Privacy Policy
Last updated 5 November 2026
The short version
We collect as little as we can to make gift lists work. We never sell anyone's data, and we never use children's details for advertising. Family don't need an account. You can see, change or delete your data whenever you like.
1. Who we are
Kinlist (kinlist.co.uk) is run by Adam Ward and Paul Gray, trading together as Kinlist, Chapel Cottage, High Street, Norton St Philip, BA2 7LG. We decide how your data is used, which makes us the "controller" under UK data protection law. Email us at hello@kinlist.co.uk.
2. What we collect from parents
- Your account: your first name, email address and password. We ask you to confirm your email when you sign up. Passwords are stored scrambled, so nobody can read them, us included.
- Your lists: occasion, date, list colour, your note for the family, gift budget and reminder settings.
- Your gifts: the links you paste, and the name, photo, price, size and stars that go with them.
- What happens on your lists: notifications when gifts are bought, held, put back, or come back on the list after a hold ends.
3. What we collect about children
A list is about a child, so we ask for only what the list needs: their first name, age and the event date. If you use gift inspiration, we also store what you tell us they're into.
We never ask for surnames, photos of the child, schools or addresses, and we ask you not to add them in your note. We never sell children's data, never use it for advertising or profiling, and never show it to brands. Lists are made by parents and guardians aged 18 or over; children can't make an account.
4. What we collect from family
- When you pick a gift: the name you give us (it can be "Nana"), which gift you picked and when, and whether you're buying it now or holding it.
- If you hold a gift and ask for a nudge: your email address. We use it for that one reminder and nothing else, and delete it when the hold ends.
- If you tap "Remind me": your email address, used for one reminder before the day.
- On your own phone or computer: we save your name and a code that tells Kinlist which gifts are yours, so you don't have to type anything again. These stay on your device, and clearing your browser removes them.
5. What we collect automatically
Like every website, our hosting provider keeps short-term technical records (such as IP addresses and error logs) to keep Kinlist running and secure. We don't use advertising or tracking tools.
6. Why we use it, and our legal reasons
| What we do | Why | Legal reason |
|---|---|---|
| Run your account and lists | So Kinlist works | Our agreement with you (contract) |
| Send account emails (confirm your email, reset your password) | So you can sign in safely | Contract |
| Show a list to people with its link | So family can pick gifts | Contract with the parent; legitimate interests for family |
| Store children's first name, age and date | The list doesn't work without them | Legitimate interests: the parent wants the list made, we keep it to the minimum and it's what anyone would expect |
| Record bought and held gifts, and end holds after 3 days | So gifts don't double up or get stuck | Legitimate interests |
| Send a nudge before a hold ends, or a "Remind me" email | Because you asked for one | Your consent, which you can withdraw any time |
| Send parents reminders and notifications | So you don't miss the date | Contract; turn them off any time |
| Gift ideas | To suggest presents | Contract (you asked for ideas) |
| Keep Kinlist safe and handle reports | To protect families | Legitimate interests; legal duties |
We don't send marketing emails unless you've said yes. The "Make a Kinlist for your own kids" card only appears on the page; we don't email family about it.
7. Who sees what
- Anyone with the share link: the child's first name and age, the occasion and date, the parent's note and first name, and the gifts. Picked gifts show as "HELD" (with when the hold ends) or "TAKEN", without saying who.
- The parent: the name of whoever bought or is holding each gift, so they can say thanks, unless surprise mode is on. Parents never see a giver's email address.
- Us: only when we need to, for example to help with a problem you've asked about or to check a report.
8. Companies that help us run Kinlist
We only share what each one needs, and they can only use it to provide their service to us.
| Who | What they do | What they get |
|---|---|---|
| Lovable (Sweden), running on Supabase | Hosting, database and logins | Everything stored in Kinlist |
| Lovable's email service, sending from kinlist.co.uk | Account, reminder and nudge emails | Your email address and what the email is about |
| Namecheap (Private Email) | Our kinlist.co.uk inbox | Whatever you send us when you email us |
| Google, through Lovable's AI service | Gift ideas | Age, occasion, budget and interests. Never the child's name or anyone's contact details |
| Shops' websites | We visit a product page to read its name, photo and price | The product link only, no personal data |
When you tap "Buy now", "See it" or "Search now", you leave Kinlist for the shop's or Google's website, and their own privacy policies apply.
We may also share data if the law requires it, to protect someone's safety, or if Kinlist is ever taken over by another business (we'd tell you first).
9. Where your data is kept
Kinlist's data is stored in Europe. Some of our providers, such as Google, may process data outside the UK. When that happens, it's protected by UK-approved safeguards, such as the UK's international data transfer agreement or the UK-US data bridge.
10. How long we keep it
| Data | How long |
|---|---|
| Your account and lists | Until you delete them. Inactive accounts are deleted after 2 years without a login, and we'll email you a month before |
| Givers' names on a list | Removed 6 months after the event date, so you still have them for thank-you notes |
| Nudge emails for a hold | Deleted when the hold ends |
| "Remind me" emails | Deleted once the event date has passed |
| Notifications | 12 months |
| Technical logs | A short time, kept by our hosting provider for security |
When you delete a list or your account, it's gone from Kinlist straight away and its share link shows "This list has been taken down". Our hosting provider keeps backups for a short time, and then they're overwritten.
11. Cookies and storage on your device
We only use what Kinlist needs to work: a cookie that keeps parents logged in, and storage on your device that remembers your name and which gifts you've picked. No advertising cookies and no tracking across other websites. If we ever add tools to count visits, we'll update this policy first and give you an easy way to opt out.
12. Keeping it safe
Data is encrypted on its way to and from Kinlist. Share links use a long random code that can't be guessed, and making a new link switches the old one off. Only the parent who made a list can change it.
13. Your rights
You can ask us to:
- show you the data we hold about you, and give you a copy
- correct anything that's wrong
- delete your data
- stop or limit how we use it, or object to it
- move it to another service
Parents can make these requests for their children. Email hello@kinlist.co.uk and we'll reply within one month. It's free.
14. Complaints
If you're unhappy with how we've handled your data, tell us first at hello@kinlist.co.uk. We'll acknowledge your complaint within 30 days and do our best to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
15. Changes to this policy
If we change this policy in a way that matters, we'll tell you by email or in Kinlist before the change starts.