Privacy policy

Wrappie lets you fill an advent calendar with photos, voice notes, videos, notes, coupons and hints, and send it to one person as a private link. This policy explains what data that involves, for the website and the iPhone app.

Who is responsible

Andrei Vychau, ul. Jana Kazimierza 32/122, 01-248 Warszawa, Poland, avychev@gmail.com (controller under the GDPR), NIP 7011055184.

What we store and why

• Calendar content: the names you enter for yourself and the recipient, the wrapping you pick, and what you put in the windows (texts, photos, voice notes, videos, coupons, hints). We store it to deliver the calendar (Art. 6 (1) (b) GDPR). There are no user accounts.
• Opening state: which days were opened, which coupons were used and which gifts were found, with the time. The sender sees this; it is part of the service.
• Reports: when someone reports a calendar we store the time of the report and the gift link it was reported from (that is the only way we can open the calendar to review it), and hide the calendar until we have reviewed it (Art. 6 (1) (c) and (f) GDPR).
• Reviews: if you send us a review, we store its text, the first name you enter and whether you allowed us to publish it. We show it on the website only with that consent and after we have read it, and you can ask us to remove it at any time. Reviews are kept separately and are not deleted with the calendar (Art. 6 (1) (a) and (f) GDPR).
• Server logs: our web server records technical data such as IP address, time and requested address to keep the service secure and fix errors (Art. 6 (1) (f) GDPR). Logs are kept only as long as needed for that.

If you add photos, recordings or videos of other people, make sure they are happy for them to be shared with the recipient.

Encrypted storage

Everything you put into a calendar (both names, every text, photo, voice note and video) is stored encrypted with a key that is derived from the gift link. We keep only a fingerprint of the link, not the link itself, so the key exists on our server only for the moment someone with the link opens the calendar or you edit it. A copy of our database, disks or backups cannot be read, and we cannot browse calendars ourselves.

Who can see a calendar

Anyone who has the gift link can open the calendar; anyone who has the private sender link can edit it. Share them only with the people they are meant for. The links are long random keys that cannot be guessed.

How long we keep it

Every calendar, with all its photos and recordings, is deleted on 31 January after the season. Drafts that were never sent are deleted after 30 days without changes. You can delete a calendar yourself at any time in the editor or the app.

Cookies and storage in the browser

We use no tracking, no advertising and no analytics on the website. We only store what the site needs to work (Art. 399 of the Polish Electronic Communications Law and Art. 5 (3) of the ePrivacy Directive: storage strictly necessary for a service you asked for): your time zone (cookie “tz”, so days open at your local midnight), the editor language (cookie “hl”), the offer of the link you came from (cookie “plan”, so the site keeps showing the prices of that link) and your editing key (cookie “ek” and local storage, so you can come back to your calendar). None of this is shared with anyone.

Payments

Premium is a one-time purchase per calendar. On the website it is sold by our reseller Paddle (Paddle.com Market Ltd, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom), the merchant of record for these orders. At checkout you give your details (such as your email address, country and postcode, and payment details) directly to Paddle. Paddle processes them as an independent controller to take the payment, issue the invoice, meet its tax obligations and prevent fraud, under its own privacy policy. We never see your card details.

Paddle tells us that the calendar has been paid for, and our server checks the order with Paddle (order number, price and calendar). We keep only the fact that the calendar is Premium; we don’t store your email address, the amount or other order details, which Paddle keeps as the seller (Art. 6 (1) (b) GDPR). If you ask about an order or a refund, we look it up in Paddle with the order number or email address you give us. Data goes to the United Kingdom on the basis of the European Commission’s adequacy decision.

In the iPhone app you buy from Apple; we use RevenueCat, Inc. (USA) to confirm those purchases. Where data goes to the USA this is based on the EU–US Data Privacy Framework or standard contractual clauses.

The iPhone app

The app works with the same server and data as the website. In addition it uses:

• Amplitude (Amplitude, Inc., USA) for anonymous usage statistics, without your IP address and without the content of your calendar (Art. 6 (1) (f) GDPR);
• Firebase Crashlytics (Google Ireland Ltd.) for crash reports, so we can fix errors (Art. 6 (1) (f) GDPR);
• RevenueCat and Apple for purchases in the app, as described above;
• push notifications, only if you allow them.

Hosting

The website and all calendar data are hosted by Hetzner Online GmbH on servers in the EU, under a data processing agreement.

Your rights

You have the right to access, correction, deletion, restriction of processing, data portability and to object to processing based on legitimate interests. Write to avychev@gmail.com. You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority in the EU country where you live.

Last updated: October 2026.