Your happy secret, explained

Privacy & Cookies

How we handle your information when you organize or join a gift exchange, and how cookies support your sign-in.

Last updated: October 26, 2026

The short version

Your organizer can enter and manage your participant details.
After a finalized draw is revealed, your assigned gift giver can see gift-related information about you.
Sign-in cookies support access to private pages. They are not advertising cookies.
Signing out or clearing cookies does not delete your account or exchange records.

Information we handle

Organizer accounts: Your email address, display name, authentication identifiers, and account information supplied when you sign up or use Google sign-in. Password authentication is handled by Supabase.
Participant details: Your name, codename where used, gender selection, age range, and the birthday or email needed for the enabled sign-in method. The gender selection includes Prefer not to say. We also store participant status, setup progress, and sign-in verification information.
Exchange and gift information: Event details, organizer notes, invitations, exclusions, draw assignments and reveal status, wishlists, and gift preferences you provide. Preferences can include likes, dislikes, colors, clothing or shoe sizes, and notes.
Authentication and technical records: Session and invitation records, hashed PINs and tokens, OTP challenge records, rate-limit information, and administrative or error records. Hosting and authentication providers may also process IP addresses, browser information, and request logs to operate and secure their services.

Please avoid adding medical details, identity documents, financial information, or other sensitive information to free-text gift notes.

Where information comes from

You may provide information directly through sign-up, participant setup, sign-in, wishlists, or preferences. Google may provide account information when you choose Google sign-in.

Your organizer may add you to an exchange and complete or update details on your behalf, including when you need assistance. Organizers should explain this use to you and have appropriate permission or authority; being an organizer does not itself prove that permission has been obtained.

A setup invitation allows participant setup only. Completing it does not sign you in or reveal a private assignment; separate authentication is required.

How we use information

Provide organizer accounts, participant access, and exchange management.
Check setup completeness, current authentication, eligibility, and exclusions before a draw can be finalized.
Generate gift assignments under the event rules, keep unrevealed assignments private, and show an authenticated participant their own match.
Share gift hints with the assigned gift giver after reveal and provide event-related notifications.
Prevent unauthorized access and abuse, investigate errors, and respond to privacy requests.

Readiness checks and draw assignment are automated event features. They apply exchange rules rather than advertising or behavioral profiling.

Who can see information

Your organizer: participant profile and contact details, access controls, and setup and sign-in readiness for their event.
You: your own participant information and gift profile after authentication, and your assignment when reveal is available.
Your assigned gift giver: the display name permitted by the event identity mode, gender selection, age range, wishlist, and gift preferences after the finalized assignment is revealed.
Service operation: ShushDraw's operator and service providers process information to run and secure the service. Provider access and processing are described below.

Participant profiles and gift preferences are not published as a public directory. The organizer interface does not provide general access to private wishlists or everyone's assignments. A codename or secret identity mode does not hide your identity from your organizer, and details you write in a wishlist may identify you.

Children and assisted participation

Age ranges include children. A parent, guardian, or appropriately authorized adult should help a child understand the exchange and the information shared with the organizer and gift giver.

If someone enters details for another person, they should explain the purposes and sharing, use only information needed for participation, and obtain permission or authority where required. Assistance is not a substitute for a valid basis to process personal information.

The application does not currently collect a separate parental or guardian authorization record or verify the assisting person's relationship to the participant. A completed setup form or successful sign-in is not proof of that authorization.

Age and birthday information receive special protection under Philippine privacy law. A privacy notice or cookie notice alone does not establish consent to process that information. Contact us before supplying details if you need help with permission, authority, or an existing record.

Cookies are small pieces of data saved in your browser. ShushDraw uses authentication cookies to keep you signed in, recognize your session, and check access to private exchange pages.

These are essential authentication and session cookies supporting the service you request when you sign in. Optional analytics, advertising, and marketing cookies serve different purposes; they are not needed to sign in.

This notice provides information. Reading it, visiting the site, or signing in is not a separate cookie-consent choice or consent to unrelated uses of personal information.

Organizer authentication — Supabase: Keeps your organizer account signed in and refreshes its authentication session. Cookie names normally begin with sb- and include an authentication-token identifier; larger values may be split across cookies. Their contents can include authentication tokens and account information, such as an account identifier and email.; The current authentication library sets a cookie lifetime of up to 400 days, which can be renewed during use. This does not guarantee access for that entire period: session expiry, sign-out, or revocation can end access sooner.; Organizer access tokens currently expire after one hour and can be refreshed. No fixed maximum session duration or inactivity timeout is currently configured. Token expiry therefore does not mean the organizer is automatically signed out after one hour.; Supabase also uses temporary sign-in verification cookies, including names ending in code-verifier and related flow identifiers, to complete sign-in and recovery flows. These are part of authentication rather than advertising.
Participant authentication — ShushDraw: shushdraw_participant holds a session token for participant access after Birthday + PIN or Email + OTP sign-in. It does not contain your birthday, PIN, or secret match.; The cookie expires with the participant session, normally 30 days after sign-in. Sign-out or revoked access can end the session sooner.; It is HttpOnly, so page scripts cannot read it; it is sent over HTTPS in production and uses SameSite=Lax protection.

You can clear or block cookies in your browser settings. Clearing authentication cookies removes that browser's stored access, but does not necessarily revoke the session on the server or sign out other devices. Use Sign out to end access through the application. Blocking cookies may prevent sign-in and access to private pages. You can still visit public pages without signing in.

This version of the application does not include an optional analytics, advertising, or marketing cookie integration. If optional tracking is introduced, we will update this notice and provide the choices required for that use. Technical service logs are separate from optional tracking cookies.

No AdSense ad script or configured affiliate tracking provider is included in this application release. If you choose to visit an external merchant through a gift link, that website may use its own cookies or tracking under its own notice.

Other services

Supabase: database storage, account authentication, and access-control infrastructure.
Vercel: hosting, application execution, and associated technical records.
Resend: email delivery for participant sign-in. The recipient email address and message, including the one-time code, are sent to the delivery provider.
Google: account authentication when you choose Google sign-in.

Providers may process information outside the Philippines and may use their own technical storage or cookies. Their privacy notices describe their practices; ShushDraw remains responsible for its own processing. This notice does not describe an active paid-plan or payment flow.

Read the privacy notices for Supabase, Vercel, Resend, and Google.

Storage and deletion

Cookie expiry, session expiry, and deletion of stored records are different. Signing out, clearing cookies, or letting an invitation or code expire does not by itself delete participant profiles, event records, gift information, or authentication history.

The application does not automatically delete all account and exchange records after an event date. Expired authentication records also require separate cleanup. Provider logs and backups have their own retention settings.

ShushDraw has not yet adopted fixed retention periods for accounts, exchanges, authentication records, or application logs. There is no promised automatic deletion deadline for those records. We will update this notice when retention periods are adopted.

Participant sign-in codes expire after 10 minutes, but an expired code's challenge record is not necessarily deleted at that time.

You can contact us to request deletion or ask about records associated with you. We review requests in light of identity verification, other participants' privacy, and applicable legal requirements; this notice does not promise immediate or complete removal from backups.

Privacy questions and requests

ShushDraw is an independently operated project. Contact the project owner at christmas.exchange.gift@protonmail.com for questions about this notice or requests concerning your personal information.

Depending on applicable law and the circumstances, your rights include being informed, access, correction, erasure or blocking, objection, and data portability. Where processing relies on consent, you may withdraw it; that can affect features which need the information. You may also raise a complaint with the National Privacy Commission.

Tell us which account or exchange your request concerns. Do not send passwords, PINs, one-time codes, invitation tokens, or private match details. We may need to verify your identity before acting on a request.