TL;DR
- Things To Have aims to be as privacy friendly as possible. We don't sell ads or your data, and we try to collect as little data as we can.
- The app earns money from affiliate links. We are not going to optimize the app for affiliate income.
- What you enter into the app lives at Cloudflare (hosting) and PostHog EU (a copy for product decisions). See all our providers. We wipe it when you delete your account, with details here.
- When we run ads for our product, we don't share your name, email or anything you enter into the app with advertisers. See what ad providers receive.
This explains what Things To Have does with your personal data. It is deliberately short. If anything is unclear, email us and we will answer.
1. Who is responsible
The controller of your data is Tsimur Brachkou, a sole trader (jednoosobowa działalność gospodarcza) entered in the Polish CEIDG register — NIP 5214164635, REGON 544707296, ul. Stefana Batorego 18/108, 02-591 Warszawa, Poland.
Contact for anything about your data: support@thingstohave.app. We have not appointed a data protection officer; that email reaches the operator directly.
2. What we collect, why, and on what basis
Because you give it to us
| Data | Why | Legal basis |
|---|---|---|
| Email address | To sign you in and send account and security messages | Contract, Art. 6(1)(b) |
| Username (we generate one; you can change it) | Your public identity on the service | Contract, Art. 6(1)(b) |
| Your lists and items — names, notes, links, prices, images | The thing the service is for | Contract, Art. 6(1)(b) |
| Profile picture, appearance settings | Your profile | Contract, Art. 6(1)(b) |
| Birthday — day and month only, never the year | Optional. Shown to mutual friends and used for birthday reminders | Consent, Art. 6(1)(a) — clear it any time |
| Passkeys, if you use them | Signing in without a code | Contract, Art. 6(1)(b) |
Because using the service creates it
| Data | Why | Legal basis |
|---|---|---|
| Sign-in records: IP address, approximate city and country, browser | Security, and so you can see and end your own sessions. The approximate city and country also tell us where our users are, to decide where and when to show our ads | Legitimate interest, Art. 6(1)(f) — keeping accounts safe; understanding our audience |
| One-time codes and sign-in links | To sign you in | Contract, Art. 6(1)(b) |
| Who follows whom, and an activity record of lists and items you create | Feeds and friend features | Contract, Art. 6(1)(b) |
| Gift reservations | So two people do not buy the same gift | Contract, Art. 6(1)(b) |
| Rate-limit and abuse counters | To stop abuse and spam | Legitimate interest, Art. 6(1)(f) |
| Server logs kept by our hosting provider, including IP addresses and requested addresses | Running and debugging the service, and security | Legitimate interest, Art. 6(1)(f) |
| Usage analytics (Section 3) | Understanding how the app is used | Legitimate interest, Art. 6(1)(f) — improving the app |
| Ad click details, if you signed up after arriving from one of our ads, with the approximate country and city you signed up from (Section 4) | Learning which ads bring people who sign up, and where and when to show them | Legitimate interest, Art. 6(1)(f) — spending on ads well |
We do not use your data to make automated decisions with legal or similarly significant effects.
We ask you not to put sensitive information into item names, notes or images. If you do, you are choosing to publish it and we process it only as part of your content.
3. Analytics
We use PostHog, running on EU infrastructure, to understand how Things To Have is used and to make it better. It is cookieless: it stores nothing on your device and reads nothing from it, so there is no cookie banner to click through.
We rely on our legitimate interest in seeing how the app is used, and you can object at any time, which switches analytics off for you.
- It sees which pages are visited, how visitors found us, and what people do in the app, such as creating a list. We never record what you type, apart from the website name of a link whose details we could not fetch.
- PostHog is where we analyse the product. Next to those events it holds a daily copy of our database and reports from Google Ads, Google Search Console and GitHub, so we can look at everything in one place. Only we can access it.
- If you connect an AI assistant, PostHog counts which features of Things To Have it uses. It does not see what the assistant reads or writes.
- Your IP address is sent so analytics can tell roughly what country a visit came from and tell visits apart. PostHog keeps only a one-way hash of it, never the address itself.
- We do not use analytics for advertising. Nothing the analytics provider records reaches an ad provider.
You can turn analytics off at any time in Settings, with immediate effect. That stops the events, including the ones from AI assistants connected to your account. The copy of our database stays, because it is your account data, which PostHog stores for us (Section 7). We also honour the Global Privacy Control browser signal automatically, for signed-in and signed-out visitors alike. Turning it off does not affect processing that already happened.
4. Advertising
No ads, no data sales
There are no ads in Things To Have, and we do not sell your data.
Our own ads
We advertise Things To Have on Google and Reddit. Our pages carry no ad pixels, advertising cookies or advertising scripts.
We tell an ad provider only that its ad led to a sign-up. When you click one of our ads, the ad provider adds its own click ID to the link. If you sign up during that visit, we send that click ID back to the provider, with the time you signed up and a one-way hash of our internal account ID, so the same sign-up is not counted twice. We never send your email address, name, username, IP address, browser details or anything you add to Things To Have. Section 7 lists what Google and Reddit each receive.
What we keep. If you sign up during a visit that started from one of our ads or a link we tagged, we save with your account the ad's click ID, the campaign tags in the link, the page you landed on, and the approximate country and city you signed up from, never your IP address. Nothing is stored on your device for this, so a later visit is not linked to the ad. We use it to learn which ads bring people who sign up.
You can say no. We rely on our legitimate interest in spending on ads well. If your browser sends Global Privacy Control, or you have turned analytics off in Settings on that device, we neither save these details nor report your sign-up.
5. Affiliate links
Some stores pay us a commission when someone buys through a link on Things To Have. Today that is Amazon, for amazon.com links only. When a link to amazon.com has no affiliate code in it, we add ours at the moment the page is shown. The link you saved stays exactly as you entered it. Links that already carry someone's affiliate code are left alone, and links on creator accounts are never changed. As an Amazon Associate, Things To Have earns from qualifying purchases.
We send Amazon nothing about you. When you open the link you are on Amazon's site, which sees your visit like any other and sets its own cookies there. Amazon decides on its own how it uses that, see the Amazon.com Privacy Notice. Amazon's reports to us show which products were bought and how many, never who bought them.
6. Cookies and browser storage
We use no advertising or cross-site tracking cookies. Our analytics provider sets no cookies at all. It identifies a visit from the IP address and browser we forward.
Necessary — these make the service work and cannot be switched off:
| Name | Purpose | Kept for |
|---|---|---|
__Secure-tth.session_token | Keeps you signed in | 7 days |
tth_login_email | Carries your address from the sign-in form to the code screen | 15 minutes |
tth_login_link_nonce | Ties an emailed sign-in link to the browser that asked for it | 15 minutes |
tth_return_to | Brings you back to the page you were on before signing in | 30 minutes |
inertia_clear_history | Clears cached pages when you sign out | 60 seconds |
Preferences — tth_prefs (1 year) stores your light/dark and layout choices and your
analytics decision. Older installs may still carry a tth_view_mode cookie, which we only read.
In your browser's session storage we keep the email you typed while signing in (removed once you are in), keys used to encrypt page data in your browser history, and scroll positions.
Cloudflare, which serves the site, may set its own security cookies. You can clear or block cookies in your browser, but the service will not work properly without the necessary ones.
7. Who else sees your data
We use these providers. They act on our instructions, except where noted.
| Provider | What they get | What for |
|---|---|---|
| Cloudflare | Hosts the service, so the database, uploaded images, sign-in records and server logs all sit on their infrastructure. Its bot check, Turnstile, additionally sees your IP address, browser and a fingerprint of your connection when you sign in — see the Turnstile privacy policy | Hosting, storage, security, logs, bot checks |
| Resend | Your email address and the content of messages we send you, plus a stored contact record — see below | Sending email |
| PostHog | Account ID, username, usage events, IP address, and a copy of our database | Product and web analytics |
| Railway | Your uploaded images, as they are resized for display | Image processing |
| Automattic (Gravatar) | A one-way hash of your email address, when you first sign up | Fetching a profile picture if you have one. Automattic decides on its own how it uses that request |
| Only if you signed up after arriving from one of our Google ads: Google's own click ID, the time of sign-up and a one-way hash of our internal account ID, sent once a day. Never your email, name, IP address or browser details. Sign-ups from the EEA, Switzerland, the UK or an unknown country are never sent. We delete the click ID once it is sent, or after 90 days if it never is. Google decides on its own how it uses this, see the Google Privacy Policy | Knowing which of our Google ads led to sign-ups | |
| Only if you signed up after arriving from one of our Reddit ads: Reddit's own click ID, the time of sign-up, our website address and a one-way hash of our internal account ID. Never your email, name, IP address or browser details. Reddit decides on its own how it uses this, including to measure and improve its ads, see the Reddit Privacy Policy | Measuring our Reddit ads | |
| Amazon | Nothing from us. If you open an amazon.com link, Amazon sees your visit on its own site and decides on its own how it uses it, see the Amazon.com Privacy Notice | Affiliate commission (Section 5) |
| Frankfurter · Discogs | No personal data — currency rates, and product details for a link you paste | Prices and autofill |
We also disclose data to public authorities where the law requires it. Note that most of these providers can be compelled directly by authorities without involving us.
If you subscribe to the birthday calendar feed, your calendar provider (Google, Apple, or whoever you choose) will receive your mutual friends' usernames and birthdays.
Every birthday email carries an unsubscribe link, and your mail app's own one-click unsubscribe button works too. Account and security messages — sign-in codes, password- free login links, alerts about changes to your account — have no unsubscribe, because you cannot opt out of those while you have an account.
A contact record at Resend. When your account is created, your email address and username are also stored as a contact in a mailing list held at Resend. We have never sent a marketing campaign to it, and we will not send you marketing email without asking you first. If you would rather not be on the list, email us and we will remove you; deleting your account removes you automatically.
We do not sell your personal data.
8. Data leaving the EU
Our providers operate internationally, so your data may be processed outside the European Economic Area, including in the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses or an adequacy decision. Analytics is an exception: PostHog runs on EU infrastructure, so analytics data, including PostHog's copy of our database, stays in the EEA.
We have not pinned our database and file storage to a specific region, so your data may be processed wherever those providers operate.
9. How long we keep it
- Your account and content — until you delete them.
- Deleting your account — we deactivate it immediately and erase it after 14 days, so you can change your mind. You can also erase it straight away.
- Sign-in records and one-time codes — deleted 7 days after they expire.
- Gift reservations — 30 days.
- Caches (product details, exchange rates) — 24 hours.
- Server logs held by Cloudflare — a short rolling window set by Cloudflare, after which they are deleted automatically.
- Backups — our providers may hold short-term point-in-time copies of the database; these expire automatically on their own schedule.
What survives deleting your account, and why:
- Items another user copied from your public list stay in that user's account, including the image, because it is now their content.
- PostHog deletes your profile and its events, and its copy of our database is replaced every day, so your account leaves it within a day of being erased.
- Preview images generated for sharing may remain in storage for a while after deletion.
- Search engines and anyone who saved a link may still hold copies of what was public. We cannot reach those.
10. What is public
- If you set a birthday, we email your mutual friends to tell them it is coming up, and their emails name you. Turning birthday emails off in Settings stops the emails you receive; to stop your birthday being shared with friends at all, clear it.
- Your username, profile picture and profile page are public and can be found by search engines. We list qualifying profiles and public lists in our sitemap, which actively tells search engines they exist.
- A list is private unless you make it public. Public lists and everything on them are visible to anyone.
- Images are served from unguessable signed links that work for up to 14 days. Someone who has such a link can open the image without signing in — including after you make the list private again. Treat an image link as public once it has been shared.
- Anyone signed in can see who you follow and who follows you.
- Reservations are anonymous: the owner sees that an item was reserved and how many times, never by whom.
11. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to another provider. Where we rely on legitimate interest you can object, and where we rely on consent you can withdraw it at any time.
Several of these you can do yourself in Settings, immediately: export your lists and items, change your email or username, edit or delete anything, end sessions, turn analytics off, turn birthday emails off, and delete your account.
For anything else, email support@thingstohave.app. We reply within one month. We may need to check that the request really comes from you before we act.
If you think we have handled your data badly, please tell us first — but you can always complain
to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2,
00-193 Warszawa, uodo.gov.pl.
12. Children
Things To Have is for adults. Our Terms require you to be 18 or over, and we do not knowingly process children's data. If you believe a child has an account, email us and we will delete it.
13. Security
Sign-in is passwordless — one-time email codes or passkeys — and sensitive actions need a fresh confirmation. Traffic is encrypted with HTTPS. Uploaded images have hidden metadata such as GPS location stripped before they are stored. Private files are not publicly listable.
No online service is completely secure. If you think something is wrong with your account, contact us immediately.
14. Changes
If we change this policy in a way that materially affects you, we will tell you by email or in
the app before it takes effect. The current version is always at /privacy, with its effective
date at the top.
15. Contact
support@thingstohave.app — Tsimur Brachkou, ul. Stefana Batorego 18/108, 02-591 Warszawa, Poland.