Privacy policy

DRAFT: checked against the GDPR, but not legal advice. G fills in the controller's details before launch.

Hintje is an app and website for wishlists and drawing names. We use as little data as possible. Hintje has no ads, no analytics and no tracking.

Who is responsible

CONTROLLER, to be filled in by G before launch: name; legal form; registered address; Chamber of Commerce (KvK) number (if a business); contact details.

Questions about privacy or your data: privacy@hintje.com.

What data we use

Your account. You can use Hintje without an email address: you then get an anonymous account on your device. To keep your lists or sign in on another device, you add your email address. You sign in with a code we send to that address. There are no passwords.
Names. The name you use in an event is seen by the other members of that event. Givers who arrange a gift through a link only enter a first name. Only the giver sees that first name.
Your lists. The wishes on your lists (title, description, price, shop links). These can say something about what you like.
Who gives what. When someone arranges a wish, we store it without you, the owner, being able to see it. Members of the event only see that something is taken, never by whom.
Drawing names. The participants' names, their email address if given, and who drew whom. Nobody can look at the draw, not even the organiser. You only see your own draw, through your personal link.
Interests, age group and gender (only if you turn this on). If you pick interests, an age group, your gender and a budget in the app, we only use them to choose which products to show you first. Age group and gender are both optional; other people never see them and we share them with no one. This is off by default. You can change or delete it at any time.
Age and boy/girl on a list for someone else (optional). If you make a list for someone else, such as your child, you can enter an age group and boy or girl. We only use it to choose suitable gift ideas for that list. Only the list's managers see it, we share it with no one, and you can delete it at any time. It goes when the list goes.

Data you don't give yourself: if an organiser enters your name (and possibly your email address) for a draw, or a parent manages a list for you, we receive that data from them.

You don't have to give us any data. Without an email address you can use Hintje normally; your lists then stay on your device.

Why we use that data (legal basis)

To make Hintje work (contract): your account, your lists, your events, draws and the wishes you arrange.
Email to participants in a draw (legitimate interest): if an organiser enters your email address, we send your personal link and messages about the draw. Every email says why you get it and how to remove your address.
Interests, age group and gender (consent): only if you turn this on yourself. You can withdraw your consent at any time by turning it off. That does not affect what we did before.

We make no automated decisions about you. We only use your interests, age group and gender to choose which products to show.

We do not sell data. These parties process data for us (processors):

Supabase: database, sign-in and server functions. Our database is in Frankfurt (Germany). Supabase is a US company: check the basis for any transfer outside the EU in Supabase's data processing agreement.
Cloudflare: the website. Cloudflare is a US company. The website runs as close to Frankfurt as possible, but this is not guaranteed. Transfers outside the EU rely on the EU-US Data Privacy Framework, with standard contractual clauses as a fallback.
Scaleway: sending email (France).

Apple and Google distribute the app through their stores. They are responsible for that themselves.

Shops and affiliate programmes

When you click a shop link, we send you on to the shop. With some shops we take part in an affiliate programme: see Affiliate. We send no personal data to shops or affiliate networks. We only count anonymously that a link was clicked (which link, which shop, when), without IP address, browser details or account. We keep those click counts for 13 months. After the redirect the shop or affiliate network may set its own cookies. Their own privacy policy applies to that.

Product images load directly from the shop's server. That shop therefore sees your IP address.

How long we keep data

Anonymous accounts that have not been used for 13 months are deleted.
Accounts with an email address that have not been used for 24 months are deleted. You get an email 30 days before; if you open the app or log in, your account stays.
Deleted lists, wishes and arranged gifts are permanently deleted after 30 days.
An event with its lists, arranged gifts and draw is deleted 12 months after the event's date, or 12 months after the last activity if there is no date.
Anonymous click counts on shop links are kept for 13 months.
Link previews (title, image and price of a product page) are kept for 7 days.
RETENTION of our processors' technical logs (Supabase, Cloudflare): check at launch.

Deleting your account

You can delete your account in the app. We then delete your account, your own lists with their wishes, and your memberships. Lists you manage for someone else pass to another manager if there is one; otherwise they are deleted. In a draw your name stays for the rest of the group, without email address and without a link to your account. Wishes you arranged for someone else stay arranged, but are no longer linked to you.

Your rights

You may see, correct or delete your data. You may ask us to restrict its use, object, and ask for a copy of your data to take elsewhere. If you gave consent (interests, age group and gender), you can withdraw it at any time. Send your request to privacy@hintje.com. We reply within one month.

If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit).

Cookies

We only use cookies and similar storage that Hintje needs to work:

to keep you signed in (also as an anonymous account);
to remember which wishes you arranged through a link (a random code in your browser);
to remember your first name and a link's password;
to store your language choice.

We use no cookies for analytics, advertising or tracking. Because these cookies are needed for the service you use, we don't ask for consent; you only see a short notice at the bottom of the page. You can clear cookies in your browser. You will then be signed out and can no longer undo gifts you arranged earlier in that browser.

Children

Hintje is not meant for children. A parent can manage a list for a child; the child then has no account of their own.

If you choose the age group "Under 16" in the app, we store no interests, age group, gender or budget, and you only see general gift ideas.

Changes

If we change this policy, you will see it here. Date of the last change.