Privacy policy
Last updated: July 29, 2026
XmasGoat is built in Canada and follows the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA): accountability, purpose identification, consent, limiting collection, limiting retention, safeguards, openness, and individual access.
What we collect, and why
We collect only what the service needs to run:
- Email address — used to send you a one-time sign-in code and messages about your own exchange (invitations, draw notifications). We ask for it exactly where it is needed, and we tell you why beside the field.
- Display name — shown to the other members of your gift exchange.
- Group membership, wish lists, and game state — the content of the exchanges you join.
- Limited gift-idea interactions — whether you saved or skipped a suggestion, used only to improve what we show you.
We do not collect ages or birth dates, we do not run third-party advertising trackers, and we never sell participant information.
Who can see what
- Secret Santa assignments are visible only to the giver — organizers cannot list them.
- Wish lists are visible only inside your exchange.
- Public pages never show participant names.
Retention and deletion
- Finished exchanges are archived automatically 90 days after their last activity.
- Organizers can delete their exchange at any time, which removes its data.
- You can request deletion of your account, or an export of your data, by emailing naturelionmushrooms@outlook.com. We respond within 30 days.
- Private administrative reference images are stored in non-public storage and purged automatically once they are no longer needed.
Children
We do not knowingly require young children to create independent accounts. For exchanges involving children, an adult should manage their participation. Gift recommendations are never targeted directly to children.
Safeguards
Sign-in uses one-time email codes — there are no passwords to steal. Data access is restricted with row-level security so each person can only read what belongs to them or their exchange. Rate limiting protects sign-in endpoints from abuse.
Emails we send are transactional and focused on your exchange — sign-in codes, invitations, and event updates. Joining an exchange never bundles a marketing opt-in. Any future commercial email would follow Canada's Anti-Spam Legislation (CASL), including consent and unsubscribe requirements.
Contact
Questions about this policy or your information: naturelionmushrooms@outlook.com. See also our terms of use and affiliate disclosure.