Privacy Policy

1. Scope

This policy covers personal information handled by Alasia Industries LLC, a New York limited liability company doing business as Humbugg (“Humbugg”), when you use our gift exchange service. Humbugg currently serves people in the United States. We aim to collect only what we need to run your exchange.

2. Account information

When you create an account we collect your email address, which our authentication provider (AWS Cognito) holds. Humbugg does not use passwords: we sign you in by emailing you a one-time code. We use your address to sign you in, secure your account, and send account-related messages such as those codes. When you join an exchange, its organizers can see your verified email address so they can reach you about that exchange; other participants cannot.

You can also sign in with a Google, Microsoft, Apple, Facebook or LinkedIn account. When you do, that provider sends us your name, your email address and an identifier for your account with them, and nothing else — we do not receive your contacts, posts or connections, and we never post on your behalf. We use the email address to connect the sign-in to your Humbugg account, so a Google sign-in and an email sign-in with the same address reach the same exchanges. The provider learns that you signed in to Humbugg and when; what it does with that is governed by its own privacy policy, not this one. Apple may give us a private relay address in place of your real one, in which case that is the address organizers see and we write to.

3. Email and invitations

We send transactional email — for example sign-in codes and exchange-related notices. To do this we process the recipient email address and keep a delivery record (such as whether a message was sent or bounced) so we can troubleshoot problems. We do not sell email addresses or use them for unrelated marketing.

The day before an exchange, everyone in it is emailed its time, place and video-call link, when the organizer has set them. You can turn this off with Email notifications in Settings.

4. Exchange and wish-list content

When you organize or join an exchange, we store the details you enter: your display name, the group name and notes, wish lists, avoid-lists, and pairing exclusions. This information is shared within the exchange as needed to run it — for example, a giver can see their assigned recipient’s wish list.

An organizer can also add when the exchange happens, where it meets, and a video-call link. Everyone who has joined the exchange can see these; people who have only been invited cannot.

Address search

Two fields suggest addresses as you type: an exchange’s location, which organizers set, and the first line of your mailing address. For both, we send what is typed to Google’s Places service to suggest matching addresses, and ask Google for the full address of the one picked. The request comes from our servers, so Google receives the search text but not who typed it, their email address, or anything else about the exchange. Google processes these searches under the Google Privacy Policy. Suggestions start after the first few letters, so what is typed is sent even if no suggestion is picked. We store only the address that is saved, and a picked address can be edited before saving.

Adding an exchange to your calendar

“Add to calendar” opens Google Calendar or Outlook with the exchange’s name, time, place, call link and instructions filled in, or downloads a calendar file. Nothing is sent until you choose one, and what you save is then held by that calendar provider under its own terms.

5. Shipping addresses

Providing a shipping address is optional. If you add one, we store it so the person assigned to give you a gift can send it. An address you enter is visible to the participant matched with you and to the organizer of that exchange. Only share an address you are comfortable sharing for that purpose. While you type it, the first line is used to suggest addresses — see “Address search” below.

6. Draw and audit records

When an exchange is drawn we store the private giver-to-recipient assignments so each person can see their match. We also keep audit records of sensitive actions, such as an organizer using an emergency reveal, so there is an accurate history of what happened in an exchange.

7. Analytics and technical data

We keep server and application logs (such as request information and error details) to operate the service, keep it secure, and diagnose problems. We use this technical and usage information in aggregate to understand how Humbugg is used and to improve it. We do not use it to build advertising profiles about you.

8. Cookies and local storage

Humbugg uses strictly necessary and functional storage to run the service, listed in the table below. Our product analytics is recorded server-side, in aggregate, and cannot be tied back to your wish list, address, email, tokens, or assignment (see “Analytics and technical data” above).

We advertise Humbugg on Google. To learn which ads bring people who go on to use it, we ask before using Google’s advertising cookies, with a banner on the marketing site and the web app. If you decline, nothing from Google is loaded. If you accept, the Google tag loads and tells Google Ads when a visit that began with a click on one of our ads goes on to create or join an exchange. Google receives the page address, the ad-click identifier, that conversion, and the technical details any web request carries, such as your IP address and browser. We never send Google your name, email address, wish list, address, exchange details, or who you drew. Google processes this under its own privacy policy. Change your answer at any time with “Cookie settings” in the site footer. Declining after accepting stops the tag and deletes the Google cookies on humbugg.com; cookies Google holds on its own domains are managed in your Google account and browser.

Apart from the cookie choice above, Humbugg’s marketing site (the pages this policy is published on) sets no cookies. It stores one optional key, for your color-scheme choice, only if you use the theme switch in the header — it is never written just by visiting. The table below is everything the marketing site and the Humbugg product app store on your device:

If Humbugg adds any other non-essential cookie or a client-side analytics tool, we will update this section and ask before using it.

9. Payment information

Paid plans are handled by a third-party payment provider. Your card details are entered with that provider — Humbugg does not receive or store your full card number. We keep a record of your plan, purchase, and billing status so we can provide the service you paid for and handle refunds. See our Billing Terms and Refund Policy for more.

10. How we share information

We share personal information only in these situations:

• Within an exchange, with its participants and organizer, as needed to run it.
• With service providers that operate Humbugg on our behalf — for hosting, databases, email delivery, and payment processing — under obligations to protect it. Our current sub-processors, what each one does, and how international transfers are protected are listed on the Sub-processors page.
• With Google, the text typed into an exchange’s location or the first line of a mailing address, as described in “Address search” above.
• When the law requires it, or to protect the rights, safety, and security of people and the service.

We do not sell your personal information.

Requests from public authorities

When a government, court, regulator, or law-enforcement agency asks us for personal information, we:

• check that the request is genuine and has a valid legal basis before disclosing anything;
• refuse or challenge requests that are unlawful or broader than the law allows;
• disclose only the minimum information the request lawfully requires;
• keep a record of every request and how we answered it; and
• tell the people affected before we disclose, unless the law forbids it or an emergency involving a risk of serious harm makes that unsafe — in which case we tell them once we can.

11. Keeping and deleting information

We keep your information while your account is active and as needed to provide the service. You can delete your account, which removes your profile and the exchange content tied to it, subject to a short period needed to complete the deletion across our systems. We may retain limited records where we must for legal, security, or legitimate business reasons — for example, basic billing history and audit records. Backups are cleared on a rolling schedule.

12. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections and access controls. No online service can be completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly to issues.

13. Your choices

You can review and update much of your information directly in Humbugg, and you can delete your account. If you would like help accessing or deleting your information, contact us at support@humbugg.com.

Requesting restriction or objection

Access, rectification, erasure, and export of your information are self-service — use the export and deletion tools in Settings, and the edit screens for your profile, wish list, and address. For a request to restrict how we process your data (Art. 18), an objection to processing (Art. 21), or a change that is not self-service — such as changing the email address on your account — email support@humbugg.com. We may ask you to confirm the request from your account’s own email address before acting on it. We respond within one month; for a complex request we may extend that by up to two further months, and we will tell you if we do.

14. Children

Humbugg is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will remove it.

15. Changes to this policy

We may update this policy over time. When we do, we will change the version and effective date shown at the top of this page.