Privacy notice

Last updated: 1 November 2026

The short version

• Your lists are yours. Only the people you share them with can see them, and they never show up in search engines.
• The person whose list it is never sees who reserved what. On lists that parents manage for a child under 13, the parents do.
• We store your data in the EU. We never sell it, show you ads or build an advertising profile of you.
• AI helps fill in items from links and screenshots, and you always check them before anything is saved.
• We only use the cookies needed to keep you signed in, so there is nothing to accept.
• You can delete everything at any time.

Who we are

Yotekobi is a personal project of Javier Antonio Ramis Borque, an individual based in Spain, who decides how your data is used (the “controller”). Contact: hola@yotekobi.com. For Brazil, Javier Antonio Ramis Borque is also the person in charge of data protection (encarregado).

What we collect

• Your account: your email address, the name you show, your language, currency and time zone, when you confirmed you’re 18 or older, and when you joined and last used Yotekobi. If you add your birthday, only the day and month.
• If you sign in with Google: Google sends us your name, email address, Google account ID and a link to your profile photo. We use your name and email. Our sign-in provider stores the photo link, but we don’t use it.
• Your lists: list names, occasions and dates, items (titles, links, prices, notes, sizes, priority and any images you keep) and who you share each list with.
• Lists for your children: a nickname and an age band (for example, 0–12). Never a photo, date of birth or email for the child.
• Groups: the group’s name and type, each member’s name in that group, their role, when they joined and which lists they share.
• Secret Santa draws: the date, the budget, the exclusions the organizer sets (for example, couples who shouldn’t draw each other) and who drew whom.
• When you reserve a gift: the name you give, what you reserved, how many, whether you bought it, when, and whether you were signed in with a confirmed email.
• If you take part as a guest (without an account): the name you give, your 18+ confirmation, your groups and your reservations.
• Lists you save: when you tap “Save list” on a list someone shared with you, or reserve a gift from it, we keep a note of which list you saved, for your Give page. The person whose list it is never sees it.
• What you ask the AI to read: links, page details, screenshots or photos (with location data removed) and text you paste.
• The Chrome extension (optional): when you click it on a product page, it sends us that page’s product details (name, price, pictures, the size or colour you picked and the description) to draft the wish. It reads nothing until you click, never reads your browsing history and saves nothing until you press Save. For Amazon pages it sends only the link and product name. Its sign-in is a token that expires after 30 days; signing out of the extension or the website disconnects it.
• Notices to gifters: if a list owner edits or removes an item, resets reservations or deletes a list, the people who reserved something get a short notice with the list and item title.
• Technical and security data: IP address, browser type, sign-in events, and error reports with personal details removed. Abuse limits use scrambled (keyed-hash) versions of IP addresses and emails.
• If you tell us you’re under 18: we create no account. For 24 hours we keep a scrambled code of the email you typed (if any), and a cookie with a random code on that browser, so sign-up stays closed. Then both are deleted.
• If you report something: what you reported (its title or name), the reason, your note if you write one, and your account if you’re signed in. The person you report isn’t told who you are.

We never ask for your home address, phone number, gender, contacts or precise location.

What your lists can reveal

Wishes can say a lot about you: sizes, health, beliefs, relationships. Only add what you’re happy for the people who see the list to know. If you add something sensitive, we store it and show it only to the people you chose. We never analyse it, draw conclusions from it or use it for anything else.

Why we use it, and on what legal basis

• To run Yotekobi for you: your account, lists, sharing, groups, draws, reservations, notices, AI capture, and the emails you need, such as sign-in codes and your draw result. Basis: our contract with you (GDPR art. 6(1)(b); LGPD art. 7, V).
• To keep Yotekobi safe: stopping abuse, spam and trolling, limits on repeated actions, the 24-hour under-18 block, checking links against lists of harmful sites, and fixing errors. Basis: our legitimate interest in a safe service for adults (GDPR art. 6(1)(f); LGPD art. 7, IX).
• To understand how Yotekobi is used, with pseudonymous statistics (see “Statistics”). Basis: legitimate interest (GDPR art. 6(1)(f); LGPD art. 7, IX). You can object at any time.
• To comply with the law and answer lawful requests. Basis: legal obligation (GDPR art. 6(1)(c); LGPD art. 7, II).

We don’t sell your data or share it for advertising, we don’t build ad profiles, and we don’t make automated decisions that have legal or similarly significant effects on you.

Who sees what

• Your lists: only you (“Only me”), the members of the groups you share them with (“My groups”), or anyone with the link (“Anyone with the link”). You choose for each list. You can make a new link at any time, and the old one stops working.
• Reservations: other gifters only see “Reserved”, never a name. The person whose list it is never sees reservations. On lists that parents manage for a child under 13, those parents see the gifter’s name and what they reserved. On lists for 13 to 17-year-olds, nobody does.
• Groups: members see each other’s names, roles and the lists they share. Anyone with the invite link sees only the group’s name. In a Secret Santa, each person sees only their own match, and the organizer doesn’t see who drew whom.
• Link previews: when you share a link on WhatsApp or a similar app, that app shows a preview with the list or group name.
• Saved lists: only you see which lists you saved, whether you are a guest or have an account. List owners never see who saved their list.

AI

When you add an item from a link, screenshot, photo or text, we send that content to Anthropic, our AI provider, to fill in the item’s details. We don’t send your name or email with it. Details filled in by AI are marked, and nothing is saved until you check it. Anthropic acts on our instructions, doesn’t use this content to train its models and deletes it within 30 days. We delete screenshots and photos from our storage within 24 hours, unless you keep the image with the item. We keep a record of each AI request (model, result, cost and the shop’s website) for 90 days. After 48 hours, that record is no longer linked to you.

Statistics

We count how Yotekobi is used (for example, lists created or links shared) on our servers, never in your browser. Events carry a pseudonymous code instead of your name or email, and never contain list or item titles, links, names, email addresses or IP addresses. PostHog stores them in the EU and deletes them after 13 months at the latest. Visits from people who aren’t signed in use a code that changes every day and can’t be linked across days. Reservations are counted only in our own database, never sent to PostHog, and only ever looked at as totals of five or more. Those records are deleted after 90 days. If your browser sends a Global Privacy Control or Do Not Track signal, we record nothing for it. To object in any other way, write to hola@yotekobi.com.

Who helps us

These providers process data only on our instructions, under data-processing agreements:

• Vercel: website and app hosting (EU, Frankfurt)
• Supabase: database, sign-in and file storage (EU, Frankfurt)
• Amazon Web Services (Amazon SES): sending emails (EU, Frankfurt)
• Anthropic: AI that fills in items from what you give it (United States)
• PostHog: pseudonymous usage statistics (EU)
• Sentry: error reports, with personal details removed (EU)
• A hosting company in the EU that runs our own mail server (our contact inbox, and a backup for sending emails)
• Cloudflare (Turnstile): checks that a guest is a person, not a bot

Other companies you may deal with

If you sign in with Google, Google handles that sign-in under its own privacy policy and learns that you use Yotekobi. If you share a link on WhatsApp, Meta handles that message under its own policy. When you open a shop’s link, that shop’s own privacy and cookie rules apply on its site. If you write to our support address, the message passes through a Google Group before it reaches our inbox, so Google also stores it under its own policy.

Amazon images load from Amazon, which sees your IP address.

Transfers outside the EU

We store your data in the EU. Anthropic processes AI requests in the United States. Some other providers are US companies or part of US groups and may access data from the US, for example to provide support. Where that happens, it is covered by the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses (and, for the UK, their UK equivalents), and for Brazil by LGPD art. 33.

How long we keep it

• Your account and lists: until you delete them. If you don’t use Yotekobi for 24 months, we’ll email you, and we delete the account 30 days later unless you come back.
• Sign-ups you never confirmed (the email link was never opened): 30 days.
• Guests: 30 days after your last visit if you’re in no group and have no reservations or saved lists, and 13 months after your last visit in any case.
• Reservations: 180 days after the list’s occasion date. If the list has no date, until you release the reservation or the item or list is deleted.
• Groups: a family group is deleted after 24 months without activity from any member (the lists stay with their owners), and a group with nobody in it within 24 hours.
• Secret Santa: the group, its draw and its exclusions are deleted 90 days after the exchange date.
• Notices to gifters: 30 days after you read them, or 90 days if unread, and at most 30 days for notices about deleted items or lists.
• Screenshots and photos for AI: 24 hours, unless you keep the image with the item. Records of AI requests: 90 days, linked to you for only 48 hours.
• The under-18 block: 24 hours.
• Security logs: up to 30 days. Error reports: up to 30 days. Statistics: 13 months. Reservation statistics: 90 days.
• Waitlist: when you create an account, we delete your waitlist entry.
• Backups: deleted data can stay in encrypted backups for up to 35 days. Then it’s gone.
• Removed from a group: if an organizer removed you, we keep a code without your name that stops you rejoining that group, until the group is deleted.
• Reports: 6 months after we close them, or 12 months if we had to act on them.
• Saved lists: deleted with your profile, and 30 days after the list’s owner turns off or replaces its share link.

Your rights

You can access, correct or delete your data, take a copy, restrict or object to its use, and withdraw any consent at any time. In Brazil you also have the other rights in LGPD art. 18. We reply within one month (15 days for a full access request under the LGPD).

To delete everything, go to Account → Delete everything. It’s done within 24 hours. Guests can use “Delete my guest data”.

For anything else, including a copy of your data, write to hola@yotekobi.com.

Age and children

Accounts are for adults (18 or older). Parents can make lists for their children. A child’s profile is only a nickname and an age band, and children never get an account. If we learn that someone under 18 has an account or is taking part as a guest, we delete it.

Security

Connections are encrypted, each part of the service can reach only the data it needs, and you sign in with a one-time code we email you or with Google, so there are no passwords to steal. To stop guessing, we limit failed code attempts and pause sign-in for that email for a while. If a breach puts your data at risk, we’ll tell the data protection authority and, where the law requires it, you.

Cookies

We only use cookies that are strictly necessary for the service you ask for, so there is no banner and nothing to accept. We use no analytics, advertising or tracking cookies, and no local storage, pixels or browser fingerprinting.

• __Host-yk-session keeps you signed in, as a member or a guest. It lasts up to 180 days, or until you sign out.
• __Host-yk-pkce protects a Google sign-in while it’s happening. It lasts 10 minutes.
• __Host-yk-merge remembers, for 15 minutes, that a guest asked to move their activity into an account.
• __Host-yk-device, if someone says they’re under 18, stops a new account being created from that browser. It lasts 24 hours.

Complaints

You can complain to the Spanish data protection authority (AEPD, www.aepd.es), the UK ICO (ico.org.uk), Brazil’s ANPD (www.gov.br/anpd) or the authority where you live. We’d appreciate the chance to fix it first.

Changes

If we change this notice in a way that matters, we’ll tell you in Yotekobi or by email before the change applies.

On the waitlist? It has its own privacy notice.