Datenschutz

Markus Klemann, Agathenstraße 12, 20357 Hamburg, Germany. Contact: privacy@itswrapt.app.

The waitlist. If you enter your email address, we store that address and the language you were reading the site in. We use it once, to tell you when WRAPT launches. Legal basis: your consent, Art. 6 (1) (a) GDPR, given by submitting the form. You can withdraw it at any time by emailing us, and we will delete the address. We keep it until launch, until you withdraw, or until we abandon the project, whichever comes first.

Signing up. If you ask for an account, we store the address you entered and the language you were reading in, the same way, and we email that address one link to finish creating the account. Nothing else is sent to it unless you use the link. Legal basis: the steps you asked us to take before a contract, Art. 6 (1) (b) GDPR. If you never use the link, the address is kept and deleted on the same terms as a waitlist entry.

Server logs. Our hosting provider records technical request data, including your IP address, for the purpose of delivering and securing the site. Legal basis: our legitimate interest in operating a working, secure service, Art. 6 (1) (f) GDPR.

About you, if you choose. Once you have an account and a partner, WRAPT offers you four optional questions about yourself: your city, things you are into, your age band, and whether you prefer experiences or things. You can answer none, some or all of them. We collect the answers for one purpose, finding gifts for you. Two things read them: the screen that shows them back to you, and, when your partner asks WRAPT for ideas for you, the model that turns your answers to the small questions and these four facts into three suggestions for your partner. Your partner sees the suggestions and the count of questions you have answered, never the answers, never which question was asked, and never why. The model is run by Anthropic, named below. It is sent what it needs for that one call, and what we keep of the call is its cost and its timing, never the suggestions and never your answers. They are stored in the database named below, they are deleted with your account, and nothing else is derived from them. You can change or clear them at any time under Settings, About you. Legal basis: your consent, Art. 6 (1) (a) GDPR, given by answering, which you can withdraw by clearing the answers or deleting your account.

Counting visits to this site. The public pages, this one included, count their visitors with Vercel Web Analytics. It records the page you looked at, the page you came from, your country, and the kind of browser and device, and it tells one visit from the next by a hash of your address and browser that changes every day and is never stored in your browser. There is no cookie, no identifier that survives the day, and nothing that follows you past this site. Pages inside the product are not counted this way: the code refuses to send them. Legal basis: our legitimate interest in knowing whether the site is read at all, Art. 6 (1) (f) GDPR, and you may object under Art. 21. Vercel is named below.

Counting what you do, if you say yes. Inside the product, WRAPT asks you once, on the welcome cards, whether it may count a few things you do: signing up, pairing, adding an occasion, adding an idea, answering a question, unlinking. No is the default, and the choice can be changed under Settings. If you say yes, each of those is sent as one event carrying your account identifier, the time, and a kind where there is one, such as whether an occasion is a birthday or whether an answer was a choice or a few words. Never the words: not an idea, not an occasion name, not an answer, not your address. The code refuses any value that could be a phrase. The events go to PostHog in the European Union, named below, and nowhere else. Nothing is loaded in your browser for this; the counting happens on our server. Legal basis: your consent, Art. 6 (1) (a) GDPR, which you withdraw by turning it off.

Nothing else. There is no tracking pixel and no advertising network on this site. The only third-party code that runs in your browser is the error reporting described next and the bot check described after it. Nothing sets a non-essential cookie, which is why you are not being asked to accept any. Beyond the answers you choose to give above, we build no profile of you, and we do not sell or share your address with anyone.

When something breaks, the site reports the error so we can fix it. The report says what the error was and where in the code it happened, plus the address of the page involved. From your browser it also includes your browser and operating system version, and it is relayed through this site’s own domain rather than sent to anyone else’s. Errors that happen on our server are sent to Sentry directly. Either way it sets no cookie, it does not record what you type or what you see, and we strip one-time credentials such as activation tokens from the address, headers and query of a report before it leaves. Sentry is named below.

When the iPhone app crashes, it reports that the same way, straight to Sentry. The report says what the error was and where in the code it happened, plus your phone model, your iOS version, and which version of the app was running. It is not linked to your account. For an error in the app’s own code, the app removes, before the report leaves your phone, the places your ideas, notes and answers could appear: the text of log lines, quoted text in error messages, the labels of what you tapped, and the query part of any address. It also removes email addresses and sign-in tokens. A crash inside iOS itself is reported by the system part of the error reporter, which records where the crash happened and the app’s recent steps, already cleaned the same way, and never the addresses the app talked to. Neither takes screenshots or records what you type or see.

Everything below exists because you asked WRAPT to plan gifts with someone. The legal basis for all of it is our contract with you, Art. 6 (1) (b) GDPR: it is what the product is. The exceptions are marked.

Your account. Your name, your email address, and your password, which is stored as a hash and never in readable form. If you signed in with Google or Apple instead, we store what they send back in place of a password, which includes the access and refresh tokens they issue. We keep them because the sign-in library stores them; no part of WRAPT reads them afterwards. Each time you sign in we keep a session, which records the browser you used and the IP address it came from, so that a session can be ended and a suspicious one recognised. We also keep one timestamp of when you last used WRAPT, on the website or in the app, moved at most every few minutes and with no history behind it, so that work WRAPT does in the background waits while you are looking. Your partner never sees it.

Your pair. That the two of you are linked, when, the time zone the pair keeps, and, where we have recorded it, whether you share a household. To make the link, one of you creates an invitation. We store the code hashed rather than as you read it, but the code is short, so the hash alone would not hold for long against someone who had the database. What actually protects an invitation is that it lasts a day, works once, is rate limited, and needs the inviter to confirm.

Your list. The occasions you name, the gift ideas you add, any structured detail on one such as a size or a date, the order you put them in, and which ideas you moved yourself, how firmly you mean each one, whether you have marked it bought or booked and when, and the budget you set. This is the private half of the product and it is enforced, not promised: every read of an idea through the app is filtered to the person who wrote it. Your partner cannot read your list. Not the titles, not the details, not the order, not the budget. Neither can they read what WRAPT concluded about it. We can: the admin console used to run the service shows idea titles and the answers you have given, and there is nothing in the product that stops us looking. When you ask WRAPT for ideas for your partner, the titles already on your list and the budget you set for that occasion go to Anthropic with the request, so that it does not suggest something you have thought of, or something outside what you mean to spend.

Detail suggestions. Each time you save a gift idea or change its title, WRAPT asks Anthropic on its own, a few seconds later, for details worth adding, such as a size or a date. You do not have to ask, though Try again asks once more. It happens for ideas for later and ideas on a list you keep alone too. A few quick changes in a row make one request, and each person has a limit of ten an hour and forty a day. It is sent the title, the details you have already confirmed, which kinds of detail not to suggest again, and your language. Never the note, never the links, and nothing of your partner’s.

The comparison. The one place both lists meet is the check for whether you have each had the same idea. It runs on our server, and the only thing it sends anywhere is the titles. It runs only on occasions you share and when both of you allow checking in Settings. Keeping checking off or turning it off leaves you connected and keeps your lists. When enabled, it runs when either of you adds an idea to one, moves an idea onto one, or changes a title there. It also runs when either of you opens a list, for up to ten ideas that have not been checked yet, and when the two of you link, for up to twenty ideas in all on the shared occasions that are still open. Ideas for later and a list you keep alone are never compared. It never returns either list to the other person. What it writes down is its verdict, which one it kept when two ideas really are the same gift, and a short description of what kind of thing your idea is, which is later used to decide what to ask your partner. You see the effect on your own list; you are never told what your partner had. The titles go to OpenAI for the comparison, described below. This is the exception to the legal basis above: the comparison rests on our legitimate interest in the product doing the one thing it promises, Art. 6 (1) (f) GDPR, and you may object under Art. 21.

The questions. WRAPT asks you small questions about yourself. We store which question was asked, whether you answered or skipped, and your answer, which is either one of the offered choices or up to eighty characters of your own words. Where a question was prompted by something on your partner’s list, we store which idea prompted it, so that the answer can be useful to them. You never see that link and neither do they. Some of the questions are about nothing in particular, and that is deliberate: it is what stops the questions themselves revealing what your partner is considering. Your partner is told how many you have answered, never which, never what, and never why one was asked. Legal basis: your consent, given by answering, which you withdraw by skipping or by deleting your account.

Keeping it safe and running. If you enter a couple code that is wrong, we record that an attempt happened and when, so that codes cannot be guessed by brute force; we do not store what you typed. Your account also carries whether it is suspended and the reason an administrator gave, and every administrative action taken on an account is written down with who took it, so that moderation can be audited rather than quietly done. Legal basis: our legitimate interest in a service that is not abused, Art. 6 (1) (f) GDPR.

The welcome flow. Whether you went through the welcome cards and whether you finished them, so we do not show them to you again. Nothing about what you read there, only that you did.

Deleting your account. Settings has a Delete account button, under Your account, on the website and in the app. It works straight away, with no waiting period, and it cannot be undone. First it checks that it is really you. If you have a password, you type it again, and after five wrong ones it stops accepting tries for fifteen minutes. If you sign in with Google or Apple, your sign in has to be less than five minutes old, and if it is older you are asked to sign in again. The admin account used to run the service cannot be deleted this way.

If you are linked to someone, deleting unlinks the two of you first, exactly as an unlink with “Also erase my lists” ticked, described below. The other person keeps their own copy of every occasion the two of you had, with their own ideas and budgets on it, and nothing of yours. Their inbox gets one line saying you deleted your account and that the occasions are theirs alone now. Nothing of theirs is deleted with your account.

What deleting removes. Your account, your sessions and your sign-in details, including what Google or Apple sent back, and the record of when you last used WRAPT. The four answers about yourself and your answers to the small questions. Your gift ideas, your budgets, and your copy of every occasion, whether it was only yours or shared. What you asked to be reminded about, the record of which reminders were sent to you, and the phones you registered for them. Your inbox, your settings and the record of the welcome flow. Any invitation you sent or claimed. The cost records we kept each time you asked for suggestions. Your waitlist entry, found by your address, together with the invitation that came from it. And any password-reset link, used or not.

What stays. Records of administrative action, which can name your account, because moderation that cannot be audited is worse. The note that an unlink happened, which after a delete names nobody, and the anonymous counts described below.

Outside WRAPT. Deleting also asks PostHog to delete everything it counted about you, with the record of you as a person, if you ever said yes to counting. PostHog does this in the background, not at once. If you signed in with Apple on the website, deleting asks Apple to withdraw WRAPT’s access, which takes WRAPT off the list under Sign in with Apple in your Apple account settings. If you only ever signed in with Apple in the iPhone app, WRAPT holds nothing it can ask Apple to withdraw. Either way, if WRAPT is still on that list afterwards, you can remove it there yourself.

Unlinking from your partner ends the pair, and each of you keeps your own lists. Each of you keeps a copy of every occasion the pair had, whoever created it. On your copy are your own gift ideas with their details and order, what you marked bought or booked, your budget, and the record of which reminders were sent to you. Nothing of your partner’s comes with it. Neither of you ever sees the other’s ideas, before an unlink or after it.

Everything that only existed because there were two of you is deleted: every question and answer asked through the pair, the updates about them in your inbox, every verdict the comparison reached and which idea it kept, and the cost records we keep for the model calls, both the comparisons and the suggestions. The four answers about yourself are not part of the pair and stay with your account.

Also erase my lists. If you tick this when you unlink, your own occasions, gift ideas, budgets and reminder records are deleted instead of kept. It only ever reaches your own. Your partner keeps their copy either way, and there is no way to erase theirs.

Beyond your own lists, three things survive an unlink. A note that an unlink happened, which names who did it for as long as that account exists. Four counts of what the pair had done by then: how many times the comparison weighed an idea, how many of those were real clashes, how many were near misses, and how many questions the occasions ever asked. And the record of how the pair was formed. Where that was an invitation one of you sent, it keeps both of your account references and the moment you confirmed, because it is the receipt for a thing that happened rather than part of the plan.

The counts carry no pair, no person and no idea, and we write them in a separate step from the note so the two cannot be joined directly. We will not claim more than that: at the volume WRAPT runs at today, an unlink note and a set of counts appearing on the same day are correlated by that fact alone, and we decided that was acceptable for a product with one couple on it rather than pretending it was solved.

Invitation codes and password-reset links stop working when they expire: twenty-four hours for an invitation, one hour for a password-reset link. The expired rows are not swept away on a schedule; they sit inert until something else removes them, and we would rather say so than imply a cleanup that does not run.

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, hosts the site and provides the visit counting described above. The functions behind the product run in Frankfurt; the site itself and the counting may be served from a United States region, so some of your data is transferred to the USA. Vercel is certified under the EU-US Data Privacy Framework, which is the basis for that transfer.

PostHog (PostHog Inc., San Francisco, USA, through its European cloud hosted in Frankfurt) receives the events described above, and only for a person who said yes. The events are stored in the European Union. PostHog acts as our processor, and its data processing agreement commits it to the EU Standard Contractual Clauses for any transfer to the USA. Legal basis: your consent, as above.

Supabase provides the database. The database itself is located in Frankfurt, Germany.

Cloudflare, Inc. runs a small bot check (Turnstile) in two places: the sign-up form, so that a script cannot fill the list with fake addresses or mail links to them, and the screen where someone without an account enters a couple code, so that a script is not left free to work through codes. To do that, Cloudflare processes technical signals from your browser, in its own words “client IP address, TLS fingerprint, User-Agent header” and the identity of this site. It does not see what you type into either one, and we do not receive or store your IP address from it. For the check itself Cloudflare acts as our processor; it also uses these signals for its own purpose of improving Turnstile, for which it is the controller. Cloudflare is a US company and is certified under the EU-US Data Privacy Framework, which is the basis for that transfer. The legal basis for the check is our legitimate interest in keeping the launch list genuine and in not letting a script work through couple codes (Art. 6 (1) (f) GDPR), and you may object under Art. 21.

Anthropic, PBC, San Francisco, USA, runs the model behind two things: turning one person’s answers into suggestions for the other, and the detail suggestions that follow every saved idea. For each call it receives what that call needs, as described above: gift idea titles and details, answers and the profile details you share, or a budget, and nothing about who wrote them. Anthropic does not use what we send to train its models. Its data processing terms commit it to the EU Standard Contractual Clauses for the transfer to the USA. Our calls are made from a function in Frankfurt. Legal basis: for suggestions, the consent you give by answering, described above; for detail suggestions, our contract with you, Art. 6 (1) (b) GDPR, since helping you complete an idea is part of the list you signed up for, and it works only on words you typed yourself.

OpenAI Ireland Limited, Dublin, Ireland, runs the model that judges whether two ideas are the same gift. For each check it receives the titles of the gift ideas being compared, and nothing about who wrote them. It is not sent the ids we store them under. OpenAI does not use what we send to train its models. Where OpenAI passes data to its companies outside the EEA, its data processing terms rely on the EU Standard Contractual Clauses or an EU adequacy decision. Our calls are made from a function in Frankfurt. Legal basis: our legitimate interest in the product working as promised (Art. 6 (1) (f) GDPR).

Amazon Web Services delivers the email WRAPT sends you: the invitation to activate an account, a password-reset link if you ask for one, and a reminder that an occasion is coming up if you switch those on. To send a message Amazon receives the address it goes to and what the message says. It acts as our processor. For the first two the legal basis is our contract with you and the steps you asked us to take before it, Art. 6 (1) (b) GDPR, since you cannot get into an account or back into one without this email. A reminder rests instead on the consent you give by switching it on, Art. 6 (1) (a) GDPR, and you can switch it off again at any time. The reminder names no occasion and carries no date: it says only that something is coming up, and links you to your own list. Where an invitation came because you joined the waitlist, it rests instead on the consent you gave there, and it is the one use that paragraph describes.

Sentry (Functional Software, Inc.) receives the error reports described above, so that faults are noticed and fixed. Our Sentry project runs in Sentry’s European region, so the reports are stored in the EU. Sentry is a US company; its data processing agreement commits it to the EU-US Data Privacy Framework for any transfer to the USA, with Standard Contractual Clauses as the fallback. The legal basis is our legitimate interest in a working, secure service (Art. 6 (1) (f) GDPR), and you may object under Art. 21.

You have the right to access your data (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw that consent at any time, without affecting what was lawful before you did.

Two of these are buttons. Settings, under Your account, has Download my data and Delete account, on the website and in the app. Download my data gives you one JSON file, a plain format another program can read, which covers access and portability. In it are your account, your sessions, when you last used WRAPT, your occasions, your ideas and budgets, your answers with the questions they answered, your reminders, the cost records of the suggestions you asked for, and your waitlist entry. Occasions you share are in it, because they are yours too. Nothing of the other person’s is: not their ideas, not their budgets, not their answers, and nothing that would tell you what is on their list, which is why a few details about your own questions and ideas are left out. Neither is any password or sign-in token. Delete account is described above.

For anything else, or if you cannot use the buttons, email privacy@itswrapt.app and we will act on it.

You can complain to a supervisory authority. Ours is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

The waitlist is entirely optional, and not joining it costs you nothing. Reading this site requires nothing at all.

An account is different, because there is no way to give you one without it: we need a name to show your partner, an email address to send the invitation to and to get you back in, and a password unless you sign in with Google or Apple. Everything after that is yours to choose. The four answers about yourself are optional. The small questions can be skipped, every one of them. You can use WRAPT without ever answering anything about yourself, and it will simply have less to go on.