Enis Alper Kale, Schwarzwaldweg 51, 65760 Eschborn, Germany.
Email: hello@alittle.gift
There are no accounts, no cookies and no advertising, and nothing is tracked across sites or used to identify you. Visits are counted, without cookies and without the address of anybody's gift, and that is described under Counting visits below. Six things are worth spelling out first.
When you create a game, what you type — the heading, the words, the hints, the lines of your letter, the clues and answers of a crossword, and any names — is stored on a database server so the link works when you send it. It is kept until it is deleted using the edit link handed to you when the game is created. There is no other way to retrieve or delete it, and no copy is kept afterwards.
Please do not put anything here you would mind existing on a server. Legal basis: Art. 6(1)(b) GDPR — performing the service you asked for.
A paid letter can carry photographs, and a box can carry photographs and voice notes. A photo you choose is re-encoded in your own browser before it is sent, which makes it smaller and, worth knowing, removes all of its embedded metadata — including the date and the GPS location a phone camera writes into a picture. Only the re-encoded image is uploaded. A voice note is recorded in your browser and uploaded as a sound file; it is not transcribed, and nothing listens to it.
Both are held in a private storage bucket. They have no public web address: a request for one straight from the internet is refused. A file is only ever sent out by this site’s own server, to someone who has already earned it — guessed the word it is attached to, or reached that goodie in a box — or to whoever holds the edit link. Deleting the gift deletes its files, and removing one and saving deletes that file.
Photographs and recordings are personal data, and often other people’s — a voice is as identifying as a face. Please only upload what you are happy to store on a server and to show or play to the person you are sending it to. Legal basis: Art. 6(1)(b) GDPR — performing the service you asked for.
A letter and a crossword keep one thing: the date the person you sent it to first pressed Open. It is shown to you, and only to you, when you open your own edit link, so that you can tell whether the thing arrived. Nothing else about them is recorded — not how long they took, not how many guesses, not where they were.
A box keeps more, because a box needs it: when it was first opened (a box that opens one goodie a day has to count from somewhere), which goodies have been opened and when, which promises have been used up, and anything the recipient writes back in a goodie that asks them a question. What they write back is readable only by whoever holds the edit link.
All of it is kept with the gift and deleted with it. If you are the person opening a gift and you would rather none of this were recorded, ask whoever sent it to delete it; they have the only link that can. Legal basis: Art. 6(1)(b) GDPR — performing the service the sender asked for, and without which a box that opens on a schedule cannot work.
To stop one person from filling the database, requests are counted per visitor. The counter is keyed by an irreversible hash of your IP address, not the address itself, and it expires automatically within an hour. Legal basis: Art. 6(1)(f) GDPR — a legitimate interest in keeping the service available.
The hosting provider records standard access logs (IP address, time, page requested, browser identification) for operation and security. Legal basis: Art. 6(1)(f) GDPR.
The typefaces are served from this website, not from a third party. No request for them leaves this domain, and no font provider receives your IP address.
Payment is handled entirely by Polar, who act as the seller of record. Your name, email address and payment details go to them and to their payment processor, never to this site — no card details ever reach my server, and I never see them. Polar are also responsible for charging and remitting VAT and sales tax.
What this site stores about a payment is minimal: a flag saying the game was paid for and the time it happened. Polar keeps its own record of the order, under their privacy policy. Legal basis: Art. 6(1)(b) GDPR — performing the contract you entered into, and Art. 6(1)(c) for the records tax law requires.
This site uses Vercel Web Analytics to count how many people visit which page. It sets no cookies and stores nothing on your device; visits are counted from a hash of the request itself, which is discarded within a day. What it records is coarse: the page, where you arrived from, your country, and your browser and device type. It cannot follow you to another website, and it is never used to identify anyone.
On the pages where a gift is opened, the address itself is the gift: it carries the link
that protects somebody's letter. So the address is trimmed before anything is
sent — the part that identifies which gift is replaced, and any token or
payment reference after the ? or # is dropped. What is recorded
is that a crossword was opened, never which one. Nothing that was written, and no id that
would lead to it, is sent anywhere.
Alongside visits, a few moments are counted the same coarse way: a gift being made, a gift being finished, and somebody following the invitation to make one of their own. Each one is a name and the kind of gift it was, and a gift being made also records whether it was a new one or a change to an existing one — nothing more. Legal basis: Art. 6(1)(f) GDPR — a legitimate interest in knowing whether the site works.
This site sets no cookies at all and loads nothing from a third party. The only thing kept on your device is a little local storage, and only for things you asked for: how far you have got in a game, an unfinished draft in the builder, whether sound is on, and whether this browser has already been handed the gift once (so that the envelope it arrives in is not shown to you twice).
Under § 25(2) TDDDG, storage that is strictly necessary to provide a service you explicitly requested does not require consent — which is why you are not asked to dismiss a banner before reading anything. None of it is used to recognise or track you, none of it leaves your device, and clearing your browser data removes all of it.
Vercel, Upstash and Polar are based in the United States, so some processing happens outside the EU; those transfers are covered by the European Commission's Standard Contractual Clauses. Email sent to the contact address is received on servers in France and does not leave the EU.
Mail sent to the address in the imprint passes through a forwarding service before it reaches me, and is then kept in my mailbox for as long as needed to deal with it. Please don't send anything sensitive to it.
You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interest. Write to the email address above. You may also complain to a data protection supervisory authority in the EU member state where you live.