Privacy Policy

When you sign up we ask for your email address. That’s it. We never ask for your phone number, your real name, or your address.

When you use PresentSphere, we store the things you save: your gift profile (sizes, favorites, things to avoid), the managed profiles you create for family members, the wishlists, the hints, the dates you add to the calendar, the circles you start or join, the reservations you make, and any notes you leave on those reservations.

If you opt in, we also collect anonymous usage events: which pages you visit, which features you open, when you sign in. Each event is tied to an opaque user id, never to your email or your wishlist content. If you opt out (the default), no events leave your device.

When you sign in, your browser receives a session cookie from Supabase that proves you’re you. When you make a privacy choice, your browser receives a small first-party cookie called ps_consent_v1 that remembers it for a year. The full cookie inventory lives at /legal/cookies.

Your gift data exists so PresentSphere can do its job: keep birthdays in one place, surface wishlist ideas at the right moment, coordinate gifts inside a family circle without ruining the surprise.

Your email exists so we can sign you in, send you the reminders you asked for, and contact you if something important breaks. We never add it to a marketing list.

Anonymous usage events exist so we can see, in aggregate, which features people actually use. That tells us what to invest in and what to remove. If you’d rather not share that, the toggle in Settings → Privacy is a single click.

We share your data with four sub-processors and nobody else. Each one has a specific job and we picked them because of how they handle data, not just price.

• Supabase: stores your account, profiles, wishlists, hints, and circles. EU-hosted Postgres.
• PostHog: receives anonymous usage events when you opt in. EU cloud. We never send PII or wishlist content.
• Resend: delivers transactional email such as sign-in links, invites, reminders, and the deletion-confirmation email. EU-routed.
• Vercel: runs the website and serves the pages. Standard request logs only; no analytics piggy-backing.

We do not sell your data. We do not share it with advertisers, data brokers, social networks, or affiliate partners. There is no version of PresentSphere where your wishlist becomes someone else’s ad-targeting input.

All of your gift data lives on EU-hosted Postgres (Supabase, Frankfurt region). Anonymous usage events go to PostHog’s EU cloud (Frankfurt). Email runs through Resend’s EU routing. The website is served by Vercel; HTML and assets are cached at edge locations worldwide for speed, but those edges never see your authenticated data.

Backups follow the host’s standard schedule (daily, retained for 30 days). When you delete your account, we issue deletion calls to Supabase immediately; backups roll off naturally within that window.

You have the right to access, export, correct, and delete your data at any time, with no questions asked. The tools live in the app:

• Access & export: download a single JSON file with everything you’ve saved from Settings → Privacy. (Available next batch.)
• Correct or change: edit profiles, wishlists, dates, and reminder preferences directly from the app.
• Delete: from Settings → Account → Danger zone. We send a one-time confirmation link to your email; clicking it permanently removes your account, your managed profiles, your hints, and your reservations.
• Opt out of analytics: toggle in Settings → Privacy, effective immediately on every device.
• Object or complain: email privacy@presentsphere.com. You also have the right to lodge a complaint with your local data-protection authority.

PresentSphere does not allow accounts for anyone under 13 (or 16 where local law requires). Children appear in PresentSphere as managed profiles created and controlled by their adult guardian; they never have a sign-in. If we learn that an account belongs to a child under our age threshold, we’ll delete it.

We don’t make routine international transfers of your personal data. All primary storage and processing happens inside the EU. Vercel’s edge network may serve cached HTML from outside the EU, but that cache contains only public pages, not authenticated content.

If we change anything material (a new sub-processor, a new category of data, a meaningful change in how we use what we have), we’ll bump the version, update the published date, and re-prompt for consent where relevant. Cosmetic edits won’t trigger a re-prompt.

Email privacy@presentsphere.com for any privacy question, data-subject request, or correction. A real person reads these.