1. In short
KleinerWichtel.de only stores what Secret Santa needs. There is no advertising, no tracking, no analytics and no sharing for advertising purposes. Fonts and images are served by the site itself, not from other servers. The only exception is the spam protection on sign-in and registration (section 8).
2. Controller
As the operator of KleinerWichtel.de, I am responsible for processing your data. Name, address and email address are in the legal notice. You can reach me there for any privacy question. There is no data protection officer, as none is required.
3. Your account
For an account I store your name, your email address, your password (only as an irreversible hash), your profile picture and settings such as language and two-factor sign-in. If you take your account back through the link in the email about a changed address, I store for 72 hours when that was and which change the link came from, so that each of these links works only once. The legal basis is the performance of the terms of use (Art. 6(1)(b) GDPR). An account cannot be created without an email address and a name.
4. Groups, wishes and the draw
In your groups I store your wishes, a nickname if you set one, and, after the draw, whom you give a present to. Whoever creates a group also provides its details and rules. All pictures are scaled down and saved anew when uploaded. Metadata such as location, date or camera model is dropped in the process. Who sees what: – Members of a group see the names, nicknames and profile pictures of the others. – Your wishlist is seen by the person who drew you. If the organiser does not take part, they can see the wishlists when the group is set up that way. – Only you see whom you drew. – In the administration area I see the names and email addresses of accounts, but no wishlists and no assignments. The only exception: if someone reports content to me as unlawful, I see the group as the person reporting saw it at that moment, including the wishlist they are allowed to see. If an organiser reports a member before the draw, I see what the organiser sees of that member; if an organiser who may see the wishlists reports a wishlist, I see that one wishlist. I need this to decide on the report. I also see who reported it and, after the draw, therefore whom that person gives a present to. I do not tell the person whose content was reported who reported it. For a report I store the account of the person reporting, the reason, their description, what they saw as a snapshot with copies of the pictures, and my decision with its reason and what I removed. The copies make sure I review the content as it was reported, even if it has been changed since. Six months after the decision I delete the snapshot, the pictures, the description, the reason, the list of what was removed and the link to the account and the group; only the reason given, the outcome and the two dates remain. As long as a report has not been decided, it stays stored in full. The legal basis is Art. 6(1)(b) GDPR, and for reviewing reports Art. 6(1)(c) and (f) GDPR. The draw is pure chance; there is no automated decision-making within the meaning of Art. 22 GDPR and no profiling.
5. Inviting others
If you invite someone by email, I store their email address and send them an invitation with your name and the group’s name. The address is deleted as soon as the invitation is accepted, withdrawn or reported or the group is drawn, and after 30 days at the latest. Anyone invited can report the invitation through the link in the email. I then receive a message with the name and address of the person who invited them and the invited address, so I can look into misuse. In addition, no more invitations go to the reported address, not even from other groups, and open invitations to it are withdrawn. If the address belongs to a confirmed account, only the reported invitation is withdrawn and nothing is blocked. Whoever invites a blocked address is not told: to them the invitation looks sent, only the email does not go out. For this block I do not store the address itself, only a checksum of it. So that an invitation can still be reported once its address has been deleted, this checksum is kept with the invitation until the invitation is accepted or deleted after 90 days. It is not stored for addresses of confirmed accounts. The block ends when someone registers with this address and confirms it, or when the report is withdrawn as a mistake within 7 days. Otherwise it stays, as that is the only way it can serve its purpose. The legal basis is the legitimate interest of the person inviting in bringing their group together, my interest in preventing misuse and, for the block, the interest of the invited person in receiving no further invitations (Art. 6(1)(f) GDPR). Please only invite people who expect it.
6. Emails
KleinerWichtel.de only sends emails that belong to using it: about your account (for instance when your address, password or two-factor sign-in was changed or you took your account back), invitations and groups, and the draw. Whom you drew is never in an email, only on your page at KleinerWichtel.de. There are no newsletters and no advertising. Emails go through the same provider as the hosting (section 7).
7. Hosting, server logs and protection against misuse
The site, the database, all uploaded pictures and the sending of emails are hosted by Serverprofis GmbH, Otto-Lilienthal-Ring 34–36, 85622 Feldkirchen, Germany, on servers in Germany. There is a data processing agreement with them (Art. 28 GDPR). With every request, the server processes technically necessary data such as IP address, time and requested address. The app’s error log is deleted after 14 days, the hosting provider deletes its access and mail logs automatically once they are no longer needed to run the site securely. To protect against attacks and spam, the site limits sign-in attempts and invitations per account and IP address; the counters expire after 24 hours at most and are then deleted. If a limit on invitations is reached, I learn which account is affected. Security-relevant events such as registrations, failed sign-ins or invitations sent are logged with the IP address and deleted after 14 days; only daily totals without any link to a person remain. The legal basis is my legitimate interest in running the site securely (Art. 6(1)(f) GDPR). The connection is always encrypted with TLS.
8. Spam protection with Cloudflare Turnstile
On the sign-in and registration page, Cloudflare Turnstile checks whether a person or a bot is filling in the form. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Your IP address and technical details about your browser and device are sent to Cloudflare. According to Cloudflare, Turnstile does not set cookies for advertising or tracking. Turnstile is not loaded on any other page. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision (Art. 45 GDPR). The legal basis is my legitimate interest in protecting the site against automated sign-in attempts and spam accounts (Art. 6(1)(f) GDPR, Section 25(2) no. 2 TDDDG). More: cloudflare.com/privacypolicy. This is the only place where data goes to a company outside the EU.
9. Cookies
There are only technically necessary cookies: one for the session (which also holds the language you chose), one protecting against forged requests (CSRF) and, if you choose “Stay signed in”, one for that. They only serve to make the site work and need no consent (Section 25(2) no. 2 TDDDG). There are no tracking cookies.
10. Links in wishlists
Wishlists can contain links to other sites, such as shops. Only when you click such a link do you leave KleinerWichtel.de; the provider of that site is responsible for the processing there.
11. Retention and deletion
Your data is kept as long as your account exists. You can remove your profile picture at any time. You can change and delete wishes until the group has been drawn; after that they stay as they are, so your Secret Santa can rely on them. The organiser can delete a group as long as they are its only member. Groups that have ended stay as an archive for their members. A group ends three months after its date or, if it has none, three months after its last change. You delete your account in your profile under “Delete account”. Name, email address, password, profile picture and nicknames are removed immediately. The exception is what a report to me holds (section 4): it stays stored until six months after my decision, pictures included. You leave groups that have not been drawn yet, together with your wishes. In groups that have already been drawn, an empty placeholder labelled “Deleted account” remains so the draw stays correct for the others. Your wish pictures are deleted immediately, and so are your wish texts in groups that have ended. In drawn groups that are still running, the wish texts stay until the group ends, so your Secret Santa can still find a present, and are deleted then. After that, the group’s archive only shows “Deleted account”, without any wishes. The hosting provider backs up all data daily, encrypted on separate backup servers. It keeps the backups of the last four days and, in addition, one per week for eight weeks. I also back up the database before every update of the site; these backups are deleted after 30 days at the latest. Deleted data may therefore remain in a backup for up to eight weeks; it is only used to restore the site after a failure.
12. Your rights
You have the right of access to your stored data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). A short email to the address in the legal notice is enough. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.
13. Minimum age
You may create an account if you are at least 16 years old. Younger people need their parents’ consent, for example to join the family’s Secret Santa group. For them too, the processing is based on the terms of use (section 3), not on consent.
14. Changes
If anything about the processing changes, I will update this policy. For significant changes you will receive an email in advance. This English version is a translation; the German version is binding. Last updated: October 2026