This Privacy Policy explains how GiftCue ("we," "us," "our") collects, uses, and protects information when you use our service at giftcue.app, getgiftcue.com, giftcue.ai, giftcue.org, and any related apps. By using GiftCue you agree to this policy.
GiftCue is operated by BOSSTORQUE (Jason Johnson, sole proprietor), based in Oregon, USA.
GiftCue exists to help one person (the Sender) give a gift to another person (the Recipient). The Sender provides information about the Recipient so we can build a personalized gift picker. This privacy policy treats both groups carefully — and treats the Recipient with extra care, because they didn't choose to share their information themselves.
We do not sell your data. We do not run third-party ad networks or analytics that fingerprint users. We do not share Recipient information with anyone other than the Sender who created their picker.
We use one cookie: giftcue_auth, an HMAC-signed timestamp used to keep you signed in. It's httpOnly, Secure, SameSite=Lax, and expires after 14 days. We don't use tracking cookies, third-party cookies, analytics cookies, or advertising cookies.
| Provider | What they do | What they receive |
|---|---|---|
| Cloudflare | Hosting, CDN, storage, AI image generation | All service data (encrypted in transit + at rest) |
| Anthropic | AI option generation, help-chat | Recipient profile info, help questions |
| Stripe | Payment processing | Payment method, billing info |
| Resend | Email delivery (notifications, magic links) | Recipient email + email body |
| Twilio | SMS delivery (when V1.1 ships, opt-in only) | Phone number + SMS body |
| Yelp Fusion | Real local business data for option curation | Recipient city + category preferences (no PII) |
| Tremendous | Digital gift card delivery | Recipient email (only if Sender chooses to fulfill via gift card) |
Regardless of where you live, you can:
To exercise any right, email privacy@giftcue.app. We respond within 30 days.
California residents have the right to know what personal information we collect, request deletion, and opt out of "sale" or "sharing" of personal information. We don't sell personal information. We don't share it with third parties for cross-context behavioral advertising.
If you're in the EU or UK, our legal basis for processing is: (a) contract for service delivery (generating your picker), (b) legitimate interests for fraud prevention and product improvement, and (c) consent for optional features (marketing email, etc.).
Note: GiftCue is currently a US service. EU/UK users access at their own discretion. We do not actively target EU/UK markets in V1.1.
If you are a Recipient who received a GiftCue link, your information was provided to us by the Sender who built your picker. We don't have your phone number, email, or any contact information beyond what the Sender wrote in the form (typically your first name and city).
If you want us to delete the entire session: email privacy@giftcue.app with the picker URL. We'll honor it within 7 days, which means the Sender will no longer see your pick.
GiftCue is not intended for children under 13. We do not knowingly collect information about anyone under 13. If you believe we have, email us and we'll delete it.
All traffic uses HTTPS / TLS. Authentication is HMAC-signed and httpOnly. Database access is encrypted at rest. We follow standard infrastructure security practices and use Cloudflare's enterprise-grade security platform. No system is 100% secure; we encourage you to use a strong, unique password and contact us immediately if you suspect an issue.
If we make material changes, we'll post the updated policy here and update the "Last updated" date. For users with an account, we'll also email you. Continued use after changes means you accept them.
For any privacy questions: privacy@giftcue.app
BOSSTORQUE / GiftCue
Operated from Oregon, USA
DRAFT v0.1 — drafted by Hugo Mercer, CEO. Not legal advice; not yet reviewed by counsel. Review and ratify before public launch.