Privacy notice
PrezzyList is a gift wish list. You keep lists of the gifts you would like, and the people you share them with can pick something without spoiling the surprise. This notice explains, in plain English, what personal data we collect, why we need it, how long we keep it and what you can ask us to do with it.
Last updated: 4 November 2026
Who we are
PrezzyList is fully owned and managed by Boxed Online Ltd, which is the data controller for your personal data. That means we decide how it is used and we are responsible for looking after it.
Boxed Online Ltd is a company registered in England and Wales, company number 13235408. Registered office: 20-22 Wenlock Road, London, England, N1 7GU.
For anything about your data, including the requests described below, email support@prezzylist.com.
What we collect
We only collect what we need to run your account and your lists:
- Your account details: your first name, last name and email address, and whether your email address is verified. You give these when you create an account, or they come from Google, Facebook, Microsoft or Apple if you sign in with one of them.
- Your first name. Sign-up asks for it first. While you create an account it is held in your draft for up to 7 days after your last change, and it is deleted if sign-up is refused. It never appears in our logs.
- The year you were born. We ask for the year you were born, to suggest gifts for your age. If you turn 18 this year, we also ask for your full date of birth to check you are 18 or over, and keep it.
- Your answers to our questions: your interests and, if you choose to answer them, optional questions such as your gender, the part of the UK you live in, your life stage and your usual gift budget. You can skip the optional ones. The occasion is asked later, for each list you make.
- Interests you add in your own words. If you type an interest we do not list, our team reads the text, without your name, to decide whether to add it for everyone. Until then only you can see it, on your account page, where you can remove it. Text that has not been reviewed is removed after 90 days.
- Whether you said yes to hearing from us by email, and when you said it.
- Your lists and gifts: list names, occasions and dates, and for each gift its name, your notes, the link, the price, the quantity and the picture.
- The people and pets you make lists for: the name you give them, for a person an age range and their interests, and for a pet its type and breed. Please only add what you need to choose a gift.
- Which PrezzyList tools you use (the website, the browser extension or the iPhone app) and when you first and last used each one, so we can show you the right tips.
- If you share a list, the link we make for it, and a count of how many people use each way of sharing it (for example WhatsApp or email), which is never tied to a list or a person.
- If you claim a gift on someone else's list: the claim itself and the quantity you claimed. We do not ask for your name. If you do not have an account, we also keep a scrambled copy of a random key from your browser, so you can see and undo your claims.
- A scrambled network value for your account: when you are signed in and open your own lists, we keep a keyed, one-way scramble of the network you are on (a hash of your internet address, not the address itself), against your account and the day. See Is this your list? below.
- Beta requests. If you ask to try PrezzyList before it opens, we keep your email, what you want to try (the iPhone app, the Edge extension or the website), your optional reason and the time you asked. You must confirm you are 18 or over to ask. If an admin invites you to the beta, we keep the email address they give us, and the same dates as for a request you made yourself.
- Technical data: your IP address, used briefly to stop abuse of our sign-up pages and the beta request form and to limit how fast claims can be made, and not stored with your account (the scrambled network value above is the only trace of a network we keep), and our service logs, which record your account's internal identifier and what our systems did, but never your email address, year or date of birth or answers.
- Only if you accept analytics cookies: how you use our website, such as the pages you visit, how you got there and the kind of device and browser you use, collected by Google Analytics.
What you type in the gift finder is used only to match interests and is never kept.
We do not collect payment details, your phone number, your contacts or your location. PrezzyList is not for anyone under 18.
How we use it, and our legal reasons
UK data protection law (the UK GDPR) asks us to give a legal reason for each use. Ours are:
- To create and run your account, keep your lists and save your gifts. Our reason is that we need to, to provide the service you signed up for (contract).
- To check you are 18 or over. Our reason is our legitimate interest in keeping PrezzyList for adults only, and the service you agreed to.
- To suggest gifts from your occasion, interests and optional answers. Our reason is your consent for the optional answers, which you can change or remove at any time from your account page, and the service you asked for for the rest.
- To work out trending gifts for groups of people, such as gifts for dads in their fifties. Our reason is our legitimate interest in showing everyone useful gift ideas. Trending gifts are not yet worked out from members' answers; when they are, we will only ever show this in aggregate, for groups large enough that no one person can be identified, and never in a way that reveals what is on, or has been bought from, a particular list.
- To let you share a list and let your friends and family claim gifts from it without an account. Our reason is that we need to, to provide the service you asked for (contract), and for givers our legitimate interest in running the claim service they use.
- To ask you "Is this your list?" when someone opens your own link on a device or network we recognise, so you do not spoil your own surprise by accident. Our reason is our legitimate interest in keeping the surprise, which is the point of the service.
- To send you marketing emails, only if you said yes. Our reason is your consent, as the Privacy and Electronic Communications Regulations (PECR) require. We do not send any marketing emails yet. When we do, every one will have an unsubscribe link, and you can withdraw your consent at any time by emailing us.
- To understand how people use our website, so we can improve it, with Google Analytics. Our reason is your consent: under PECR for the analytics cookies, and under the UK GDPR for the data they collect. Nothing is collected unless you accept analytics cookies, and you can withdraw at any time.
- To review your beta request and, if we approve it, send you one email with your beta link. Our reason is that you asked us to. We use it for nothing else and never for marketing. If an admin invites you, we use your email address only to send you your beta link. Our reason is our legitimate interest in letting the people we choose try PrezzyList, and you can ask us to delete it at any time by emailing support@prezzylist.com.
- To keep PrezzyList secure and working: rate limits against abuse, error logs and performance monitoring. Our reason is our legitimate interest in running a safe, reliable service.
- To meet our legal obligations, for example if a court or regulator lawfully asks us for information.
We do not sell your personal data, and we do not use it to make automated decisions that have a legal or similarly significant effect on you.
Keeping the surprise
A list owner should never find out what has been bought for them. That rule shapes how we handle gift data: nothing we show a list owner, including counts, ordering and trending figures, is allowed to reveal whether a gift on their list has been bought.
The sections below explain how sharing a list and claiming a gift work, what a gift giver gives us, who can see it and how long we keep it.
Is this your list?
If you open your own share link, you could see what has been bought for you. To stop that happening by accident, we ask "Is this your list?" before we show anything, when we think the visitor may be the owner. We think so in two ways:
- Your browser: a cookie called pl_od remembers that you signed in to PrezzyList on this browser (see Cookies and similar storage).
- Your network: when you are signed in and open your own lists, we keep a scrambled network value against your account and the day. It is made with a keyed, one-way scramble of your network (your whole address for IPv4, the first half for IPv6), using a key that changes every month, so it cannot be turned back into an address. We keep it for 60 days, and the monthly keys for 90 days, then delete them. We use it only to decide whether to ask "Is this your list?". It never opens your view of the list on its own, and it is not used for anything else. We do not use it if many different accounts share the same network, such as a library or an office.
This protects you from accidental spoilers. It does not stop a determined owner: if you open your link while signed out in a private window, on a network we do not recognise, you can see the list as a giver sees it, including what has been claimed. Please do not.
International transfers
Everything PrezzyList stores itself, including your year of birth, your answers and your lists, stays in the UK. Clerk stores your name, email address and sign-in details in the United States. Clerk's data processing addendum covers that transfer: Clerk relies on the EU-US Data Privacy Framework and its UK Extension, and, if those cannot be used, on the standard contractual clauses with the UK Addendum.
Error reports from the website and our servers, and crash reports and performance diagnostics from the iPhone app and the browser extension, and usage sessions from the iPhone app, can go to Sentry's European Union data region. Sentry is a United States company, so its staff there could reach them. Sentry's data processing agreement covers any such transfer.
If you accept analytics cookies, Google Analytics data is processed by Google Ireland Limited and Google LLC, and may be transferred to the United States. Google's data processing terms cover that transfer, using the UK International Data Transfer Addendum and the UK Extension to the EU-US Data Privacy Framework.
How long we keep it
- A beta request is kept for 90 days if it is waiting, 30 days if we decline it, and, if we approve it, for 90 days after you use your beta link or we send the email, whichever is later. Then it is deleted. We delete it sooner if you ask, by emailing support@prezzylist.com.
- If you start creating an account and do not finish, your answers are kept for 7 days after your last change and then deleted automatically.
- If what you give shows you are under 18, your answers are deleted straight away and we keep only an anonymous count. If that happens after you have created an account, the account is deleted.
- While you have an account, we keep your details, answers, lists and gifts. A gift you remove or a list you delete is hidden but kept until your account is deleted, because someone may already have bought that gift for you.
- When you delete your account (from the Account and security section of your account page, or by asking us), Clerk deletes your sign-in details and tells us, and we permanently delete your account, answers, lists, gifts and the people and pets you added. Our database backups hold a copy for up to 7 more days before it is gone for good.
- After your account is deleted we keep only your old Clerk account identifier and the date it was deleted, so a deleted account cannot come back by mistake. It contains no name, email address or other details.
- A claim made without an account is deleted when the list is deleted, or 12 months after the list's event date, or 12 months after that giver's last claim on the list, whichever comes first. A claim you make with an account is kept until you undo it or delete your account, which deletes your claims. A first name given with a claim before 24 October 2026 is kept with that claim, is never shown to anyone, and is deleted with it.
- A list kept in Friends' Lists stays until you remove it or its owner stops sharing it, and is then deleted.
- The scrambled network value that helps us ask "Is this your list?" is deleted after 60 days, and the monthly keys used to make it after 90 days.
- A page feedback answer, with its optional reply email, is kept for 12 months and then deleted.
- Our service logs are kept for a limited time and then deleted automatically.
- If you accept analytics cookies, Google Analytics keeps the data it collects for 14 months and then deletes it.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you (access), including in a format you can take elsewhere (portability)
- correct anything that is wrong (you can change most answers yourself on your account page; email us to correct your year or date of birth)
- delete your data (you can delete your account yourself, or ask us to)
- restrict how we use your data, or object to a use based on our legitimate interests
- stop marketing emails, or withdraw any consent you gave, at any time
To ask for any of these, including a copy of your data or its deletion, email support@prezzylist.com from the email address on your account. We may ask you to confirm who you are, and we will reply within one month. It is free.
If you are unhappy with how we have handled your data, please tell us first at support@prezzylist.com. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: make a complaint to the ICO or call 0303 123 1113.
How PrezzyList earns
PrezzyList is free. We plan to earn a commission from shops when someone buys a gift through a link on PrezzyList (an affiliate link), and from clearly labelled adverts. A commission never changes the price you pay.
Affiliate links and adverts are not live yet. When they are, the shop or affiliate network may record that you arrived from PrezzyList, under its own privacy notice, and we will only learn that a sale happened and the commission due, not who bought it. We will update this notice before they start, and ads will always be labelled.
Reading shop pages
When you add a link to a gift, our program PrezzyListBot fetches that one shop page to fill in the gift's name, price and picture, and keeps its own copy of the picture so the people viewing your list never load anything from the shop. It sends the shop nothing about you. How PrezzyListBot works.
A copy of the page is kept privately for up to 7 days, and the shop's original picture for up to 30 days. The resized picture copies are kept and credited to the shop (image credits and removal). When the same product is saved by more than one person, we match it by a cleaned-up link with tracking codes removed, and we never match a link that looks personal to you.
Page feedback
Some pages have a small "Tell us how to improve" link that opens a page with one box. If you use it, we keep the kind of page you were on (for example "a gift page" or "a shared list"), what you wrote and the date. We do not keep the address of the page, the list, the gift or the share link, where you came from, your account or your IP address, and the box is not tied to your account even if you are signed in.
You can also give an email address if you would like a reply. It is optional, you must be 18 or over to give one, and we use it only to reply to you. Please do not put personal details in the box. If you use the link on a shared list, we keep only "a shared list" as the page, never which list it was or anything about what has been claimed.
We use what you write to improve PrezzyList, because it helps us make the site better (our legitimate interests). We keep each answer for 12 months and then delete it. To have yours deleted sooner, email support@prezzylist.com and tell us roughly what you wrote.
The Send to My PrezzyList browser extension
The extension for Microsoft Edge saves the gift on the shop page you are looking at to one of your lists.
- What it reads: the product name, price, picture and link from the one page you choose, and that page's address. It also reads the shop's option pickers on that page (such as size or colour), so you can choose from them. Only the picker names and the options you choose are kept, and they are saved in your gift's notes.
- When: only when you press the PrezzyList button in your toolbar. Nothing runs on pages in the background, and it does not watch what you browse.
- What it sends, and where: only the gift you save (its name, your notes, the link, the price and the picture's address), to your own PrezzyList account through the PrezzyList API, and a crash report if something goes wrong (see below). The page itself is never sent or stored.
- Sign-in: it reads the PrezzyList website's sign-in cookie, so if you are signed in on the website you are signed in to the extension. It keeps a PrezzyList sign-in token on your device, which it uses to get short-lived tokens for talking to PrezzyList. It never sees a sign-in code and reads no cookie from any other site.
- Your email address: the extension shows the email address of the PrezzyList account you are signed in with, so you can see which account you are using. It comes from your PrezzyList sign-in and is only shown on your device.
- What stays on your device: the sign-in token, the lists to choose from, your last used list and an unsaved draft. Drafts and the lists are cleared when your browser session ends, and everything the extension holds is cleared when you sign out of it.
- How long it is kept: a gift you save stays on your list until you remove it, like any gift added on the website, and is deleted with your account as described above.
Two things load pictures from the shop rather than from us. To let you check a picture before you save, the extension shows it from the address the page gives, without telling the shop which page you came from (no referrer). And until we have made our own copy, your own view of your list shows the shop's picture the same way. The shop can see your device's internet address when its picture loads, but not which page you were on. The people you share a list with only ever see our copies.
The extension does not sell your data, does not use it for anything other than saving gifts to your lists, does not use it for advertising or credit decisions, and loads no code from the internet.
If the extension hits an error, it can send a crash report to Sentry, our crash reporting provider, in its European Union data region. A crash report is about the error: its type, its message, where in the extension's code it happened, and the extension's version and build. Before a report leaves your device, the extension removes web addresses, query strings and quoted text from it. It does not put page content, gift details or list details in a report on purpose, and it does not record what you browse or do. The extension can also send performance diagnostics: how long a step took, such as saving a gift, and whether it worked. They hold no list, gift or account details and no identifier for you or your device, and they need no consent because they only tell us how fast and how reliably the extension works. Sentry receives the IP address a report comes from as part of the connection; we have asked Sentry not to store it. We do not use crash reports for tracking or advertising.
The PrezzyList iPhone app
The app uses the same account and the same data as the website. It keeps your sign-in securely in the iPhone's keychain and clears it when you sign out or delete your account. When you share a page to PrezzyList from Safari, it reads only the page's title and address. The app has no analytics or advertising tools of its own. Our servers record when your account first and last used the app, as described under what we collect. The app never stores or shows what has been bought.
What else stays on your phone: small settings, such as the list you last added a gift to and whether you have seen the steps for sharing a page to PrezzyList. If you share a page while you are signed out, or the gift cannot be saved straight away, the app keeps that shared gift on the phone so it is not lost. It holds the gift's name, details, address and price, whatever you typed or the page gave us, and the name of the list you chose. It sits in storage shared between the app and its share extension, and is left out of backups. It is sent to your account once you are signed in. It is removed once it is 7 days old, the next time the app opens. It is also deleted when you discard it, sign out, or delete your account.
If you sign in with Apple, Apple shares your name and email address with us through Clerk. If you choose Hide My Email, it is a private relay address instead. You can stop using Sign in with Apple with PrezzyList at any time. On an iPhone, open Settings, tap your name, then Sign-In & Security, then Sign in with Apple, choose PrezzyList and tap Stop Using. On a Mac, open System Settings, click your name, then Sign-In & Security, then Sign in with Apple. When you delete your PrezzyList account in the app, it tells you how to remove PrezzyList from your Apple ID in the same place. It does not do that for you.
The iPhone app can send a crash report to Sentry, our crash reporting provider, in its European Union data region, when the app crashes. A crash report holds the type of error and where in the code it happened, the app version and build, and the phone model and iOS version. It holds no name, email address, account id, page address, list content or error message. Sentry receives the IP address a report or a session comes from as part of the connection; we ask Sentry not to store it. We do not use crash reports for tracking or advertising. The app can also send performance diagnostics: how long a step took, such as opening a list, and whether it worked. They hold no list, gift or account details and no identifier for you or your device, and they need no consent because they only tell us how fast and how reliably the app works. The app, and the share extension when it is used, can also send a usage session to Sentry: Sentry's random install identifier, when the session started and ended, and whether it ended normally, in a crash or unexpectedly, with the app version and environment. We use it to see how many people use each version and how often it crashes, not for tracking or advertising. Debug builds never send reports or sessions.
Keeping your data safe
Your data is encrypted on its way to us and stored in Microsoft's UK data centres. Your sign-in codes are checked only by Clerk and never reach PrezzyList. The code that lets you start an account is stored only in scrambled (hashed) form, and access to our systems is limited to the people who run PrezzyList.
Changes to this notice
We will update this notice whenever we change how we use personal data, and change the date at the top. If a change matters to you, for example a new use of your data, we will tell you before it happens.
Contact us
For questions, requests about your data or complaints, email support@prezzylist.com.