Privacy Policy

Ribbon helps people make wishlists and lets their friends and family reserve gifts without doubling up. This page explains what we keep and why. It's written to be read.

What we store

• Your account: your name, email address and a hashed password (we never see or store the password itself), and an optional profile photo.
• Your wishlists: titles, descriptions, dates, and the gifts on them: names, links, photos, prices, notes.
• Gift-giver details: if you reserve a gift, we store that reservation. Guests give a name and email so they can manage their reservations.
• Messages you send us through the contact form.
• Where you came from, if you arrive through a link with campaign tags (UTM parameters): the tags, the page you landed on, and the site that referred you. Saved once, when you sign up.

Who can see it

The surprise. The owner of a list can never see which of their gifts have been reserved or purchased, or by whom. That information is stored where the owner's account cannot read it. Other gift-givers see that a gift is taken, and see a name only if the person who took it chose to show it.

Gift-giver emails are never shown to list owners or other gift-givers. People with the link to a list can see its contents. Private lists can be seen only by you.

Cookies

We set only the cookies we need. There are no advertising or analytics cookies, and nothing is shared with advertisers.

• Sign-in session keeps you signed in. It's HttpOnly and not readable by scripts.
• Guest reservation cookie remembers a guest on a list so they can manage what they reserved.

Your theme choice and the dismissal of the cookie notice are kept in your browser's local storage, not in cookies. Campaign tags are held in session storage until you sign up or close the tab.

Looking up products

When you paste a product link, our server fetches that page to read its public details (name, photo, price). We don't send anything about you to the store beyond a normal web request from our servers. Product photos are fetched and resized by our server so your visitors' browsers don't contact the store.

Who we share data with

Only the services that run Ribbon: our hosting provider, our database and sign-in provider, and an email service for messages like confirmation links. They process data on our behalf and may not use it for anything else.

Keeping and deleting your data

Delete a gift or a list and it's removed, along with any reservations on it. Delete your account from Settings and we permanently remove your profile, lists, gifts and photo. Contact messages can be deleted on request.

To ask what we hold about you, or to have something removed, use the contact form.

Changes

If this policy changes in a way that matters, we'll say so on this page and, for signed-in people, by email.