Privacy Policy

This policy explains what personal data Posy collects, why, and what you can do about it. Posy is the data controller for that data under UK GDPR and the Data Protection Act 2018.

1. What we collect

• Account data — your email address, a hashed password, and optionally a display name, avatar image URL, language and currency.
• Event data — events you create or join, gift ideas, notes, prices, who is a member of an event and in what role, RSVPs, reservations, Secret Santa draws, and recorded pool contributions.
• Photos — the cover photo you choose for an event, and a team logo if you add one. You pick the image from your device; it is uploaded to our server and stored there, and everyone in that event can see it.
• Settings — your notification and privacy preferences, and your block list.
• Device identifiers — if you turn push notifications on, we store the Firebase Cloud Messaging registration token for your installation of the app, so a notification can be delivered to it. On iPhone that token is issued through Apple Push Notification service (APNs). It is deleted along with everything else when you erase your account.
• Technical data — the requests your app makes to our API, and error logs. We use these to keep the service working and secure.

We do not collect payment card details, we do not track you across other apps or websites, and we do not sell your data to anyone. Ever.

2. Why we use it, and our lawful basis

• To run the service you asked for — creating events, showing wishlists, hiding reservations from recipients, sending invites. Lawful basis: performance of a contract.
• To keep Posy safe — moderation, reports, blocks, abuse prevention, security logging. Lawful basis: legitimate interests.
• To send you notifications you have turned on. Lawful basis: consent, which you can withdraw at any time in Profile → Notifications.
• To meet legal obligations where one applies. Lawful basis: legal obligation.

3. The surprise rule

Posy is built so a recipient cannot learn who reserved or bought a gift for them, or who contributed what to a pool for them. This is enforced by the service itself, not merely hidden in the interface, and it is not something you or we can switch off for an event you are the recipient of.

4. Who we share it with

Other members of an event see what that event requires them to see — for example, your display name and the gifts you added — and never more than the surprise rule allows. Beyond that we share data only with the service providers we need in order to operate. They act on our instructions and may not use your data for their own purposes:

• Hosting and database — our server and database provider stores everything above.
• Push notifications — Google Firebase Cloud Messaging receives a device token and the text of a notification, if you have turned push on. On iPhone, Firebase delivers it through Apple Push Notification service (APNs), so Apple receives the device token and the notification too.
• Email delivery — Brevo (Sendinblue) receives the email address of anyone you invite by email, together with the event title, so the invitation can be sent.
• AI gift suggestions — if you use the gift concierge, OpenRouter and the model provider behind it receive the text of your request. Do not put anything confidential in it.

We will disclose data if the law requires it.

5. Where your data lives

Posy’s servers are in the United Kingdom / European Economic Area. If any provider we use processes data outside the UK, we rely on an adequacy decision or the UK International Data Transfer Agreement.

6. How long we keep it

We keep your account data for as long as your account exists. If you erase your account, your account, events, gifts and reservations are deleted immediately and are not recoverable. Backups and security logs are kept for a short retention period and then rotate out. See Delete your account.

7. Your rights

Under UK GDPR you have the right to:

• access your data — Profile → Privacy settings → Download my data gives you a JSON export of your account details, the events you own, your memberships, the gifts you added and the reservations you made;
• erase your data — Profile → Privacy settings → Erase my account does it immediately and permanently;
• rectify your data — Profile → Account details;
• restrict or object to processing, and to data portability;
• withdraw consent for notifications at any time.

Ask us anything about your data at hello@overclockminds.co.uk. If you are not satisfied with our response you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Cookies and local storage

Posy stores your sign-in token and a small number of preferences on your own device so you stay signed in. We do not use advertising or third-party tracking cookies.

9. Children

Posy is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We will post any change here and, if it is material, tell you in the app before it takes effect.