Privacy Policy

Effective November 3, 2026 · Updated November 5, 2026

Christmas HQ (ChristmasHQ.app) is run by elSwan Apps ("we", "us"). This policy explains what we collect when your family uses Christmas HQ, why, who helps us run it, and the choices you have. The short version: we collect what the app needs to work, we don't sell it, we don't show ads, and we don't track you around the internet. A few links to Amazon may earn us a small commission (see "Amazon links" below).

What we collect

From the family organizer and other adults

Email address, to send sign-in links and invitations, and the Sunday email if you turn it on. There are no passwords.
Name and role (for example "Amy, Mom"), an emoji if you pick one, and the family's name, color theme and mascot.
Payment records, only if we offer paid plans in a future season and you buy one: which plan, the amount, the season and a Stripe reference number. Your card details would go straight to Stripe; we never see or store them. Christmas HQ is free this Christmas.

About everyone in a family

Wish lists: what you add, such as item names, links, prices, sizes, notes and pictures (an image link). You can't upload photos to Christmas HQ.
Gift activity: who has claimed or bought a gift, its stage (bought, arrived, wrapped), what was paid and notes on where it's hidden. The app never shows this to the person the gift is for.
Family plans: events you add (title, date, time, place, notes), who's going and who's bringing what.
Fun tab: movies watched, ratings and Christmas checklist ticks, and any Christmas favorites you share (such as a favorite movie, food or memory). Your favorites stay hidden from the rest of your family until Christmas Day, when the family sees them in a "Who said it?" quiz. They are never shown outside your family.
A PIN for people 13 or older who sign in with the family code instead of email. We store only a scrambled (hashed) version, never the PIN itself.

Automatically

One sign-in cookie, so you stay signed in. It lasts 30 days from the last time you opened the app. We use no advertising or analytics cookies.
Your device keeps a copy of the app and your family's last-loaded lists so it works offline, plus small preferences such as the family name. This stays on your device.
Basic server logs kept by our hosting provider for a short time to keep the service running and secure. Examples: that a sign-in happened, a family was created, or a payment went through, plus standard request details such as IP address and browser type. If the app hits an error on your device, it sends us the error message and the screen it was on, never your lists or names.
When a family signs up, we get an email with the family's name and the organizer's name and email, so we can welcome you and spot misuse. Nothing else about your family.
Problem reports. If you use "Report a problem", we get what you write, your email if you give it, the app version, the screen you were on, your text size and your type of device and browser, plus your name and family if you're signed in. It reaches us by email (sent through Resend). We use it only to fix the problem and reply to you.
Limits on sign-in tries. To stop people guessing family codes and PINs or sending floods of sign-in emails, we count recent tries from each internet address. We store only a scrambled (hashed) version of the address, and the counts expire within an hour.

Children

Christmas HQ is made for whole families, but children under 13 don't use it themselves. They have no account, no sign-in and no PIN. A grown-up in the family creates the child's profile, and the organizer, a Santa's helper, or a parent the organizer picks for that child adds the child's wishes and checklist ticks for them. The organizer must be the child's parent or guardian or have their permission. A grown-up can show a child their list on the grown-up's own device, on a screen that doesn't reveal anything about who's buying what.

About a child under 13, we keep only what their family enters: a first name or nickname, a role such as "Son", an emoji if a grown-up picks one, their wish list, and their movie and checklist entries. We never ask for a child's email address, phone number, home address or any other contact details. Everything stays inside their family's private Christmas HQ. We don't use children's information for advertising, and we don't sell it or share it except with the service providers listed below, only to run the app.

Teenagers 13 and older can be given a PIN by the organizer to sign in themselves. If we learn that a child under 13 has been signing in, we'll remove their sign-in. A parent can have the organizer change or remove a child's profile, which deletes their information, or email us to review or delete it.

How we use it

To run Christmas HQ for your family: showing lists, keeping surprises secret, the buying desk, plans, calendar links and the leaderboard.
To send sign-in links and invitations you or your organizer ask for.
If you turn it on, a Sunday email for the six weeks before Christmas: that week's family plans and counts of the gifts you're buying (never their names). It's off unless you switch it on, and every one has a link to stop it.
If paid plans return, to process payments and unlock the plan you bought.
To keep the service secure, for example by locking a name after too many wrong PINs, and to fix problems.

We don't sell your information, use it for advertising, or build profiles of you. We don't use your family's content to train AI models.

Who can see your family's information

Your family. Each family is walled off from every other family. Within a family, the app hides what's been claimed or bought from the person it's for, and hides surprises and stocking stuffers from the person they're for and from other kids.
Calendar links. If you turn on "Add to my calendar," your calendar app gets a private link to your events. Anyone you give that link to can see those events. Making a new link turns the old one off.
Service providers who run parts of Christmas HQ for us, and only for that:
- Cloudflare hosts the app and its database.
- Stripe would handle payments, if paid plans return in a future season.
- Resend sends our emails.
Shops you link to. When a wish has a product link and no picture, our server visits that page once to find the product photo, except Amazon pages, which we don't fetch. The shop sees our server, not you. Product pictures then load from the shop's own website, as with any web page. We don't download or store Amazon's product photos.
Amazon links. As an Amazon Associate I earn from qualifying purchases. When you tap an Amazon link in Christmas HQ, including one someone added to a wish, the app adds our Amazon Associates tag on the way (it never changes the link saved on the wish, never replaces someone else's tag, and isn't added for children's accounts, for the Associates account holder's own household, or in emails). Links Christmas HQ makes itself, such as "Add all to my Amazon cart", Gift ideas and the gift idea of the day on Home, carry the tag too. Your browser may tell Amazon that the visit came from Christmas HQ (the site address only, not the page you were on). Amazon may set its own cookies, under Amazon's privacy notice. We never send Amazon your name, email, lists, or anything else about your family. A price typed next to an Amazon link is the family's own estimate, not a price from Amazon.
The law. We may share information if the law requires it, or to protect someone's safety.

How long we keep it

Your family's information is kept while the family uses Christmas HQ.
The organizer can delete the whole family in Family settings. Anyone else can leave the family from the home screen, and anyone signed in by email can delete their account there too (an organizer of a family that still has other people hands the role over, or deletes the family, first). Wishes, claims, plans and Fun tab entries go right away. Payment records are kept for tax and accounting, without the family name attached in the app.
When the organizer removes someone, that person's wishes, claims, plans and Fun tab entries are deleted right away.
Sign-in links and codes expire: 30 minutes for a sign-in, 7 days for an invitation. A sign-in code stops working after 5 wrong tries. Expired sign-in sessions are cleared out.
You can also email us to delete a family or an account. We'll delete it within 30 days, except payment records we must keep for tax and accounting.

Your choices and rights

You can see and change most of your information in the app at any time. You can also ask us for a copy of your information, ask us to correct or delete it, or ask any question about this policy. Email elswanapps@gmail.com. Depending on where you live, you may have extra rights under local law. We'll honor them and won't treat you differently for using them.

Security

We use HTTPS everywhere, store PINs, sign-in tokens and sign-in codes only in hashed form, use one-time sign-in links and codes instead of passwords, and limit wrong PIN attempts. No system is perfectly secure, but we work to protect your family's information and will tell you if something goes wrong that affects you.

Where it's stored

Christmas HQ runs on Cloudflare's network and is operated from the United States. Your information may be processed in the United States and other countries where our service providers operate.

Changes

If we change this policy, we'll update the date at the top. If a change matters, for example a new kind of information or a new way of using it, we'll let organizers know by email or in the app before it takes effect.

Contact

elSwan Apps · elswanapps@gmail.com