Privacy policy

Gifty is an iPhone app that picks random winners from the comments of a public Instagram post or reel, published on the App Store by its developer ("we"). This website, giffty.app, explains the app and offers free browser tools. Contact us at info@giffty.app.

Gifty is not affiliated with, sponsored or endorsed by Instagram or Meta.

• The post you choose. When you paste a link, our server looks up that public post and its public comments (username, profile photo link, comment text, like count and date) through a third-party data provider, so the app can run your draw. We store the post link, post ID, the post owner's username, caption, counts and thumbnail link, plus the time of the request.
• Device and app identifiers. A random device ID created by the app, your push notification ID (if you allow notifications), and your device language code. We use them to run the service, prevent abuse and send optional notifications.
• Purchases. In-app purchases are handled by Apple. We receive purchase status and transaction details through RevenueCat. We never see your card details.
• Usage and diagnostics. App events, crash reports and performance data (Firebase Analytics and Crashlytics), and install attribution (Adjust). If you allow tracking in the iOS prompt, the advertising identifier may be used for attribution; if you decline, it is not.
• Account record. The app creates an anonymous Firebase account linked to the random device ID so your purchases can be matched to your device. It does not ask for your name, email or Instagram password.

Draws themselves run on your phone. Your giveaway credits are stored on your device.

• Analytics. We use Google Analytics 4 to understand which pages help people. In the European Economic Area, the UK and Switzerland, analytics storage stays off until you accept it in the cookie notice. We do not use advertising cookies on this site.
• Free tools. The name picker, wheel, number picker, Secret Santa generator and rules generator run entirely in your browser. Lists you type are saved only in your browser's local storage so they are still there when you come back; they are never sent to us. Share links and Secret Santa links carry the names after the # in the link, a part browsers do not send to our server.
• Post preview. When you paste a public Instagram post or reel link, our server fetches that post's public card (account name, picture, caption, comment and like counts) and up to 15 of its newest public comments (username and text) from Instagram and shows them only to you. We keep them in a short-lived cache for up to 30 minutes, do not save them in a database, do not show commenters' profile pictures and keep these results out of search engines.
• Server logs. Our host keeps standard logs (IP address, browser, requested page, time) for security and troubleshooting.

We share data only with providers that help us run Gifty, under their own terms and privacy policies: Apple (App Store and purchases), Google Firebase and Google Analytics (analytics, crash reports, anonymous accounts), RevenueCat (purchase status), Adjust (install attribution), OneSignal (push notifications), HikerAPI (public Instagram post and comment lookups) and our web host. We do not sell personal data.

Post lookups and device records are kept while they are useful for running and securing the service and are deleted on request. Analytics data in Google Analytics is kept for 14 months. Crash reports follow Firebase's retention periods.

• Turn off notifications or tracking at any time in iOS Settings.
• Ask us to access or delete the data linked to your device ID by emailing info@giffty.app. The app shows your device ID in the feedback email it prepares, which helps us find your records.
• Depending on where you live (for example under the GDPR, the UK GDPR, Brazil's LGPD or California's CCPA), you may have rights to access, correct, delete or port your data and to object to processing. We answer requests within 30 days.

Gifty is not directed to children under 13 and we do not knowingly collect their personal data.

We will update this page when our practices change and show the new date at the top.