Privacy policy

Updated September 29, 2026

What we save

Your email, chosen display name, account ID, and the holiday plans you add: gatherings, attendance, dishes, optional recipes, activities, and wishlists. Use a nickname if you prefer. Gathering addresses are encrypted in your browser before new saves. The server stores an encrypted copy; its key stays in the invitation link and browser storage. Reopen the full invitation on a new device to read the address. Avoid placing addresses in other text fields. We do not ask for payment details, phone contacts, or device location.

How it is used and shared

We use this information to sign you in and keep your plans available across devices. Your email is not shown in member lists. Names and plans are shared with people who have a valid invitation or membership. Invite links can be forwarded, so share them carefully. Gift purchase status is hidden from the assigned wishlist owner's account.

Supabase handles sign-in; Sites and Cloudflare host the website and shared data; an email provider delivers codes. Authorized administrators and providers may access information to operate the service. The address field uses browser encryption; other planning content is not end-to-end encrypted. Older readable addresses are encrypted when the host opens the gathering with this version; until then, those older entries remain stored as before. Providers may process IP addresses and operational logs. Hollygiving stores short-lived hashed identifiers to limit sign-in abuse; expired entries are removed on the next sign-in request. There are no advertising or analytics trackers or data-sale features. Fonts are hosted locally.

Storage and your choices

Cookies keep you signed in; browser storage keeps drafts, saved invitation links, and address keys. Signing out does not clear all browser data. On shared devices, clear the site's browser data after use.

Plans and accounts currently have no automatic expiry. Leaving a gathering removes membership, not your earlier contributions. Self-service account deletion and complete data export are not yet available. For corrections, removal requests, or privacy questions, contact the site owner through the channel where you received Hollygiving, or ask your organizer to connect you. Provider logs and backups may retain older records, including addresses saved before this change.

Security

We use HTTPS, email-code sign-in, protected cookies, access checks, and sign-in attempt limits. No website can guarantee zero security incidents. Never share your sign-in code. The GPTBot block asks that crawler to stay away; it does not prevent hacking. External product links have their own privacy policies.

Hollygiving is made by Mems Designs. We will update this page when our practices change.