Privacy

Who is responsible

The controller for this service is TinyHint (hello@tinyhint.com).

What we store when you create a hint request

The nickname you give the recipient, your relationship, the occasion and its date, your budget range, interests you picked, an optional note, the ideas and questions you chose, and your settings (surprise, anonymous, your first name). We don't ask for your email or any account.

Access works through a private link that only you have. We store a fingerprint (hash) of that link, not the link itself.

What we store when someone answers

The areas they picked, their answers, their reactions to ideas, optional notes and an optional name. The person you sent the link to isn't asked to sign up and we don't collect their email or contact details.

We process the recipient's answers on the basis of legitimate interest (Art. 6(1)(f) GDPR): helping someone choose a gift they'll actually like. Every answer page explains this and offers a one-tap way to delete the answers.

Secret Santa draws

When you run a Secret Santa draw we store the participants' first names, who gives to whom, the optional group name, budget and date, and any wishes participants write for their Santa. If the organizer adds a note for the group, every participant sees it on their link, and it's deleted with the draw. The organizer only gets the private links, never the pairs. The draw is deleted 30 days after the exchange date (or 90 days after it was created if there's no date), and the organizer can delete it at any time.

If a participant sends their giftee a few questions from their page, we store the questions and the giftee's answers with the draw and delete them together; the giftee never sees who asked.

Keeping TinyHint safe

To prevent abuse, we briefly count how often a network uses the service. We don't keep network addresses, and these counts are deleted after two days.

Counting visits

When a page opens, we count the visit together with the page, the country, the type of device and browser, and the website or campaign link that brought you. This count contains nothing that identifies you and nothing is stored on your device. We rely on our legitimate interest (Art. 6(1)(f) GDPR) in knowing how many people use TinyHint. Creating a hint request, sharing it and answering are also counted, because they're part of running the service.

On our public pages — never on a private link page — we also load Cloudflare Web Analytics to tell real visitors from automated traffic. It counts page views without cookies and without storing or reading anything on your device. It receives the address of the public page you opened, your approximate location and your browser type; it cannot follow you to other websites. If you decline analytics, or your browser sends Global Privacy Control, we don't load it at all.

Analytics, only with your consent

If you allow analytics, we also learn how TinyHint is used during your visit, such as which pages you open and which buttons you press, and your browser remembers for 30 days how you first found us. We use this only to improve TinyHint, never for advertising and never to follow you on other websites. Our legal basis is your consent (Art. 6(1)(a) GDPR and § 25 TDDDG).

You decide in the banner when you first visit, and you can change your choice at any time with “Analytics settings” at the bottom of every page or with the switch below. If your browser sends a Global Privacy Control signal, analytics stays off.

Cookies and local storage

We set one functional cookie only when you switch language, to remember your choice. Your browser's local storage keeps the list of hint requests you created on this device, your analytics choice, the language you declined if you close our language suggestion, and, for recipients, a private key that lets them change or delete their own answers. Only if you allow analytics does it also keep the analytics details described above. You can clear all of this at any time by deleting this site's data in your browser. Nothing is used for advertising or cross-site tracking.

How long we keep it

Hint requests and all answers are deleted automatically 90 days after the occasion date (or 90 days after creation if there's no date). You can delete a hint request at any time from its private page; recipients can delete their answers at any time from the answer page.

Visit and analytics data is kept for up to 13 months and only in anonymous form.

Service providers

Hosting: Vercel Inc.; our server functions run in Frankfurt, Germany. Database: Neon (Databricks), hosted in Frankfurt, Germany. Visit counting on public pages: Cloudflare, Inc. (Cloudflare Web Analytics), which is also our domain registrar and DNS provider. All three process data on our behalf under data processing agreements; where data leaves the EU (for example through Vercel's global network or support access), this happens under the EU–US Data Privacy Framework or standard contractual clauses.

Your rights

You can ask for access to, correction or deletion of your data, restrict or object to processing, and lodge a complaint with a data protection authority. Because we don't know who you are, the quickest way is to use the delete buttons; otherwise write to us and include the relevant link. You can withdraw your analytics consent at any time with “Analytics settings”; this doesn't affect anything done before.

Children

TinyHint isn't meant for recipients under 13, and the wizard doesn't let you send a survey to a child.