Privacy

Controller

The controller for the processing of personal data on this website and in the “mine, thanks.” app is:

What this website always does

Fonts are served from the same server as the page itself and are not loaded from third parties. Images on shared lists and profile pages come from our storage at Supabase (see “Your account in the app”); older wishes sometimes still show their image directly from the online shop they come from – in that case, displaying it gives that shop your IP address and browser identifier.

The website runs at Vercel Inc. (USA) in a data centre in Frankfurt am Main. Each request produces the usual server logs: IP address, time, requested address and browser identifier. They arise technically with every transfer and serve the operation and security of the site; the legal basis is our legitimate interest in this, Art. 6(1)(f) GDPR. Vercel processes them as our processor (Art. 28 GDPR); access from the USA is covered by the European Commission’s standard contractual clauses. How long the logs are kept depends on Vercel’s settings.

If you choose a language or country yourself — in the picker on the home page or at the bottom of any page — a cookie named mt_locale remembers that choice (for example “en-gb”) for one year, so that minethanks.com takes you straight there next time. That is all it holds, no identifier, and it is not analysed. Without the cookie, the home page follows the language your browser sends anyway; we never go by your location or IP address. The cookie is strictly necessary for the service you requested and therefore needs no consent (Art. 5(3) of Directive 2002/58/EC).

The site creates two further entries only when you use the respective feature, in your browser’s local storage rather than as a cookie: if you reserve a wish on a shared list, your browser stores a random key under “wp.res.” and the wish’s identifier so you can cancel the reservation later. If you connect ChatGPT or Claude to your account, “mt-connect” keeps you signed in for that process. Both are strictly necessary for the feature you requested and therefore need no consent (Art. 5(3) of Directive 2002/58/EC).

Forwarding to the right store

When you open minethanks.com/app, or the window with the two stores on this website, we evaluate the browser identifier (user agent) that your browser sends with every request. We only read the operating system from it – iOS, Android or another – to show you the right store or to forward you straight to it. For the window, this happens entirely in your browser; nothing is sent to us for it.

We do not store the result, we do not build a profile from it and we do not pass it on to anyone. The response to /app is not cached either. The usual server logs (see above) are not affected by this.

The legal basis is our legitimate interest in offering you the app for your device without detours, Art. 6(1)(f) GDPR.

Once forwarded, you are in Apple's App Store or on Google Play. Apple or Google, respectively, are themselves responsible for the processing there; their privacy policies apply.

Pointer to the app

If you open this website or a shared list on an Android device, we show a slim bar at the top with a link to Google Play. Whether it is an Android device we read – as with the redirect to the store – solely from the browser identifier (user agent). On shared lists, wish pages, profile pages and the report form this happens on our server, on all other pages in your browser. We do not store the result.

If you close the bar with ✕, we set the cookie “mt_app_banner” with the value “dismissed”. It only records that you closed the notice, so that it does not come back for 30 days; after that it expires. It contains no identifier; we only read it to decide whether the bar appears, and we do not use it for tracking.

In Chrome on Android, the page also asks the browser whether the mine, thanks. app is already installed and then hides the bar. Chrome carries out this check on your device; the result stays in the browser and is not sent to us.

The legal basis is our legitimate interest in offering you the app for your device and in not showing a closed notice again, Art. 6(1)(f) GDPR.

Your account in the app

For an account we store your phone number, your display name and – if you provide them – profile picture, short bio and profile address, as well as the app language and the country derived from your phone number. If you sign in with Apple or Google, the details this provider sends are added (see below).

Your account, lists, wishes, images and all other app data are stored at Supabase Inc. as our processor (Art. 28 GDPR) in a data centre in Frankfurt am Main. Access from the USA, for example for maintenance, is covered by the European Commission’s standard contractual clauses.

The legal basis is performance of the terms of use, Art. 6(1)(b) GDPR. We keep the data for as long as your account exists.

You can delete your account in the app at any time; how to do this is also explained on this website under “Delete account”. We then delete your account, your lists and wishes, the reservations on them, your uploaded images and your device entries, and disconnect a sign-in with Apple.

Signing in with an SMS code

If you sign in with your phone number, we send you a code by SMS. For this we transmit your phone number and the text of the message including the code to Bird (MessageBird B.V., Amsterdam, Netherlands), which delivers the SMS as our processor (Art. 28 GDPR). The code is valid for ten minutes. The legal basis is performance of the terms of use, Art. 6(1)(b) GDPR.

Signing in with Apple or Google

If you sign in with Apple or Google, we receive from that provider an identifier of your account there, your email address and your name; with Apple you can choose an address forwarded by Apple instead of your own. We use the name as your display name; we store the email address with your account and use it only for signing in. Apple and Google are themselves responsible for signing in with them; their privacy policies apply.

When you sign in with Apple, we also store an access token from Apple so that we can disconnect from Apple when you delete your account. If you later link your account to your phone number or another provider, we combine the sign-in methods in one account. The legal basis is performance of the terms of use, Art. 6(1)(b) GDPR.

Wishlists, shared lists and reservations

We store your lists and wishes – titles, notes, links, prices and images – so that you can manage and share them. Anyone with the link to a list sees it with your display name and profile picture, even without the app and without an account.

If you make a list or your profile public, it can be viewed by anyone at your profile address. You decide in the app whether search engines may include your profile. Wishes on public lists feed, without your name, into the counts for “Often wished for” and the collection pages (see below).

Guests reserve without an account. We only store which wish was reserved and when, plus a random key with which the reservation can be cancelled; we do not collect the guest’s name or email address. Whoever created the list sees that a wish is reserved, but not by whom. The legal basis is performance of the terms of use with you as the owner of the list and our legitimate interest in letting guests reserve without an account (Art. 6(1)(b) and (f) GDPR).

Your devices in the app

When you sign in to the app, we add an entry for that device to your account. It contains the platform (iOS or Android), the device name reported by the system, the operating system and app versions, when the device was last used and – if you allow notifications – the push address we use to send you notifications. You can see this list under “My devices” and sign devices out there.

So that a device appears only once in the list – even if you sign out and back in, turn notifications off and on, or reinstall the app – the app sends a device identifier: on iPhone, a random identifier created once and kept only in this device’s keychain, which does not move to a new device when you switch phones; on Android, the Android ID the system assigns to this app. We store only a non-reversible hash of it. The identifier is used solely for this device list; we do not use it for advertising or to recognise you across other apps, and we do not build a profile from it.

The legal basis is performance of the terms of use, Art. 6(1)(b) GDPR – signing in, notifications and managing your devices are part of the service – and, for merging duplicate entries, our legitimate interest in an accurate, clear device list, Art. 6(1)(f) GDPR. A device entry remains until you sign the device out or delete your account; if another account signs in on the same device, the entry passes to that account.

Notifications

If you allow notifications, we send you a message, for example, when someone has reserved a wish on your list; it names the title of the wish, not the guest. Notifications are delivered via the push service of Expo (650 Industries, Inc., USA) and from there via Apple (Apple Push Notification Service) or Google (Firebase Cloud Messaging) to your device. Expo is our processor (Art. 28 GDPR); the transfer to the USA is covered by the European Commission’s standard contractual clauses.

We delete the text of a notification after it has been sent, and the delivery record without text 30 days later. The legal basis is performance of the terms of use, Art. 6(1)(b) GDPR. You choose in the app which notifications you receive; you can switch them off completely in your device settings.

Usage and error measurement in the app (PostHog)

To see whether the app works, where errors and crashes occur and which features are used, the app measures with PostHog. It records events such as opening the app, screens viewed (without identifiers in the address), steps such as creating a list or the type of sign-in, errors and crashes with technical details, as well as device type, operating system, app version and language. We do not record the titles or contents of your lists and wishes, phone numbers or names.

The events are linked to your account identifier so that we can attribute errors to a sequence of steps; before you sign in, the app uses a random identifier stored on your device for this. Your IP address is not stored and we do not determine a location.

The recipient is PostHog Inc., which stores the data as our processor (Art. 28 GDPR) in its EU cloud in Frankfurt am Main and deletes it once the retention period set in our project has expired.

The legal basis is our legitimate interest in running the app reliably, fixing errors and improving it (Art. 6(1)(f) GDPR). You can object to the measurement at any time (Art. 21 GDPR); just write to support@minethanks.com.

Reporting and blocking

If you report a list or a profile – in the app or via the report form on this website – we store the reason, your optional free text, what was reported and, if you are signed in, your account. If you report without an account, we store an irreversible hash of your IP address instead of the address itself to limit abuse. We delete reports after twelve months.

So that we see a report quickly, we post a notice to our internal channel at Slack (Slack Technologies Limited, Dublin, Ireland). It contains the reason and the title of the reported list or the display name of the reported profile – never your free text and never who reported it. The legal basis is our legitimate interest in reviewing and removing unlawful content (Art. 6(1)(f) GDPR).

If you block someone, we store this with your account until you lift the block or delete your account. The legal basis is performance of the terms of use, Art. 6(1)(b) GDPR.

Connecting ChatGPT or Claude

You can connect your account to an AI assistant such as ChatGPT or Claude. To do so, you sign in on this website with your phone number (see “Signing in with an SMS code”) and agree to the connection; we store which assistant you have given access. The assistant can then retrieve your lists and wishes, add wishes and view shared lists whose link you give it. Whatever it receives is processed by the assistant’s provider – such as OpenAI or Anthropic – under its own responsibility and privacy policy.

The legal basis is performance of the terms of use, Art. 6(1)(b) GDPR. The connection lasts until you delete your account; you can disconnect it in the assistant at any time.

Links to online shops

If you open the link to a shop from the app, a shared list or a collection page, we forward you via minethanks.com. We store which wish or item was opened, the destination, the time and a random click number – not your IP address and not your browser identifier.

If the shop takes part in a partner programme, the link runs via an affiliate network such as AWIN. The network receives the click number and the item identifier, may set cookies and learns whether a purchase is made. We then receive details of the commission, such as amount and status, but no details of who bought. The network and the shop are themselves responsible for their processing.

The legal basis is our legitimate interest in operating the forwarding and settling commissions with which we finance mine, thanks. (Art. 6(1)(f) GDPR). This does not change the price for you.

Curated collection pages

The collection pages with gift ideas contain no personal data about users. A “× wished for” figure next to an item counts how many different owners of public wish lists in the collection’s country want that item, and only appears once a minimum count is reached (currently 5). Links to shops may be affiliate links; where that is the case, the link carries an asterisk (*), explained as “Advertisement” on the same page.

“Often wished for” in the app

In the app’s Inspiration tab, “Often wished for” shows what other people often wish for. Only wishes on public lists are counted, and an item only appears once a minimum number of different owners have it (currently 5). Blocked accounts are not counted, and new accounts only after a waiting period; the same applies to the “× wished for” figure on the collection pages. The title, brand and image of such an item are details that at least two different owners gave in the same way; photos that users uploaded themselves are never shown there. If you add an item to your list with “+”, it gets no price and only a link that most owners use – without the query part of the address, where third-party affiliate and tracking identifiers usually sit.

Which items you see, and in what order, depends on your country, the occasion of your own lists and what you already have on a list. We work this out in our database; we do not pass your wishes on to anyone for this, and nobody else sees any of it. It is a sorting of suggestions, not a decision about you within the meaning of Art. 22 GDPR. The legal basis is providing the app you use (Art. 6(1)(b) GDPR).

To find similar items, we have OpenAI convert the title and brand of these publicly counted items into series of numbers (so-called vectors). Only this item text goes to OpenAI – no names, no phone numbers, no accounts, no lists, none of your own wishes, no device data. We then match it against your wishes ourselves, in our database. OpenAI processes the texts in the USA; we base the transfer on the European Commission’s standard contractual clauses. Insofar as such an item text relates to a person at all, the legal basis is our legitimate interest in showing suitable suggestions (Art. 6(1)(f) GDPR).

Automatic check of uploaded images (Google Cloud Vision)

Images you upload yourself – your profile picture, a list’s cover image and your own photos of wishes – are also seen by your guests. To make sure nothing pornographic appears there, we have every such image checked automatically before guests can see it. Sexual products as wishes are fine; we only check whether the image itself is pornographic. Images from online shops we list as trusted are not checked and are not transmitted for this purpose.

We transmit the image file itself – for very large files its address in our storage instead – but no name, no phone number and no list. We receive assessments in rough levels (such as “unlikely” or “likely”), which we store together with the result for as long as the image exists. If an image is rejected, we delete it, remove it from your profile or list and notify you in the app; we delete the related check record after 90 days.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor (Art. 28 GDPR) under the Google Cloud data processing terms. Processing by Google LLC in the USA is possible; it is based on Google LLC’s certification under the EU-US Data Privacy Framework and additionally on the European Commission’s standard contractual clauses. According to Google, the images are not used for Google’s own purposes.

The legal basis is our legitimate interest in protecting guests – including minors – from pornographic content and in not distributing unlawful content (Art. 6(1)(f) GDPR). You can object to the check (Art. 21 GDPR) by not uploading your own images; if you think a rejection was wrong, write to support@minethanks.com.

Your rights

You can ask for access to your data, have it corrected or erased, restrict its processing, object to it and receive it in a common format (Art. 15 to 21 GDPR). Write to the address above. You can also complain to a data protection supervisory authority, for instance the one where you live or the one where the provider is established: the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg.