Privacy Policy

1. Scope

This policy covers personal information handled by Humbugg (“Humbugg”) when you use our gift exchange service. Humbugg currently serves people in the United States. We aim to collect only what we need to run your exchange.

2. Account information

When you create an account we collect your email address and the password credentials handled by our authentication provider (AWS Cognito). We use this to sign you in, secure your account, and send account-related messages such as confirmation and password-reset codes.

3. Email and invitations

We send transactional email — for example confirmation codes, password resets, and exchange-related notices. To do this we process the recipient email address and keep a delivery record (such as whether a message was sent or bounced) so we can troubleshoot problems. We do not sell email addresses or use them for unrelated marketing.

4. Exchange and wish-list content

When you organize or join an exchange, we store the details you enter: your display name, the group name and notes, wish lists, avoid-lists, and pairing exclusions. This information is shared within the exchange as needed to run it — for example, a giver can see their assigned recipient’s wish list.

5. Shipping addresses

Providing a shipping address is optional. If you add one, we store it so the person assigned to give you a gift can send it. An address you enter is visible to the participant matched with you and to the organizer of that exchange. Only share an address you are comfortable sharing for that purpose.

6. Draw and audit records

When an exchange is drawn we store the private giver-to-recipient assignments so each person can see their match. We also keep audit records of sensitive actions, such as an organizer using an emergency reveal, so there is an accurate history of what happened in an exchange.

7. Analytics and technical data

We keep server and application logs (such as request information and error details) to operate the service, keep it secure, and diagnose problems. We use this technical and usage information in aggregate to understand how Humbugg is used and to improve it. We do not use it to build advertising profiles about you.

8. Payment information

Paid plans are handled by a third-party payment provider. Your card details are entered with that provider — Humbugg does not receive or store your full card number. We keep a record of your plan, purchase, and billing status so we can provide the service you paid for and handle refunds. See our Billing Terms and Refund Policy for more.

9. How we share information

We share personal information only in these situations:

• Within an exchange, with its participants and organizer, as needed to run it.
• With service providers that operate Humbugg on our behalf — for hosting, databases, email delivery, and payment processing — under obligations to protect it.
• When the law requires it, or to protect the rights, safety, and security of people and the service.

We do not sell your personal information.

10. Keeping and deleting information

We keep your information while your account is active and as needed to provide the service. You can delete your account, which removes your profile and the exchange content tied to it, subject to a short period needed to complete the deletion across our systems. We may retain limited records where we must for legal, security, or legitimate business reasons — for example, basic billing history and audit records. Backups are cleared on a rolling schedule.

11. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections and access controls. No online service can be completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly to issues.

12. Your choices

You can review and update much of your information directly in Humbugg, and you can delete your account. If you would like help accessing or deleting your information, contact us at support@humbugg.com.

13. Children

Humbugg is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will remove it.

14. Changes to this policy

We may update this policy over time. When we do, we will change the version and effective date shown at the top of this page.