Privacy policy

Account: your email (to send the sign-in code) and, if you provide it, your name, which guests see as the list creator. We don't use passwords.

What you create: lists, descriptions, gifts (name, store link, price, photo), names of the people a gift is for, and, if you add it, your Pix key with name and city. In groups: the name you show, your list, group chat messages, anonymous questions and, in birthday groups, your date.

Guests: the name typed when picking a gift or writing in the chat and, optionally, a WhatsApp number in split proposals. Each browser gets a random key; we store only its fingerprint (hash), which is what lets you undo your own picks.

Security: the IP address of requests, used only to limit abuse (for example, too many sign-in codes). It is kept in a counter that expires in minutes to one hour.

Usage statistics: page counts by Vercel Web Analytics, aggregated and without cookies or individual tracking.

Anyone with a list's link sees the list: name, description, gifts and, if added, the Pix key. Don't put anything you wouldn't share with your guests.

Guests see each other's names on picked gifts and in the chat, and the WhatsApp numbers people chose to share there. The list owner never sees who is giving what or the conversations: that is the core of the service, and not even data export shows it.

In a group, members see the group chat and the lists the rules allow. Draw pairs are seen only by each giver; anonymous questions arrive without the sender's name.

To provide the service you asked for (performance of a contract, art. 7, V of the LGPD): signing you in, saving lists, showing them to guests, running groups and draws.

To keep the service safe and working (legitimate interest, art. 7, IX): usage limits, abuse prevention and aggregated statistics.

We don't sell data, don't show ads and don't use your data to build marketing profiles.

Vercel (hosting and statistics) and Resend (sending the sign-in email) process data on our behalf, in the United States; the database is hosted with a cloud provider. These transfers follow art. 33 of the LGPD, with providers that adopt contractual and security safeguards.

When you paste a product link, our server visits that page to read name, price and photo. The store receives a regular visit from our server, not from you.

We only use necessary cookies: your session (to keep you signed in), your language choice and, for 15 minutes, the email waiting for the sign-in code.

On your device (local storage) we keep your guest key, so you can undo what you picked, and preferences such as already-seen tips. Clearing your browser data removes them.

While your account exists. When you delete it, data is removed right away from the service; provider backups are overwritten in their normal cycle.

Sign-in codes expire in 10 minutes. Security counters expire in up to one hour.

Under art. 18 of the LGPD you can confirm and access your data, correct it, have it deleted, take it with you (portability) and get information about sharing. On the My account page you can download all your data and delete your account on your own, immediately.

If you deleted your account, what you did as a guest on other people's lists is handled like this: your chat messages are deleted, and the gifts you reserved remain reserved under the name "Guest", so nobody buys a duplicate.

Without an account, as a guest, you can undo your picks and delete your messages on the list itself. For anything else, contact us through the contact listed on this page once it is published. You may also file a complaint with Brazil's data protection authority (ANPD).

Encrypted connections (HTTPS), password-free sign-in with single-use codes and attempt limits, guest keys stored only as fingerprints, access checks on every action and limits against automated abuse. No system is 100% safe; if an incident puts you at risk, we'll let you know.

shh! isn't intended for children. Teenagers should use it with a parent or guardian.

If this policy changes in a relevant way, we'll update the date below and highlight it on the site.