Privacy Policy
What Wrapt collects, who it is shared with, and how information about the people you shop for is handled.
Last updated 27 August 2026
Wrapt helps you remember what the people in your life would actually like to receive. Doing that means storing notes about them, so this policy tries to be specific rather than reassuring.
The important thing to understand up front: most of the information in Wrapt is not about you. It is about your friends and family, who have not signed up and have not agreed to anything. That shapes most of what follows.
At a glance
A summary of what Wrapt handles. The sections below are the authoritative version; this table is here so you can see the shape of it without reading all of them.
| Data | Why we have it | Who else sees it |
|---|---|---|
| Your name and email | Sign-in, verification, sending reminders | Resend (email delivery) |
| Your password | Sign-in. Stored only as a bcrypt hash | Nobody — we cannot read it |
| Profiles of people you add | Generating gift ideas for them | Anthropic, per request, to produce suggestions |
| Photos you upload | Building a starter profile from an image | Anthropic. Held in memory only, never written to disk |
| Wishlist and tracker entries | Running the features you use them for | Anyone you send a share link to |
| Page views and product events | Understanding which features get used | PostHog, with share tokens removed |
| Error reports | Fixing crashes | Sentry, without personal identifiers |
| Product search terms | Finding a buy link for an idea | SerpAPI and DuckDuckGo. No profile data, no identifiers |
What we collect
- Your account
- Your name, email address, and a bcrypt hash of your password. We never store your password itself. Email verification is required before an account becomes usable.
- The people you add
- Whatever you choose to record: names, birthdays and other dates, relationship, gender, free-text notes, and structured details such as hobbies, favourites, clothing and shoe sizes, occupation, dislikes and values. This is the bulk of what Wrapt stores, and it describes third parties rather than you.
- Your activity in the app
- Gift ideas generated for each person, which you saved or marked as given, thumbs up/down ratings, wishlist items, and notification preferences.
- Images you upload for analysis
- Screenshots or photos submitted to the AI import feature are held in memory for the duration of the request and are never written to disk or stored in our database. They are transmitted to our AI provider (below) to produce the suggested profile, and are not retained by us afterwards.
- Basic usage analytics
- Page views and a small set of named product events (for example, that a share link was created or opened). Automatic capture of clicks and form input is disabled, session recording is disabled, and share tokens are removed from URLs before analytics data leaves your browser.
Information about people who are not users
If you add someone to Wrapt, we hold information about them supplied entirely by you. They have no account, receive no notification, and cannot see or correct what has been recorded.
We ask you to only record things that person would be comfortable with you writing down, and to only upload photographs you have the right to use. Please do not store sensitive information about anyone — health conditions, religious or political views, sexuality, or anything similar — even where it might feel relevant to a gift.
If you are the subject of a profile someone has created and you want it removed, contact us at hello@wrapt-app.com and we will work with the account holder to resolve it.
Who we share it with
We do not sell your data or the data of anyone in your account. We use the following providers to run the service, and share only what each needs to do its job:
- Anthropic (AI suggestions)
- Profile details for the person you are shopping for are sent to generate gift ideas, along with any image you submit to the import feature. Sent per-request; we do not use this data to train models.
- Neon (database) and Railway (application hosting)
- Store and run the service. All stored data lives here.
- Vercel
- Serves the website and its static assets.
- Resend
- Delivers verification, reminder and price-alert emails. Receives the recipient address and message content.
- PostHog (analytics)
- Receives page views and named product events, with share tokens redacted. Configured not to capture form input or record sessions.
- Sentry (error tracking)
- Receives backend error reports. Configured not to attach personal identifiers, with share tokens stripped from error payloads.
- SerpAPI and DuckDuckGo (product search)
- Receive search terms derived from a generated gift idea — for example a product name. They do not receive profile details or any identifier.
- Amazon
- Some product links carry an Amazon Associates affiliate tag. If you buy through one, we may earn a commission at no extra cost to you. Amazon receives the click as it would any referral.
Shared links
Wishlist and profile share links contain a secret token, and anyone holding the link can view that page without signing in. Treat them like a door key: share deliberately, because we cannot tell an intended recipient from anyone the link was forwarded to.
These pages are excluded from search engines via robots.txt, and error and analytics data has the token stripped before transmission. A link preview generated when you paste a link into a messaging app will show the first name and item count on the list.
Retention and deletion
We keep your data for as long as your account exists. Uploaded images are the exception and are discarded as soon as the request completes.
You can delete your account yourself at any time from Settings. It is immediate and permanent: your account, every contact profile you built, gift suggestions, tracker entries and price history, wishlist, ratings, reminder preferences and notification history are all removed. There is no soft-delete and no recovery window, so export anything you want to keep first.
If you would rather we did it, or you want a copy of your data first, email hello@wrapt-app.com.
Backups are retained for a short period for disaster recovery and age out on their own; we do not restore deleted accounts from them.
Security
Passwords are hashed with bcrypt. Traffic is encrypted in transit. Access to production data is limited to the operator of the service.
No service is perfectly secure, and Wrapt is a small operation. Please do not store anything in it whose disclosure would seriously harm you or anyone else.
Children
Wrapt is not intended for anyone under 16, and we do not knowingly create accounts for them. You may of course record gift ideas for a child in your life; that information is yours, held under your account.
Your rights
Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to certain processing. Email hello@wrapt-app.com and we will honour these regardless of whether the law requires it in your case.
TODO before launch: confirm the operating entity, jurisdiction, and whether GDPR or CCPA obligations apply, and name a data controller.
Changes
We will update this page when the service changes and revise the date above. Material changes affecting how your data is used will be emailed to you.
Questions: hello@wrapt-app.com.