Privacy Policy

1. Introduction

Santa Party ("we," "us," "our," or "Company") operates the www.santa-party.com website (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

2. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected:

• Personal Data: Email address, name, encrypted password
• Party Information: Party names, dates, budgets, and gift wishlists
• Participant Information: Names and email addresses of party participants
• Usage Data: Browser type, IP address, pages visited, and timestamps

3. Use of Data

Santa Party uses the collected data for various purposes:

• To provide and maintain our Service
• To authenticate your account and manage your sessions
• To send transactional emails (account verification, password reset, party invitations)
• To notify participants of Secret Santa assignments
• To improve and optimize our website functionality
• To prevent fraud and enhance security

4. Email Communications

We send transactional emails necessary for account management and party operations:

• Email verification upon account creation
• Password reset requests
• Party invitations
• Secret Santa assignment notifications

These are essential transactional emails and cannot be opted out of if you wish to use the Service. We do not send marketing or promotional emails.

5. Data Security

The security of your data is important to us, but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Security measures include:

• Encrypted passwords using bcryptjs
• Secure HTTPS connections with SSL certificates
• HTTP-only secure cookies for session management
• Rate limiting to prevent brute force attacks

6. Data Retention

We retain your Personal Data for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy. You may request deletion of your account and associated data at any time by contacting us.

When you delete your account, your personal information will be removed from our active systems within 30 days. However, some information may be retained in backup copies for up to 90 days for security and recovery purposes.

7. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion of your account and data
• Export your data in a portable format
• Withdraw consent for data processing

To exercise these rights, please contact us at the email address provided below.

8. Third-Party Services

We use third-party service providers to assist in operating our website and conducting our business:

• Supabase: Cloud database hosting
• Vercel: Website hosting and deployment
• Mailgun: Email delivery service

These third parties have their own privacy policies and are committed to keeping your information confidential. We recommend reviewing their privacy policies.

9. Children's Privacy

Our Service is not intended for individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete such information immediately.

For users between 13-18, parental consent is recommended before creating an account.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date on this page. Your continued use of the Service following the posting of revised Privacy Policy means that you accept and agree to the changes.

11. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at: