Privacy Policy

Information used by Secret Santa

Room and participant information

When a room is created or joined, the service stores the Room Code, room name, exchange settings, event date, participant display names, participant identifiers, Host status, join times, and personal archive preference. The service uses this information to operate the room across iPhone and Web.

Drawing information

The service stores drawing rounds and assignments so the exchange can work consistently across devices. A participant-scoped reveal endpoint returns only that participant’s assigned recipient. Room responses do not include the complete assignment mapping.

Credentials and security material

Each room identity uses a bearer credential. The service stores credential hashes rather than the bearer token itself. Device Linking stores a hash of the one-time link secret. Recovery Codes are shown to the participant when issued or regenerated; the service stores a salted, keyed verifier and short-lived encrypted response material rather than a plaintext Recovery Code.

Where information is stored

iPhone

The iOS app stores room-scoped identity credentials and room references in Apple Keychain. The credential items use kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly; they are intended to remain on that device and are not synchronised as a user account. The selected language is stored in UserDefaults.

Web browser

The Web app stores room-scoped credentials in browser local storage and temporary device-link processing values in session storage. Recovery Codes are not automatically stored in local storage. Clearing browser data can remove local access; Device Linking or Recovery Details can restore the same participant identity when available.

Cloudflare infrastructure

The API runs on Cloudflare Workers and stores application records in Cloudflare D1. Cloudflare may process technical request information, including IP address and request metadata, as part of operating and protecting its infrastructure. The Worker reads the connecting IP for rate limiting but does not write it to the application tables. Cloudflare’s own terms and privacy materials govern infrastructure-level processing and log retention that this application does not control.

How information is used and shared

Information is used to create and retrieve rooms, authenticate room members, manage settings and personal archive preferences, run drawings, reveal a participant’s own recipient, support Device Linking and Recovery, enforce rate limits, and prevent room-code reuse after permanent purge.

Secret Santa Exchange does not require an account, email address, phone number, advertising identifier, or participant name as a recovery credential. No analytics, advertising, or tracking SDK was found in the iOS or Web application. The service does not intentionally sell participant information or share private assignments with other participants. Cloudflare processes data as the hosting and infrastructure provider.

Deletion and retention

Room deletion

The Host can request deletion through the supported room control. Deletion closes the room and schedules its room records for permanent purge after 30 days. At purge, the service removes the room, participants, drawing rounds, assignments, credentials, recovery records, device-link sessions, and related room data. A deleted Room Code tombstone is retained to prevent accidental code reuse; this implementation does not specify a separate tombstone expiry.

Other cleanup

Expired recovery response records and rate-limit buckets are cleaned in bounded daily maintenance. Device-link sessions expire and cannot be redeemed after their expiry or attempt limit; their database cleanup is tied to room deletion rather than a separately documented timer.

Personal Archive does not delete data or change room status. Leaving a room is available only where the room rules permit it and removes that participant record through the supported API.

Your choices and security

You may choose not to create or join a room. You may remove a room through the Host deletion flow, leave where permitted, clear local browser data, or remove the app’s local Keychain data through the device’s normal controls. Clearing local data does not by itself delete server-side room records.

Keep Room Codes, bearer credentials, Device Link URLs, and Recovery Details private. Do not send them to Support. The service uses HTTPS, room-scoped authorization, hashed credentials, participant-scoped recipient access, rate limits, and generic failure responses as security controls.

Privacy questions

For privacy questions or support, contact littlelucktoday@protonmail.com.

Please do not include Room Codes, Recovery Codes, Device Link secrets, bearer credentials, participant names, or recipient assignments in an email.