Privacy Policy

1. What data we collect

• account data: your name, email address, password (stored only as a secure hash) and, if you add one, a profile photo;
• content you create: lists, wishes (name, price, link, photo, notes), groups, group membership, reservations;
• Secret Santa data: participation in a game, the exchange date and budget, and the pairs (each pair is visible only to the person it concerns);
• messages sent through the contact form: your name, email and the text of the message;
• technical data: the request address (IP), browser type and error logs, for security and diagnostics; to protect the contact form from spam we store only a hash of the IP address;
• if link autofill could not read a shop, we anonymously store only the domain of the shop and the kind of problem, to improve autofill. We store the full link (without parameters) only if you press "Send to developers";
• your choice about cookies.

2. Why we use it

• to create your account, let you sign in and show you your lists and groups;
• to show content to the people you have given access to;
• to send service emails: email confirmation, password reset, group invitations;
• to answer your messages;
• to protect the service from abuse and to fix errors;
• to understand what in the service can be improved, but we turn analytics on only with your consent.

3. Who we share data with

We do not sell your data. To run the service we use third-party providers that process data on our behalf: hosting and delivery of the site, the database and authentication, and sending email. They receive only the data needed for their part of the work.

Other users can see what you have given them access to: your name, profile photo and your lists, according to the visibility settings. We do not show your email address to other users, except when you invited that person by email yourself.

3a. Signing in with Google

You can create an account or sign in with Google. In that case Google gives us only your email address, name and profile photo. We use this data only to create and protect your account in Bazhanka and to show your name and photo to other members you have given access to. We do not receive your Google password.

We do not sell this data, do not pass it to advertising networks and do not use it for advertising. Our use and transfer of information received from Google complies with the Google API Services User Data Policy, including its Limited Use requirements. You can revoke the access you gave Bazhanka at any time in your Google account settings.

3b. Browser extension

The “Bazhanka - add a wish” extension (Chrome, Edge) works only after you click its icon. It then reads the name, description, photo, price and address of the product from the open tab to fill in the wish form. This data is sent to bazhanka.app only when you press “save”, and ends up in your list the same way as a wish added on the site.

To sign you in, the extension uses your session on bazhanka.app: it does not store passwords or tokens. In the browser it remembers only the list you chose last. The extension does not collect your browsing history, does not track what you do on other sites, contains no ads or analytics, does not sell data and does not pass it to third parties. The data is used only to add a wish to your list.

4. Cookies

Necessary cookies are needed to sign in to your account and to remember your theme and cookie choices. They work without consent because the service cannot work without them. Analytics cookies help us understand what to improve and are turned on only with your consent. You can change your choice at any time with “Cookie settings” at the bottom of the page.

5. How long we keep data

Account and content data are kept for as long as you use the service. When you delete a list or a wish, it disappears from your account. You can delete your account yourself: in your profile, in the “My data” section. If you follow other users, we store that subscription and the notifications about their new wishes (read ones are deleted after 60 days); only you can see who you follow. Co-owners of a shared list can see its wishes and change their own, and group members can see who the co-owners are. After you confirm with your password the account is frozen for 14 days: sign-in is unavailable, your lists are hidden from everyone, and an email with a restore link goes to your sign-up address. If you do not restore it, the account is deleted permanently after 14 days: your lists, wishes, reservations and photos disappear, groups where you were the admin pass to the member who joined first, and groups with nobody else are deleted.

6. Your rights

Account deletion is available in your profile, in the “My data” section. For any other request, write to us through the contact form.

• find out what data of yours we hold and get a copy of it;
• correct inaccurate data (you can change your name, email and photo yourself in your profile);
• ask us to delete your data;
• withdraw your consent to analytics cookies;
• complain to a personal data protection authority.

7. Security

Access to data is protected by authentication and by access rules at the database level: users see only what they are entitled to. No online service can guarantee absolute security, so do not share your password and send links to your lists only to people you trust.

8. Changes to this policy

We may update this policy. The current version is always here, and the date of the update is shown at the top. We will tell you about material changes in the service.

9. Contact

For any question about data, write through the contact form: in the profile menu, or on the public pages through the “Write to us” button at the bottom of the page.