Privacy Policy

1. Who we are

The Gift64 service is operated by Gift64 Inc., a corporation incorporated in Ontario under the Business Corporations Act, with its registered office at 120 East Beaver Creek Road, Unit 200, Richmond Hill, Ontario L4B 4V1, Canada. For the purposes of Canadian privacy law (PIPEDA), Quebec’s private-sector privacy law (Law 25), the EU and UK GDPR, and the California CCPA/CPRA, Gift64 Inc. is the organization responsible for (the “controller” of) personal information processed through the Service.

Our Privacy Officer is the person accountable for how we protect personal information. You can reach them at [email protected] or by mail at the address above.

In short: we do not sell your personal information, we do not use your device’s advertising ID, we do not share your data with outside advertising networks, and you can delete your account at any time.

2. Information we collect

2.1 Account information

When you create an account we collect your email address, a password (which we store only as a salted hash — we never see the cleartext), the username and display name you choose, and an optional profile avatar. If you turn on two-factor authentication we store the authenticator secret and backup codes needed to check your codes. At sign-up you confirm that you are 13 or older.

2.2 Sign-in provider profile data

You can sign in with a third-party provider instead of using a password. When you do, the provider sends us a limited set of profile fields. We use this only to create or sign you into your account and to fill in your profile.

2.3 Phone number (Twilio SMS verification)

When you verify a phone number, we send your number to Twilio, which delivers a one-time verification code to your phone via SMS. We store the phone number on your account so we can re-verify or contact you about account-security events. We do not use phone numbers for marketing, and we do not sell or share them with advertisers. Twilio acts as our service provider under their Privacy Notice.

2.4 Email (SendGrid transactional mail)

Transactional email — password resets, verification emails, gift card receipts, gift card transfer notices, and important account notices — is sent through Twilio SendGrid. SendGrid processes your email address and the message contents on our behalf. See SendGrid’s Privacy Notice.

2.5 Your profile and community content

We collect what you choose to add or post: your bio, pronouns, birthday, links to your social profiles, the people you follow and who follow you, the people you block, posts and comments, giveaway chat messages, giveaways you host, and reports you send us. If you use direct messages, we store the messages, photos, GIFs, gift cards, and links you send so we can deliver them to the people in the conversation. When you search for a GIF, your search words are sent to our GIF provider. When a message contains a link, our servers fetch that page to build a preview and check the link against lists of unsafe sites.

2.6 Giveaways, points, and activity

We record the giveaways you enter, host, and win, the points, levels, streaks, and achievements you earn, the deals you claim, the shops and sponsors you follow, referral or invite codes you used or shared, and how you use the Service (such as the screens you visit and when).

2.7 Gift cards and your wallet

We keep a record of the gift cards you buy, receive, win, transfer, give back to the community, and redeem: the shop, amounts, balances, dates, transfer codes, the accounts a card moved between, the location or terminal where it was redeemed, and your receipts. The shop that issued a card can see the redemptions made at that shop and the information needed to honour the card and handle refunds or disputes.

2.8 Payments

Gift card purchases and other payments are processed by Stripe. Card numbers, CVCs, and bank details are entered directly into Stripe’s forms or payment sheet and never touch our servers. We receive a Stripe customer and payment reference, the amount, the payment status, and any partner code you arrived with. If you receive payouts from us (for example as a shop or an ambassador), Stripe collects the identity and bank details it needs to pay you; we receive your payout status, not those documents.

2.9 Location data

To show you nearby giveaways, deals, and shops, to check that you are eligible for a giveaway limited to an area, to confirm you are at the shop when you pay with a gift card, and to understand and improve how the service is used across regions, we collect location while you use the Service:

• Precise location (you opt in). If you grant the location permission in your browser or in our app, your device’s latitude and longitude are used for the purposes above and are recorded against your account. You see a permission prompt first, and you can revoke it at any time in your browser or device settings. We collect location only while you are using the Service, never in the background. These coordinates may also be sent to the Google Maps Geocoding API to label them with a city, region, and country.
• Approximate location (from your IP). If you have not granted precise location, we derive a coarse, roughly city-level position from your IP address using a geolocation database, so we can still understand regional usage. We do not capture precise GPS for anyone who has declined the permission.

We use this for personalization, product analytics, and safety and abuse detection, and to give shops aggregated, anonymized insights (for example, how many people visited an area) — never individual tracking. We keep location tied to your account for at most 90 days; after that it is permanently anonymized — your identifier and IP are removed and the coordinates are coarsened — so only aggregate density remains (“how many people were in an area,” never who). We never sell your location and never reveal who an individual is. You can request deletion of your data at any time (see section 12).

2.10 Mobile app and device data

When you use our Android or iOS app, or sign in on the web, we collect:

• Device details: device make and model, operating system and version, app version, language, time zone, screen size, an installation identifier we generate for the app, and the list of devices and sessions signed in to your account. You can review and sign out sessions in your account settings.
• Integrity signals: whether the app appears to be running on an emulator or a modified (rooted) device. We use this only to protect giveaways and gift cards from abuse.
• Push notification token: if you allow notifications, a token from Firebase Cloud Messaging (Android) or the Apple Push Notification service (iOS) so we can reach your device.
• Crash and diagnostic data: when the app crashes, Firebase Crashlytics sends us a crash report containing the device model, OS version, app version, the state of the app at the time, and a Crashlytics installation ID.
• App lock: if you turn on the biometric app lock, the fingerprint or face check is done entirely by your device. We never receive your biometric data — only whether the lock is turned on.

We do not collect your device’s advertising ID, and our Android app removes the permissions that would allow it. The Facebook sign-in component in the app has its automatic event logging and advertising-ID collection turned off; it is used only if you choose to sign in with Facebook. We do not access your contacts, call logs, microphone, calendar, or health data.

2.11 Cookies and web analytics

See section 10 for the full list. In short: we set first-party cookies for sign-in, security, and referral attribution, and we use Google Analytics to measure how the website is used. We do not use third-party advertising cookies or cross-site tracking pixels.

2.12 Ads you see

Ads on the Service come from our own advertising platform, not an outside ad network. We record which ads were shown and tapped, and we use a first-party identifier to limit how often you see the same ad. See section 6.

2.13 Applications and programs

If you apply to be an ambassador or a volunteer, claim a sponsor profile, or register a shop, we collect the fields you submit: name, email, phone number, a short bio, your motivation, and any details you choose to share. We use this information to evaluate your application, contact you about it, and run the program.

2.14 Support and correspondence

If you contact us or open a support request, we keep the messages and any files you send so we can help you.

2.15 Server logs

Our servers automatically record technical information about each request (IP address, user-agent string, timestamps, response codes). We also keep a security audit trail of sign-ins and sensitive account actions. These are used for security, abuse detection, and debugging.

3. App permissions

Our apps ask for a permission only when a feature needs it. You can say no, and you can change your mind at any time in your device settings.

4. How we use your information

• Provide the service. Create your account, sign you in, run giveaways and draws, sell, store, transfer, and redeem gift cards, deliver messages, and remember your preferences.
• Verify identity. Send phone verification codes via Twilio, send email verification and password-reset links via SendGrid, and rotate session tokens.
• Personalize experience. Show shops, deals, and giveaways near your location and remember your language.
• Analyze usage & help shops. Produce aggregate, anonymized analytics about how the service is used across regions — including insights for shops such as how many people visited an area — never identifying individuals. See section 2.9 for how location is anonymized after 90 days.
• Communicate. Send transactional emails and notifications — receipts, security alerts, account changes — and, if you opt in, occasional news.
• Protect users. Detect fraud, abuse, multi-account attempts, spam, stolen payment methods, and unusual location or device patterns; review reports; and enforce our Terms.
• Fix and improve. Diagnose crashes and errors and improve the Service.
• Comply with the law. Respond to valid legal requests and meet our obligations to tax, anti-fraud, and consumer-protection authorities.

Legal bases (EU/UK). Where the GDPR applies, we rely on: performing our contract with you (running your account, giveaways, gift cards, and messages); your consent (precise location, push notifications, and marketing email — you can withdraw it at any time); our legitimate interests (security, fraud prevention, website analytics, improving the Service, and first-party ads); and legal obligations (financial records).

5. Automated screening

We use automated tools to keep the Service safe: usernames, giveaway text, and ad text are checked against word lists; uploaded images such as avatars are checked by an image classifier that runs on our own servers; and links are checked against lists of known unsafe sites. These checks can lead to content being rejected or removed automatically. Fraud and abuse signals (such as many accounts on one device, or an emulator) can lead to an entry being disqualified or an account being reviewed. We do not make decisions that have legal or similarly significant effects on you by automated means alone: you can ask for a person to review any of these outcomes by emailing [email protected].

6. Advertising

Ads and sponsored content on the Service are sold and served by us, through our own advertising platform. Ads are chosen based on where they are shown in the Service, your general area, and how often you have already seen them. We do not share your personal information with advertisers, we do not use your device’s advertising ID, and we do not let outside ad networks track you on the Service. Advertisers receive only aggregate results, such as how many times an ad was seen or tapped. If you tap an ad and go to an advertiser’s site, their privacy policy applies there.

7. What other people can see

Your username, display name, avatar, bio, level, achievements, giveaway wins, giveaways you host, and leaderboard position can be seen by other users and, on public pages, by anyone. Giveaway chat is visible to everyone viewing that giveaway. Your email address, phone number, precise location, payment details, gift card balances, and direct messages are never public. You control who can see your followers, activity, and other details in Account → Settings → Privacy. When you send someone a gift card or a message, they see your name and what you sent.

8. Sharing & third-party processors

We do not sell or rent your personal information. We share it with the service providers below only to the extent they need it to do their job for us, under terms that limit how they can use it.

We also share information:

• With shops, as needed to issue, honour, refund, and resolve disputes about a gift card or deal at that shop (see section 2.7).
• With giveaway hosts, who can see the usernames of people who entered and won their giveaway.
• When required by law (court order, subpoena, regulatory request) or where necessary to protect the safety or rights of users or the public.
• If our organization changes, for example a merger with or transfer to another corporation. We would tell you first, and this policy would continue to protect your information.

9. Google API Services User Data Policy

gift64’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use the limited Google profile data we receive only to authenticate you and personalize your Gift64 account — never for advertising, never to train AI/ML models, and we do not allow humans to read this data except (a) with your explicit consent, (b) for security investigations, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized.

10. Cookies in detail

The cookies we set ourselves are first-party, secure (HTTPS-only), and SameSite=Lax. Most are HTTP-only, meaning scripts in the page cannot read them. We do not set advertising cookies from outside ad networks.

You can block or delete cookies in your browser settings; blocking strictly necessary cookies will stop sign-in from working. To opt out of Google Analytics on any site, you can install Google’s opt-out browser add-on. Our mobile apps do not use cookies for analytics.

11. Data retention

• Your account is kept until you ask us to delete it (see section 12) or until it has been inactive long enough that we close it.
• When you delete your account, it is removed from public view within minutes and your personal data is erased from our active systems within 30 days. Backups roll over on a 30-day cycle.
• Server access logs are retained for up to 90 days. Security audit and anti-abuse records are retained for up to 12 months.
• Location history is tied to your account for at most 90 days; after that it is permanently anonymized (identifier and IP removed, coordinates coarsened) and retained only as aggregate data.
• Direct messages are kept until the conversation or the accounts in it are deleted.
• Crash reports are retained by Firebase Crashlytics for 90 days.
• OAuth tokens are rotated on every sign-in; old tokens are invalidated immediately.
• Guest IDs expire after 365 days.
• Gift card and payment transaction records are kept as long as required by tax and anti-fraud rules (typically 7 years). After account deletion your name and email are removed from these records.

12. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

• Access a copy of the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your account and the personal information attached to it — see our deletion instructions for the in-app and email-fallback paths. You can start deletion yourself, on the web or in our apps, from Account → Settings → Delete account. Spend or transfer any gift cards first: they are removed with the account.
• Export your data in a portable format.
• Object to or restrict certain types of processing.
• Withdraw consent for processing that relies on consent.
• Lodge a complaint with your local privacy regulator (in Canada, the Office of the Privacy Commissioner; in Quebec, the Commission d’accès à l’information).

To exercise any of these rights, email [email protected]. We may need to confirm your identity first. We will respond within 30 days, and we will never treat you worse for exercising a right.

Controls you have right now:

• Location: turn it off in your browser or device settings.
• Push notifications: turn them off in your device settings or in the app.
• Marketing email: use the unsubscribe link in any marketing email.
• Who sees what: Account → Settings → Privacy, and the blocked-users list.
• Sessions and devices: review and sign out devices in your account settings.
• Sign-in providers: manage connected accounts in your account settings, and revoke our access on the provider’s side (links are on the deletion page).

California residents: we do not sell your personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. The categories we collect and the purposes are described in sections 2 and 4.

13. Children

gift64 is intended for users 13 years of age or older. We do not knowingly collect personal information from children under 13, in keeping with the U.S. Children’s Online Privacy Protection Act (COPPA). Users aged 13 to 17 (or under the age of majority where they live) need the permission of a parent or guardian to use Gift64. Where the law sets a higher age for consenting to data processing (up to 16 in parts of the EU), a parent or guardian must consent. If you believe a child under 13 has signed up, contact us at [email protected] and we will delete the account.

14. International transfers

Some of our service providers (Stripe, Twilio, SendGrid, Cloudflare, Google, Apple, Meta, Microsoft) may process information in the United States and other countries outside of Canada, including outside Quebec, and outside the EEA. Information held there may be accessible to courts and authorities in those countries. Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms to keep your information protected at the standard required by Canadian and European law.

15. Security

We use TLS for all data in transit, hash passwords with a modern algorithm, encrypt stored secrets such as API keys, set HTTP-only and secure cookies, rotate short-lived access tokens, offer two-factor authentication and a biometric app lock, keep an audit trail of staff access to user data, and follow the principle of least privilege internally. Card details are handled by Stripe, a PCI-DSS certified provider, and never reach our servers.

No service is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the relevant privacy regulators as the law requires. If you spot a vulnerability please report it responsibly to [email protected].

16. Changes to this policy

We will post any updates here with a new effective date at the top of the page. For material changes — for example, adding a new category of personal information or a new processor — we will notify registered users by email or in the app at least 14 days before the change takes effect.

17. Contact us

Privacy Officer — questions or requests: [email protected]
Security reports: [email protected]
Legal notices: [email protected]
Help with your account: [email protected]
Anything else: [email protected]
Postal mail: Gift64 Inc., 120 East Beaver Creek Road, Unit 200, Richmond Hill, Ontario L4B 4V1, Canada