Privacy Notice

Last updated 15 November 2026

Damon McLaughlin is the data controller for Santa's Christmas List Wishes. This notice explains what we collect, why, and your rights under UK GDPR.

What we collect and why

• Grown-up accounts: email address (optional for a second grown-up who joins with a code) and password. Used to create and secure your account (contract).
• Children's lists: the name and picture you choose for each child, and their 4-number code (stored scrambled, never readable). Used to show each child only their own list (contract).
• Wishes: page links, titles, page pictures and photos you or your child upload, and Santa status notes. Used to provide the wish list (contract).
• Searches: the words typed or spoken into search. Voice is turned into text by the phone itself; we never receive recordings. Search text is sent to our search provider to find results (contract).
• Linked phones: a private device key and phone type, so a child's phone can open only its own list (contract).
• Usage and security data: basic technical logs such as errors, to keep the app safe and working (legitimate interests).

Children

The account belongs to the parent or guardian, who decides what goes on their child's list. Children never see each other's lists, and we don't show children ads or sell any data.

Who we share it with

• Service providers: our hosting and database provider (Lovable Cloud), and our web search and page-picture provider (Firecrawl), which receives search words and shop links but no account details.
• Paddle: our Merchant of Record, which handles the sale of the Family Unlock, payments, tax and invoicing. Paddle collects your payment details directly under its own privacy notice.
• Professional advisers such as accountants or lawyers, when needed.
• Authorities, where the law requires it.

Some providers may process data outside the UK. Where they do, we rely on safeguards such as UK adequacy regulations or standard contractual clauses.

Visitor analytics

We use Lovable's built-in visitor analytics on the published site. It uses no cookies, stores nothing on your device, doesn't keep IP addresses and doesn't identify you. It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links are clicked. These are recorded for every visitor. Detailed data is kept for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable's privacy policy explains how it handles it.

Cookies and storage on your device

We don't use advertising or tracking cookies. The app saves a few essential items in your browser's storage: your sign-in session, which child is chosen, a linked phone's device key, and whether "keep me signed in" is on. The app also loads its fonts from Google Fonts, which receives your IP address when the fonts load.

How long we keep it

We keep your family's data while your account is open. When you remove a child or unlink a phone, that data is deleted. If you ask us to delete your account, we delete or anonymise its data. Purchase records are kept as long as tax law requires.

Your rights

You can ask to access, correct, delete, restrict or move your data, object to how we use it, or withdraw consent. We reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

Security

We use encryption in transit, private picture storage, access rules so each family only sees its own data, and scrambled codes.