Scope
This Privacy Policy explains how [LEGAL ENTITY NAME] ("Pocket Elf," "we," "us") collects, uses, discloses, and protects information in connection with the Pocket Elf mobile application and pocket-elf.com (together, the "Service"). It applies to account holders and, separately, to individuals whose information account holders enter into the Service ("Recipients") see Section 4. The Service is directed to users located in the United States.
Information We Collect
From you directly:
Account information: email address, and a payment reference token held by our payment provider, [PAYMENT PROVIDER] (we never receive or store your card number).
Content you enter: names, dates, relationships, and interest/preference notes for people you add.
Communications: messages you send to support.
Automatically:
Device and usage data: browser type and version, operating system, device type, crash and error logs, in-product interaction events (e.g., feature usage, session length), and, if you turn them on, a browser notification token so we can deliver reminders. Pocket Elf does not access your device's contacts, and does not collect precise or approximate location.
Categories under state law (California and similar frameworks): identifiers (email, device ID); customer records (payment reference); commercial information (subscription history); internet activity; and, depending on the interest notes you choose to enter about Recipients, potentially inferences that fall within "sensitive personal information" see Section 4.
How We Use Information
To operate the Service (send reminders, generate suggestions), to maintain and secure your account, to provide customer support, to improve the Service using aggregated and de-identified usage data, and to comply with legal obligations. We do not use the content you or others' information for automated decision-making that produces legal or similarly significant effects.
Information About Other People (Recipients)
When you add a Recipient, you are entering information about a real person who has not created an account or agreed to this policy. We limit what we collect about Recipients to what you choose to enter for gift-planning purposes: a name (or nickname), a date, and optional interest notes. We do not collect Recipients' contact details, location, or any information from their own online accounts, and we never contact them directly.
Recipients' own privacy rights.
If a Recipient is a resident of a state with a comprehensive privacy law (including California, Virginia, Colorado, Connecticut, and others), they may independently exercise rights over their own information held in our systems including the right to request access to, correction of, or deletion of that information even though they are not our account holder. Because we cannot verify a non-account-holder's identity the way we verify an account holder, we use a manual verification process for such requests: see Section 10.
Sensitive interest notes.
Some interest notes may reveal or imply sensitive categories about a Recipient for example, a religious observance, a health condition relevant to a gift (an allergy, a recovery), or similar. We treat any such notes as sensitive personal information under applicable state law and do not use them for anything beyond generating suggestions for your account. Do not enter detailed health information about any person; the Service is not designed to store health records, and depending on your state, entering certain health-related information about another person may itself carry legal obligations that are yours, not ours, to assess (see our Terms of Use, Section 6).
What We Never Do
We do not sell personal information, as "sale" is defined under state privacy laws. We do not "share" personal information for cross-context behavioral advertising. We do not use the content you or your Recipients' information contains to train machine learning models. There is no exception to these three commitments, and they apply equally to Recipient information.
Who Can See It
A limited number of our staff can access accounts to provide support you request, and every access is logged. Service providers (cloud hosting, customer support tooling, error monitoring, and payment processing) process data on our behalf under contract, are prohibited from using it for their own purposes, and are contractually bound to the same restrictions in Section 5.
Cookies and Tracking
See our Cookie Policy for details on cookies and similar technologies used on pocket-elf.com, and how to exercise choices about them.
Data Retention
We retain account and Recipient information for as long as your account exists. Deleting a Recipient removes their record immediately. Deleting your account removes all associated data, including Recipient information, within 30 days, including from backups.
Data Security
We use industry-standard technical and organizational safeguards, including encryption in transit, to protect information from unauthorized access. No system is perfectly secure; in the event of a security incident affecting your personal information, we will notify you and any applicable regulator as required under applicable state breach notification laws.
Your Privacy Rights
Depending on your state of residence, you may have the right to: know what personal information we hold about you; access a copy of it; correct inaccuracies; delete it; opt out of the sale or sharing of personal information (we do not engage in either, per Section 5); limit the use of sensitive personal information; and not be discriminated against for exercising these rights. To exercise these rights, use the export and delete tools under Settings in your account, or contact support@pocket-elf.com. If you believe our response to your request was inadequate, you may appeal by replying to our decision email; some states additionally allow you to lodge a complaint with your state Attorney General.
Requests from Recipients (non-account-holders).
A Recipient exercising their own rights under Section 4 should contact support@pocket-elf.com. Because Recipients do not hold an account, we will ask for reasonable information to verify identity before acting on the request, consistent with applicable law.
Global Privacy Control
We recognize the Global Privacy Control (GPC) signal from supported browsers as a valid opt-out preference signal where required by applicable law. As stated in Section 5, we do not sell or share personal information regardless of this signal.
Children's Privacy
Pocket Elf does not knowingly collect personal information directly from children under 13. Users aged 13-17 may use the Service only through an account created and controlled by a parent or legal guardian, consistent with our Terms of Use. If we learn that we have collected personal information directly from a child under 13 without verifiable parental consent, we will delete it promptly. Parents who believe their child has provided us information may contact support@pocket-elf.com to request its removal.
Changes to This Policy
If we make a material change, we will notify you by email before it takes effect. The date at the top of this page always reflects the current version.