Privacy Policy

Effective 2026-10-19 · Version 3

1. Who we are

You Shouldn’t Have is operated by AI Eh By Solutions, a Canadian company (“we”, “us”), 51 Earle St, Grand Falls-Windsor, NL A2B 1H5, Canada. We are responsible for the personal information we hold and follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector.

Our Privacy Officer is the person in charge of the protection of personal information and handles questions, requests and complaints: privacy@ai-eh-by.ca. For anything else, write to contact@youshouldnthave.ca.

This policy covers every part of You Shouldn’t Have:

• the website youshouldnthave.ca;
• the web app at app.youshouldnthave.ca;
• the iOS app and the Android app (“the apps”);
• the emails and notifications we send.

2. What we collect

Account

Your name, email address, the ID your sign-in provider gives us (Google, Apple where offered, or your email address and password), your language, time zone and display theme. If you sign in with an email address and password, the password is handled by Google Identity Platform; we never see it or store it in readable form. If you use Sign in with Apple, we keep an encrypted Apple token so we can revoke our access when you delete your account. Optionally, your country and postal code, used only to estimate delivery times (section 13.3); we never ask for your street address and never use your device’s location.

Content

• Events: what organizers enter: title, description, date, time, time zone, location, budget, draw rules (households and pairs who should not draw each other), a shipping address for a registry if the organizer adds one, and the names, email addresses and (optionally) phone numbers and households of the people they invite. If someone invited you, we received your name and email address from them. We do not send text messages or make calls today.
• Gift ideas and registries: your interests, notes (for example sizes) and the gift links you add; registry items, who claimed or bought them, and gift status.
• Messages: anonymous questions and answers in Secret Santa threads.
• Secret Santa pairings: who gives to whom, stored encrypted (section 13.1).
• Calendar: if you create a calendar feed, a secret link token stored only as a hash; if you connect Google Calendar, an encrypted Google refresh token and the ID of each event we add to your Google Calendar (section 13.5).

Device and usage

• Delivery records: for each email and push notification, the address or account it went to, the type of message, the language, the time and whether it was delivered. Never the content of an email; for push, only the title.
• Notifications: if you turn on push notifications, your browser’s push address and keys (web) or your device’s push token (apps); your notification choices and quiet hours.
• Consent records: the versions of these terms and this policy you accepted, and your push opt-in, with the date and time, language, where you accepted (website, iOS or Android) and how, the wording you saw for push, IP address and browser or app.
• Technical: our hosting keeps request logs (IP address, browser or app, time, page and errors) for security and troubleshooting. We use no advertising or analytics tools, no crash-reporting tools and no third-party trackers.

This website

• Forms: what you send through the contact, support or account deletion forms (name, email address, topic, message, and the page and language you used). We store it in our database in Canada, with whether it was delivered, and send it to our team by email.
• Theme setting: if you choose light or dark, your browser remembers it (section 8).
• Cookies: the website sets none.

The apps (iOS and Android)

• Sign-in on your device: Google sign-in uses Google’s sign-in on your device (Google Sign-In on iOS, Credential Manager on Android); Sign in with Apple, where offered, uses Apple’s sign-in. They give us the same account details as on the web (name, email address, provider ID). The sign-in itself stays in the app’s own storage on your device (section 8).
• Push notifications: the only permission the apps ask for is notifications, and only when you turn them on. When you do, Firebase Cloud Messaging (Google) gives the app a push token, which we store with the platform (iOS or Android), the app version, and when it was registered and last seen. On iOS, Firebase passes notifications to Apple Push Notification service (APNs). The Firebase Cloud Messaging library on your device also creates an installation identifier that Google uses to deliver notifications.
• Device data: the platform (iOS or Android) and the app version, sent with your push token; our hosting logs see the app’s requests like any other (IP address, time, errors).
• What the apps do not use: no location, contacts, camera, photos, microphone or calendar permission, and no advertising identifier (it is removed from the Android app).
• Storage on your device: a few settings (section 8). Files you download (your data export, calendar files) are saved to the app’s temporary storage and handed to your device’s share sheet.

3. Why we use it, and what we never do

We use this information only to run the service: sign you in, send invitations, make the draw, deliver anonymous messages, show wishlists and registries, look up gift links, estimate delivery, send the reminders and notifications described in the app, keep the service secure, record your consent and comply with the law.

We never sell personal information, never use it for advertising or to build advertising profiles, never track you across other websites or apps, and never give your content to anyone to train AI models. The draw is random and the app makes no automated decisions with legal or similarly significant effects.

4. Consent

By creating an account or joining an event you agree to this use; the sign-in screen says so, and we record which versions of the terms and this policy you accepted. Organizers confirm they have permission to add the people they invite.

Optional features start off and are separate choices, never bundled with sign-in: push notifications (each type separately), the daily registry summary email, the calendar feed and Google Calendar, and the postal code. You can withdraw consent at any time: change Settings, turn off notifications on your device, use an email’s unsubscribe link, disconnect Google Calendar or delete your account. Without some information (for example your email address) you may not be able to take part in events.

5. Who we share it with

• Other participants, as described in sections 13.1 and 13.2.
• Service providers that process data for us, only to provide the service:
  • Google Cloud (Canada): app servers, database, Secret Manager, scheduled tasks, backups and logs, in the northamerica-northeast1 region (Montréal); pages may be delivered through Firebase Hosting, Google’s worldwide network.
  • Google Identity Platform (United States and other countries): sign-in, including email and password and Sign in with Google.
  • Apple (United States), if you use Sign in with Apple where offered: sign-in and the token we revoke at deletion.
  • Google Workspace (Gmail API, United States and other countries): sends our emails from noreply@youshouldnthave.ca, and delivers website form messages to us.
  • Firebase Cloud Messaging (Google, United States) and, on iOS, Apple Push Notification service (United States), if you turn on notifications in the apps: your push token and the notification.
  • Your browser’s push service if you turn on notifications on the web: Apple (Safari), Google (Chrome and most Android browsers), Mozilla (Firefox) or Microsoft (Edge). It receives your browser’s push address and the notification, encrypted so only your browser can read it.
  • Google Calendar (United States), only if you connect it: the events we create for you (section 13.5).
• Retailers’ websites: when you paste a link, our servers (not your device) fetch that page (section 13.3); no personal information is sent.
• Legal reasons: when the law requires it, or in a sale or transfer of our business (we will tell you).

6. Where it is stored and transfers

Our database, backups and logs are in Canada (Montréal). Some providers above (sign-in, email, push services, page delivery and Google Calendar) may process data outside Quebec and Canada, including in the United States, where courts and authorities may be able to access it under local law. We use providers that protect the information by contract and with security measures comparable to ours, and we send them only what they need.

7. How long we keep it

• Account data (profile, notification choices, consent records, calendar connection, wishlists and messages you wrote): until you delete your account (the calendar connection also ends when you disconnect).
• Push subscriptions and app push tokens: until you turn notifications off, sign out on that device or delete your account; deleted sooner when the push service reports them invalid, or after 60 days without being renewed.
• Events (with their participants, wishlists, messages, items and claims): until an organizer deletes the event, or until its owner deletes their account with no co-organizer left. Events are closed 30 days after their date but not deleted automatically.
• Delivery records: 13 months after the email or notification was sent, or sooner if you delete your account.
• People invited who never joined: 90 days after the event date, their name, email address, phone number, delivery records and invitation link are deleted.
• Link lookups: about 7 days (section 13.3).
• Organizer audit log (draws, changes and troubleshooting reveals): 2 years after the event date, or 2 years after the event is deleted if it is deleted before its date.
• Short-lived security records (sign-in and other attempt counters, Google Calendar connection requests and troubleshooting confirmations): 30 days at most; deleted right away when you delete your account.
• Unsubscribes and bounces: a one-way hash of the address (not the address itself) with the email type, kept so we never write to it again against your wishes.
• Backups: copies of the database made before each update of the app, stored in Canada: 35 days.
• Hosting logs: 30 days.
• Website form messages: 13 months after you send them in our database (then deleted automatically), and in our email for as long as needed to handle your request.

8. Cookies and storage on your device

We use no advertising or analytics cookies. What we keep on your device:

• Web app: one cookie, __session (HttpOnly, Secure, 14 days), keeps you signed in; deleted when you sign out. The sign-in library (Firebase) keeps your sign-in in your browser’s IndexedDB; cleared when you sign out. In your browser’s local storage: youshouldnthave.lang (language), youshouldnthave.theme (theme), youshouldnthave.auth.lastProvider (which sign-in method you used last, so the sign-in screen can mark it; never your email), youshouldnthave.installBanner.dismissed (you closed the install banner). In session storage, cleared when you close the tab: youshouldnthave.pendingLink (a sign-in in progress while you link two sign-in methods), youshouldnthave.pendingReauth (a confirmation in progress in Settings), youshouldnthave.justJoined (to offer notifications right after you join). The service worker caches the app’s own files (no personal data) so it opens quickly.
• Website: youshouldnthave.theme in local storage if you choose light or dark (an older key, ysh-site-theme, is moved there and removed). No cookies.
• Apps: the sign-in (Firebase, IndexedDB inside the app) and the settings above in the app’s storage, plus youshouldnthave.push.device (which push registration this device made). youshouldnthave.auth.lastProvider is kept with Capacitor Preferences (UserDefaults on iOS, SharedPreferences on Android). On iOS, the app’s storage can be included in your device backups; the Android app turns backups off.
• When it is cleared: signing out removes the session cookie, the sign-in and this device’s push registration. Account deletion also removes youshouldnthave.auth.lastProvider. The language, theme and banner settings stay until you clear your browser’s site data or uninstall the app.

9. Your rights

• Access and export: Settings > Download my data gives you a copy of your data in a structured, commonly used format (JSON).
• Correction: edit your profile in Settings; ask an organizer to fix event details they entered.
• Withdraw consent: section 4.
• Deletion: section 10.
• Other requests: write to our Privacy Officer at privacy@ai-eh-by.ca to ask for access, correction, deletion or information about how we use your data. We answer within 30 days.
• Complaints: contact our Privacy Officer first. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

10. Account deletion

Delete your account in the web app or the apps from Settings > Delete account, or without the app from the account deletion page at youshouldnthave.ca/delete-account. That page lists exactly what is deleted right away and what is kept, and for how long: in short, your account, profile, push registrations, consent records, calendar connection, wishlists, messages you wrote and delivery records are deleted; events you own pass to a co-organizer or are deleted; organizer audit entries (2 years), unsubscribe hashes, backups (35 days) and hosting logs (30 days) are kept for the periods in section 7.

11. Security, breaches and risks

Encryption in transit (HTTPS) and at rest, sealed pairings, encrypted calendar and Apple tokens, database access limited to the app’s own service account, session cookies that are HttpOnly and Secure, and logging of sensitive actions. No system is perfectly secure, and anyone who has your calendar feed link or an open registry link can see what it shows. We keep a record of every privacy breach (confidentiality incident). When a breach creates a real risk of significant harm (a risk of serious injury under Quebec law), we notify the people affected and the Office of the Privacy Commissioner of Canada and, for people in Quebec, the Commission d’accès à l’information, as the law requires.

12. Children

Accounts are for people 14 and older (section 2 of the Terms of Use). We do not knowingly collect information from children under 14 without the consent of a parent or guardian. An organizer may include a child under 14 in an event only with a parent’s or guardian’s permission, using the parent’s or guardian’s email address. If you think a child under 14 has given us information without that consent, contact us and we will delete it.

13. Product features

13.1 Secret Santa secrecy

Pairings are encrypted with a key kept in Google Cloud Secret Manager, so they cannot be read even by looking in the database. Each person sees only who they give to; the person who gives to you sees your name, interests and wishlist. Organizers see a status table (joined, has seen their match, wishlist ready, gift status, unanswered questions, last email delivery) that never shows pairings. An organizer can reveal one person’s match only through a troubleshooting tool, after two confirmations, typing that person’s name and giving a written reason; each reveal is logged (who revealed, whose match, the reason and the time) and shown to all organizers of that event. Anonymous messages never show the giver’s identity to the recipient, and notifications never say who you are matched with.

13.2 Registries

Organizers see who claimed or bought each item; other guests see only how many are still available. A shipping address, if the organizer adds one, is shown only to organizers and guests who have joined. Anyone with an open registry link sees the event title, date and description, the organizer’s first name and the items, never who claimed them.

13.3 Link lookups and delivery estimates

When you or an organizer paste a link, our servers fetch that web page to read the product name, picture and price. Amazon pages are the exception: we never fetch them, so for an Amazon link we take the product name from the link itself, show no picture and no price, and the app says “See price on Amazon”; an Amazon price counts as unknown for budget checks. The retailer sees a request from our servers, not from your device. The result (the link and the product details, not who pasted it) is reused for 24 hours and deleted after about 7 days. For stores we have no affiliate program with, we keep the website name, a count, the first and last dates it was seen and one example link, not who pasted it, to decide which programs to join. Delivery estimates are calculated by us from typical times we set for each store and your country and postal code; nothing about you is sent to the store.

13.4 Affiliate links

When we take part in a retailer’s affiliate program, links to that retailer carry our affiliate tag and are listed first among places to buy. We do not send your personal information to retailers. When you follow a link to a store, you leave our service: the retailer (for example Amazon, which may process data in the United States) may set its own cookies and handles your data under its own privacy policy. We do not receive your purchase details from retailers beyond what their affiliate programs report to us.

13.5 Calendars and Google Calendar

“Add to calendar” links open Google Calendar, Outlook, Office 365 or Yahoo with the event’s title, date, place and a link to the event; that provider receives them when you choose it. Your calendar feed link shows your events and deadlines to anyone who has it; you can replace or remove it in Settings.

If you choose to connect Google Calendar (when offered), Google asks you to give us access with the Google Calendar scope “calendar.events”. We use that access only to create in your primary Google Calendar one event for each You Shouldn’t Have event you organize or have joined, to update that same event when the event changes (connecting again or adding the event again updates it; it never adds a copy), and to delete it when the event is deleted or you leave it. We do not read, change or delete any other event, and we use nothing from your calendar for any other purpose. We store the Google token encrypted, with the ID of each Google event we created. When you disconnect or delete your account, we delete the events we created from your Google Calendar (where Google still lets us), revoke our access with Google and delete the token; you can also remove our access at any time at myaccount.google.com/permissions (the events we added then stay in your calendar until you delete them). You Shouldn’t Have’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (developers.google.com). We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except with your consent, for security, or where the law requires.

13.6 Emails and notifications

All our emails are about events you organize, joined or were invited to: invitations (sent at an organizer’s request and naming that organizer), match notices, questions and answers, reminders and, only if you turn it on, a daily registry summary. We do not send marketing or promotional emails. Every email identifies You Shouldn’t Have and AI Eh By Solutions, with our mailing address (51 Earle St, Grand Falls-Windsor, NL A2B 1H5, Canada) and our contact address (contact@youshouldnthave.ca), and has an unsubscribe link for that type of email that works without signing in and takes effect right away. You can also choose each email type in Settings > Notifications.

Push notifications, on the web and in the apps, are off until you turn them on; you choose each type, and none is sent during your quiet hours (22:00 to 07:00 unless you change them). Notifications show on your lock screen, so they never say who you are matched with. They pass through the push services in section 5.

14. Changes to this policy

We post every change here with a new version number and effective date, and record it in our changelog. We tell you about material changes in the app or by email before they take effect, and the app asks you to accept the new version before you continue.

15. Contact

Privacy Officer: privacy@ai-eh-by.ca. General contact: contact@youshouldnthave.ca. By mail: AI Eh By Solutions, 51 Earle St, Grand Falls-Windsor, NL A2B 1H5, Canada.

This policy is available in English, French and Spanish, and each version has the same effect.