Privacy Policy
This policy explains how GiftJo handles information when you browse, create an account, or place an order.
Last updated: September 2026Connected accounts
We use Google, Facebook or Apple to verify your identity when you choose social login. We store the provider account identifier and permitted profile details. Provider credentials are not GiftJo session credentials. Apple revocation credentials are encrypted and removed after revocation.
Delivery location (optional)
You may optionally provide a delivery pin. We store its coordinates with your order for fulfilment and remove them under our order-data retention policy. Map images are supplied by OpenStreetMap; loading the map shares your IP address and requested map tiles with its hosting service. Opening driver links shares the selected destination with Google Maps.
Information we collect
We collect the account, contact, delivery, order, and payment-status information needed to provide the shop and fulfil your orders.
How we use information
We use your information to manage your account, process and deliver orders, provide support, prevent misuse, and improve the service.
Sharing and protection
Information is shared only with service providers needed to operate GiftJo, including DigitalOcean hosting and storage, delivery providers, and Apple, Google or Facebook when you choose their login. The optional delivery map loads tiles from OpenStreetMap, which may receive your IP address and the viewed map area. We do not sell personal information or use it for cross-app tracking.
Mobile app data
The mobile app stores a session token and an app-generated device identifier in secure device storage. It sends account and delivery details, order activity, product interactions and the identifier to our API for authentication, order processing and service analytics. You can enter a delivery address and optionally choose a precise delivery pin. We do not request access to contacts, the SMS inbox, microphone, camera or the device location service.
Data security
Account passwords are hashed on the server. Production traffic uses HTTPS and mobile session tokens use secure device storage. DigitalOcean provides hosting and media storage. Customer information is accessible only to authorized operations and support.
Privacy enquiries
Contact [email protected] for privacy questions or an account deletion request. You can also use the account deletion page on this website.
Cookies and local storage
We use essential cookies and local browser storage to keep sessions secure, retain your cart and language choice, and remember cookie acceptance. The public demo does not use advertising cookies.
Your choices
You may review your account details or request account deletion from your profile. Contact us by email for privacy questions.
Deletion and retention
We delete your account, credentials and saved addresses and revoke access immediately. We fulfil unfinished orders and retain only necessary contact and delivery details until 30 days after delivery or cancellation, or until an open complaint or dispute closes, whichever is later. Required financial records are retained through December 31 of the year following the transaction year. Anonymous financial and inventory history is preserved. Protected managed database backups have a seven-day recovery window after active data removal. Completed deletions are reapplied before service resumes after a backup restore.