Privacy Policy

This policy explains what personal data Call Dibs collects, why, and the choices you have. We have written it to be readable rather than exhaustive. If anything is unclear, email hello@calldibs.uk.

Who we are

Call Dibs (“we”, “us”) is operated by Grasshopper Labs, a company registered in England and Wales (company number 17117225) with its registered office at 22 Stephenson Way, Didcot, OX11 9AU. We are the data controller for the personal data described here. You can reach us at hello@calldibs.uk or by post at that address.

The short version

• On the website you can create and share a gift list, and call dibs, without an account. The iPhone and Android apps need a free account.
• We collect only what we need to run the service: list content, the names and emails people choose to give, and a login if you have an account.
• We do not sell your data, and we do not run advertising trackers.
• Call Dibs never handles money. Group gifts are coordinated between guests off-platform; we hold no payment details.

What we collect

Most personal data is provided directly by you. Some information, such as product titles, prices and images, is obtained from third-party retailer webpages when you choose to import an item.

List content you provide

• The list itself: title, host name, occasion, an optional event date label and note.
• Items you add: title, shop name, product link, price and image. When you paste a product link we fetch that page server-side to read its title, price and image, and we may store a copy of the image. Product images remain the property of their respective owners and are stored solely to display the items you add.
• An optional owner email, used to send your private edit link and to let you recover it later.

Information from guests

• When someone reserves an item (“calls dibs”) they may add a name so others know it is taken. A name is optional.
• A reserver may also leave an optional email, used only to let them know if that gift's link, price or notes change, if it is removed from the list, or if the list is taken down. In the app, this is the email on your account, sent only if you leave the email switch on. It is never shown to the list owner or other guests and never used for marketing. It is kept with the reservation and deleted when the reservation is cancelled or the list is deleted.
• For a group gift, the coordinator and contributors provide a name, email, an optional contact (phone or handle) and a pledge amount. The amount is a figure for coordination only; no payment is taken by us. This information may be visible to the list owner, the group-gift coordinator, and other participants as needed to coordinate that gift.

Accounts

On the website an account is optional: you can make, share and call dibs on a list without one, and an account gives you a single place to find your lists. The iPhone and Android apps require you to sign in. Sign-in is handled by our processor Clerk, which processes your email and authentication details and sets a session cookie. You can sign in with email, Google or Apple; Google and Apple sign-in is also handled through Clerk.

If you save someone else's list while signed in, we store the fact that your account saved that list, and when, so we can show it back to you. Only you can see your saved lists. Saving does not tell the person whose list it is, and it does not give you any access you would not have from the link itself. You can un-save a list at any time, from the list.

Circles

A Circle gathers a group's lists for one occasion on one page. The organiser needs an account. For each member we store the name they join with, their personal Circle link, which lists they brought, and, if they are signed in, their account ID and their account picture. Members of a Circle see each other's names and lists, and the names of other current members who called dibs or chipped in on those lists. A dibs called from a Circle page shows no name anywhere else.

Secret Santa

For a Secret Santa we store the exchange's title, budget, date and note, the organiser's account ID (organising needs an account), and each participant's name, their email where given, and their account ID if they are signed in. The name and email are entered by the organiser when inviting someone, or by the participant when joining by link. A participant's wishlist is an ordinary list. We store who buys for whom after the draw, and keep it secret: the organiser sees participants' names, emails and whether they have looked at their match, but never who has whom. Participants see each other's names, never emails. A participant learns who their own Santa was only if the organiser turned on the reveal, and only after the exchange date.

Reports and safety

If you report a list for abuse, we store the reason and any detail you add so we can review it. We keep records of moderation actions.

Feedback you send us

If you send feedback from the website or the app, we store your message, the category you chose, and the page you were on (with any private link codes removed). If you are signed in we also store your account ID, and we keep an email address only if you give one, so we can reply. Deleting your account deletes feedback you sent while signed in.

Technical data

Our infrastructure provider (Cloudflare) processes standard request data such as IP address and timestamps to deliver the service, apply rate limits and protect against abuse. We use this for security and reliability, not to build profiles of you.

Usage analytics

We count how the service is used so we can see what works and what breaks. This is done on our servers, by our processor PostHog (its EU region), and not by any script in your browser or app. When you do something such as create a list, add or reserve an item, share or save a list, follow a link out to a shop, or open one of our public pages, our server sends PostHog a short event saying what happened. Events carry counts, yes/no flags and categories (for example the occasion, whether an item had a price, the shop's website address, where a visit came from, and whether it was the web, iPhone, Android or the browser extension). They do not carry names, email addresses, list titles, notes, or the private links that give access to a list.

Events about a list are filed under the list's internal identifier, and PostHog is told not to build a profile from them. On the website, events about your visits are filed under a random code kept in a cookie called visitor for up to 180 days, so we can tell that a visit on Thursday came from the same browser as one on Monday. A second cookie, first_touch, remembers for up to 30 days where that browser first came from: the campaign tags on the link you followed, the name of the website that linked to us (such as tiktok.com), the app whose built-in browser opened the link (such as TikTok or Instagram), and the day. When you create a list, Secret Santa or Circle, that event carries the same code and where you first came from, so we can count which places bring people who go on to use Call Dibs. Neither cookie holds your name, email, IP address or anything you typed, and we use them only for these counts, never for advertising.

You can turn both cookies off (see Cookies), and we treat a browser that sends the Global Privacy Control signal as having turned them off. Without them, events about your visits are filed under a code made by scrambling the day's date with your IP address and browser details in a way that cannot be reversed. That code changes every day, so it cannot be used to follow you from one day to the next. Your IP address and browser details are used only to make it and are not passed on to PostHog. The apps and the browser extension set no analytics cookies.

The browser extension

The optional Call Dibs browser extension adds the product you are viewing to one of your lists. It is designed to read as little as possible:

• It only acts when you click it. Opening the extension reads product information (title, price, image address and page address) from the tab you are currently viewing, using a permission the browser grants for that tab only. It does not run in the background, does not read other tabs, and does not collect your browsing history.
• That product information is shown to you first, and is sent to calldibs.uk only if you press Add to list. It is then stored as a list item, exactly as if you had added it on the website.
• If you right-click a link and choose Add this link to Call Dibs, the extension sends that link to calldibs.uk so we can read the product details for you. Nothing is saved until you press Add to list.
• Adding items requires a Call Dibs account. The extension uses Clerk (our sign-in processor, described above) to keep you signed in; its cookie access is used solely for your own session.
• To open quickly, the extension remembers your lists and your last-used list on your device. This snapshot stays in your browser's extension storage and is removed when you uninstall the extension.
• The extension contains no advertising, no analytics trackers, and sends data to no one other than calldibs.uk and our processors listed in this policy.

The mobile app

The Call Dibs app for iPhone and Android sends error and crash reports to our processor Sentry so we can find and fix bugs. A report contains what went wrong (the error and where in the code it happened), your device model, operating system and app version, and timing data for how quickly screens load. If you are signed in, it also includes your account ID so we can tell whether one person or many are affected. It does not include your name or email address, and we do not record your screen. Sentry stores these reports in the EU and deletes them after 30 days.

Push notifications

If you are signed in to the app and allow notifications, we store a push token for your device (a code that identifies the device to the push service), whether it is an iPhone or an Android device, and when it was registered. We use it to tell you when your thank-you list opens, when a gift you called dibs on is removed from a list, and when a list you called dibs on, chipped in on or organised a group gift on is taken down. A notification names the list, and the gift when one is removed. For a Secret Santa it names only the exchange. The data behind it holds only an identifier used to open the right screen. To deliver it, we send the notification and your device's token to Expo, whose push service passes it on to Apple (Apple Push Notification service) for iPhones or Google (Firebase Cloud Messaging) for Android devices. We also keep a delivery ticket for each notification sent, made up of an identifier from Expo and your device's token. It holds none of the notification's text, and we use it only to find out whether delivery failed.

You can choose which notifications you get under More, then Notifications, in the app, and you can turn notifications off for the app in your device's settings. If you do the latter, or uninstall the app, we will stop being able to deliver them.

Emails we send

We send email only about something you have taken part in, through our processor Resend. We do not send marketing email. Depending on what you do, you may get:

• your private edit link, if you give an email when making a list;
• if you left an email when calling dibs: a note when that gift's link, price or notes change, when it is removed, or when the list is taken down;
• for a group gift: a confirmation when you chip in, which includes the organiser's name and contact details; as the organiser, a note each time someone chips in, with their name, contact details and amount, and a reminder before the event; and a note to everyone involved if the gift is cancelled or removed, or the list is taken down;
• for a Secret Santa: your invitation, a note when the names are drawn, a note if your match changes, a note if a gift you called dibs on for your match changes or is removed, or your match's wishlist is taken down, and a reminder before the exchange if your wishlist is empty or you have not called dibs on anything yet. These emails never name your match: you see that only through your personal link.

If you send us feedback with an email address, we may reply to it.

Why we use it, and our lawful basis

Under the UK GDPR we rely on the following bases:

• Contract: to create, display and manage your list and reservations at your request, and to send the transactional messages you ask for, such as your edit link.
• Legitimate interests: to keep the service secure and reliable, prevent abuse, respond to reports, and understand in aggregate how the service is used and where its users come from. We balance these against your rights.
• Consent: for push notifications, which you allow through your device's permission prompt and can switch off at any time, and for any other genuinely optional communications we may introduce in future (for example a newsletter). We do not currently send those, and where we rely on consent you can withdraw it at any time.
• Legal obligation: where we must retain or disclose data to comply with the law.

Who we share it with

We do not sell personal data. We share it only with the service providers (processors) that run Call Dibs, each bound to handle it on our instructions:

• Cloudflare: hosting, our database (D1) and image storage (R2).
• Clerk: authentication, for users who create an account.
• Resend: delivery of transactional email (for example your edit link).
• Sentry: error and crash reporting for the mobile app, stored in the EU.
• PostHog: usage analytics, in its EU region (see Usage analytics above).
• Expo: delivery of push notifications to the mobile app, which it hands on to Apple (iPhone) or Google (Android) to reach your device.

We may also disclose data where required by law, or to protect the rights and safety of users and the public.

International transfers

Cloudflare, Clerk, Resend, Sentry, Expo, Apple and Google may process personal data in countries outside the UK or EEA, including the United States (Expo is based there). Where they do, the transfer is protected by appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.

How long we keep it

We keep list and reservation data for as long as the list exists. Because access works by secret link, an owner can ask us to delete a list at any time and we will remove it and its items, reservations and pledges.

• Deleted lists are normally removed from active systems within 30 days, though copies may persist in backups for a limited period before being overwritten.
• Moderation and abuse-prevention records may be retained for up to 24 months.
• Feedback messages are deleted after 12 months.
• A device's push token is deleted when you sign out in the app, when you delete your account, or when Expo tells us the token no longer works, and it is replaced if the same device is signed in to a different account. Delivery tickets are deleted once the delivery check is done, and in any case within about a day.
• Email delivery logs are kept only briefly, for troubleshooting and abuse prevention.
• Saved lists are kept until you un-save them, or until the list is deleted, at which point the record goes with it.
• If you delete your account, the lists you own are deleted with their items, reservations and group gifts, and your saved lists, push tokens, activity and notification settings are removed. A list we have taken down for breaking our terms is kept as a record of the takedown, no longer linked to you.
• Dibs you called and group gifts you chipped in on or organised on other people's lists are not deleted with your account. They stay, with the name and email you gave, so the list owner's thank-you list stays complete, but they are no longer linked to your account. Your Circle memberships end, with your name and picture removed, and Circles you organised are ended.
• A Circle is kept until its organiser deletes it, which removes its memberships. When someone leaves or is removed, their lists leave the Circle and other members no longer see them.
• Secret Santa exchanges, their participants and the draw are kept after the exchange date, and deleting your account does not remove them, apart from any wishlist your account owns. You cannot yet delete an exchange yourself: email us and we will delete it.

We may keep limited records longer where we have a legal obligation or a clear safety reason to do so.

Your rights

Under the UK GDPR you can ask us to access, correct, delete or restrict your personal data, object to certain processing, or receive it in a portable form. To exercise any of these, email hello@calldibs.uk. We may request information necessary to verify your identity, or your control of the relevant list or email, before acting on a request.

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk, though we hope you will contact us first.

Cookies

Call Dibs sets the cookies needed to run the site. We and our providers may set strictly necessary security and authentication cookies: if you sign in, Clerk sets a session cookie to keep you logged in, and Cloudflare may set security cookies (such as one to tell humans from bots). If you fill in a new Secret Santa or Circle before signing in, we keep what you typed in a cookie for up to an hour, so it is still there when you come back from signing in, and delete it once it is created.

We also set two analytics cookies of our own, visitor and first_touch, described under Usage analytics above. The law lets us set these without asking first because they are ours, are used only to understand and improve Call Dibs, and are easy to turn off. We do not use advertising or cross-site tracking cookies.

Affiliate links

Some product links on a list are affiliate links. Call Dibs is a participant in the Amazon Associates Programme. If you click through to a retailer and buy something, we may earn a small commission, at no extra cost to you. As an Amazon Associate, Call Dibs earns from qualifying purchases.

These links work by redirect: when you tap a buy link we forward you to the retailer (sometimes via an affiliate programme) with a tag that lets the purchase be attributed to us. We do not add advertising or tracking scripts to our own pages to do this, and the tag is not tied to your identity. The retailer you are forwarded to may set its own cookies under its own privacy policy, which is outside our control.

What other users can see

Call Dibs is a sharing tool, so some of what you provide is shown to other people using the same list. Depending on how a list is used, others may be able to see information you choose to provide, including your name, whether you have reserved an item, your group-gift participation and contact details, and notes associated with a list. To protect the surprise, an owner does not see who reserved their own items until after the event date. The exception is a list someone keeps for another person, such as a child, where the person keeping it sees who has called dibs and chipped in. In a Circle, members see each other's names and lists. In a Secret Santa, participants see each other's names, and the organiser also sees their emails. Each participant sees only who they buy for, and the organiser sees no one's match. Only share information you are comfortable other participants seeing.

How we protect data

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration. No online service can be completely secure, so we cannot guarantee absolute security.

A note on shared links

Access to a list is controlled by the secret link, not by a login. Anyone you give a share link to can view that list, and anyone with the private edit link can change it. Share these links only with people you trust.

Children

Call Dibs is not intended for use by anyone under 16 without the involvement of a parent or guardian. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will remove it.

Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above, and for significant changes we will take reasonable steps to let affected users know.

Contact

Questions or requests: hello@calldibs.uk.