WHAT WE COLLECT, WHAT WE DON'T.

What we collect

• ●Anonymous gift session data — budget, age range, gender selection, occasion, recipient brief, hard no's, generated message, and recommendations shown.
• ●Recipient email — only if you send the optional e-card. The raw address is sent to the email provider; analytics store a one-way hash, not the address.
• ●A server-side cookie id hash and IP hash — used for abuse prevention and daily rate limits.
• ●First-party events — recommendation generated, buy clicked, and message copied.
• ●Retailer link metadata — merchant, product URL, optional affiliate URL, and cached product image URL.
• ●Outbound click records — when you use a Buy link we log a random click id, the merchant, and the destination URL, used for product ranking and (when affiliate programs are active) commission attribution.

What we don't do

• ●We do not sell, rent, or trade your data.
• ●We do not collect recipient shipping addresses, user emails, or payment card details in the free generator.
• ●We do not place orders, receive merchant tracking, or share a recipient address with retailers.

Affiliate links & cookies

When affiliate partnerships are active, Buy links may route through an affiliate network (such as Sovrn or Skimlinks, or a store's own program) before landing on the retailer. The network may set cookies in your browser so the store can attribute a purchase to that click, and we may earn a commission. Your price is the same either way. We see aggregate click and commission reports — not what you personally bought. Where links are monetized, we say so right on the results page.

How AI handles your gift brief

Your gift brief and structured answers are sent to our AI provider to expand the brief and generate recommendations. We may store a cached expansion and recommendation result so the same brief can be replayed consistently, and we keep limited diagnostic copies to improve reliability.

We are rolling out automated redaction of detailed brief text — across session records, debug traces, prompt traces, excerpts, and event payloads — targeting removal from every operational copy within 90 days of submission. Non-readable fingerprints, product ids, prompt and model versions, and usage totals may be retained beyond that point.

How long we keep it

Gift session and event records are retained for product analytics, abuse prevention, and debugging. Detailed brief text is covered by the redaction rollout described above. You can request deletion of personal data, if any, by emailing hello@thoughtlessgift.com — we'll honor the request unless we're required to keep records for legal reasons.