Privacy policy

Last updated: 2026-09-06

Who is responsible

MijnSintlijstje is a small, non-commercial website run by Gerben de Graaf. You can reach me at privacy@mijnsintlijstje.nl for anything in this policy.

What we store

Your account:

• Your username, email address, name and preferred language.
• Your password, stored only as a salted hash. If you sign in with Google, no password is stored at all.

If you sign in with Google:

• Your name, email address, profile picture link and language, as provided by Google.
• We do not store Google access tokens, and we cannot read anything else in your Google account.

What you create on the site:

• The Secret Santa parties you make: name, description, budget and instructions.
• Your wish list: item names, descriptions, prices and links you add.
• Who drew whom, and which gifts have been marked as bought.
• Email addresses you enter to invite other people.
• A record of the emails the site has sent you.

Technical data:

• A session cookie so you stay signed in, and a cookie remembering your language choice.
• Failed sign-in attempts, including the IP address, to block password guessing.
• Standard web server logs, which include IP addresses.

We use no analytics, no advertising and no tracking cookies, and we never sell your data.

Why we may store it

We process your account details and the things you create because they are needed to provide the service you signed up for. We keep sign-in attempts and server logs on the basis of our legitimate interest in keeping the site secure and working.

Who can see it

• Other participants in a party you join can see your name and your wish list.
• Whoever drew your name sees your wish list; you cannot see who drew you, and you are not shown which of your own gifts have already been bought.
• Our email provider handles messages the site sends, such as invitations and password resets.
• Nobody else. We do not share data with advertisers or analytics companies.

How long we keep it

• Your account and the things you create are kept until you ask us to delete them.
• Failed sign-in records are cleared automatically a short time after the attempt.
• Server logs are rotated and deleted after a few weeks.

Deleting your data

Email privacy@mijnsintlijstje.nl from the address on your account and ask us to delete it. We will remove your account, your wish lists and your participation in any party, normally within 30 days. Parties you created are deleted along with your account, which also removes them for the other participants, so tell them first if that matters.

If you signed in with Google or Facebook, disconnecting the site from that provider stops future sign-ins but does not by itself delete your data here. Email us for that.

Your rights

You can ask for a copy of your data, have it corrected, have it deleted, or object to how we use it. Write to privacy@mijnsintlijstje.nl. If you are unhappy with how we handle your request, you may complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes

If this policy changes we will update the date at the top of this page.