your messages and any file you attach.
We keep a copy of every email we send you, including its full content, so that we can prove what was sent and diagnose delivery problems. For gift card delivery emails, that copy contains the gift card code.
When someone opens your referral link, we do not store their IP address. We record only a one-way
fingerprint calculated from their IP address and browser, which cannot be turned back into an IP
address, so we can count unique visits without identifying anyone. We set a cookie (gh_rv) on their
device for 180 days so a single visit is not counted twice.
We use no advertising or analytics trackers — no Google Analytics, no advertising pixels, no third-party profiling. We do not ask for or store your date of birth, government ID, or any identity document. We never see or store your cryptocurrency wallet's private keys.
| What for | Our legal basis |
|---|---|
| Creating and running your account, taking payment, delivering your gift card, and supporting you | Performing our contract with you |
| Preventing fraud, abuse of promotions and referrals, and money laundering; keeping the service secure | Our legitimate interest in protecting the business and our users |
| Recording that you accepted our Terms | Our legitimate interest in being able to prove agreement |
| Emailing you about your orders and account | Performing our contract with you |
| Complying with the law and responding to lawful requests | Legal obligation |
We do not use your data to make automated decisions that have legal effects for you.
We do not sell your personal data. We share it only with the following, and only as far as needed:
| Who | What they receive | Why |
|---|---|---|
| Our gift card supplier | The product ordered and an order reference — and, for products that need it, the recipient's phone number and any required account identifier. We do not send them your email address. | To obtain and issue your gift card |
| Our payment providers | An order reference and the amount. No personal data. | To create and check your cryptocurrency payment |
| Google / GitHub / Apple | Only if you choose to sign in with them. | Sign-in |
| Our email provider | Your email address and the full content of the email — which, for a delivery email, includes your gift card code. | To send you email |
| Our error-monitoring provider | If an error occurs, a technical report that may include your email address, IP address, and details of your request. | To find and fix faults |
| Law enforcement or regulators | Only what we are legally required to disclose. | Legal obligation |
The companies above are located in various countries, some outside the European Economic Area. Where we transfer personal data internationally we do so on the basis of appropriate safeguards.
We keep your account data for as long as your account exists.
We keep order records, including gift card codes, and the emails we have sent you, for as long as we need them to provide the service, resolve disputes, and meet our legal and accounting obligations.
We keep proof that you accepted our Terms for as long as the contract is relevant, and for as long afterwards as we may need it to defend a claim.
If you close your account, we delete or anonymise your personal data — except where we must keep it by law, or where we need it to defend a legal claim.
If another user buys a gift card for you, they give us your email address — and for some products your phone number — so that we can send you the code.
We use it only for that, and to reply if you contact us about it. We do not create an account for you, we do not add you to any marketing list, and we do not use your details for anything else. Our basis for this is our legitimate interest in delivering the gift that the buyer paid for. You can ask us to delete your details at any time — see §8.
Wherever you live, you can ask us to:
How to exercise these rights: email [email protected]. We handle these requests by hand and will reply within one month. We may first ask you to confirm your identity — we will not delete or hand over an account's data to someone who cannot show that it is theirs.
We may keep some data after a deletion request where the law requires it, or where we need it to defend a legal claim. If that applies, we will tell you.
If you are in the EU or the UK you also have the right to complain to your national data protection authority — though we would much rather you came to us first.
We use only cookies that are strictly necessary for your data's security.
We use no advertising, analytics, or tracking cookies.
We take the security of your personal data seriously, and we use appropriate technical and organisational measures to protect it against unauthorised access, loss, alteration, and misuse. We review those measures as the service develops.
You can see every device signed in to your account and revoke any of them at any time.
No system is perfectly secure, and we cannot promise absolute security. If a data breach happens that is likely to put you at risk, we will tell you and the relevant authority, as the law requires.
GiftHub is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us their data, contact [email protected] and we will delete it.
If we change this policy we will publish the new version here, with a new version number and date. If the change is significant, we will tell you.