Privacy policy
LittleNoted is a small, self-hosted gift and wishlist site run by the person who runs this site for family and friends. There are no ads, no analytics, and no trackers, and nothing here is sold. This page explains what is stored, who can see it, and what leaves this server.
What we store
- Your account: your name, email address, and password (stored only as a one-way hash). If you connect Google, your Google account ID.
- What you add: your wishlists and items (titles, links, prices, images, notes), the people you buy gifts for, your notes about them (sizes, interests, brands, things to avoid), their occasions, and your gift-idea lists.
- Claims: who said "I'll get this" for an item: your account, or the name a guest typed in.
- Friends: who you are connected with, and pending requests.
- Sign-ins: for each signed-in browser or browser extension, the IP address and browser type it signed in from, so sessions can be recognised and ended.
Who can see what
- Your wishlists are visible to your friends here and to anyone you give a share link to. They see your name, never your email address.
- Claims on your wishlists are hidden from you, so gifts stay a surprise. Everyone else viewing the list sees them, so nobody buys the same thing twice.
- Your notes about people and your gift-idea lists are private to you. The people they are about cannot see them, even if they have an account.
- Your email address is visible only to people you are friends with here.
What leaves this server
- Gift suggestions (Anthropic). When you ask for gift ideas, this server sends that person's profile to Anthropic's Claude: relationship to you, age, interests, brands, sizes, things to avoid, your notes, the budget and occasion you entered, and the ideas already on your lists. Their name and birthday are not sent. This happens only when you click "Suggest gifts". Anthropic handles it under its privacy policy.
- Google sign-in. Only if you choose it. Google tells us your name, email address, and Google account ID.
- Online stores. When you add an item from a link, this server downloads that page to read its title, price, and image. Item images are shown straight from the store's website, so the store can see the IP address of anyone viewing the list.
- The browser extension sends the page you are looking at to this server, and only when you click its button.
- Email. Password-reset emails go through an email delivery service.
Cookies
One cookie keeps you signed in. If you claim something as a guest, a second cookie remembers the name you typed so you don't have to enter it again. That's all.
Keeping and deleting your data
Your data is kept until you delete it. You can delete lists, items, people, and occasions at any time, and they are removed from the site. To delete your whole account or get a copy of your data, contact the person who runs this site.
Security
Passwords are stored as one-way hashes. Connections to the site are encrypted (HTTPS), and the API key used for gift suggestions is stored encrypted. No system is perfectly secure, so please don't store anything here you couldn't stand to lose.
Children
Accounts are for people 13 and older. Younger family members can still have wishlists kept for them by a parent.
Changes
If this policy changes, the date at the top will change with it.