Privacy Policy

Last updated September 27, 2026. Heaps is made by an individual developer in Colorado, United States.

What Heaps collects

• Your email address, to sign you in. Heaps has no passwords; we email you a one-time link.
• Your display name, so the people in your events know who you are.
• The events you create or join, including their names, dates, budgets and notes.
• Your wishlist items: titles, prices, links and images you add or paste, and how much you want each one.
• Claims: which items you have said you'll buy, and any note you leave for the other givers.
• Lists you manage for people who don't use the app, such as a child or grandparent, under a name you choose.

Heaps does not collect your contacts, location, photos, payment details or advertising identifiers, and does not use analytics or advertising SDKs.

Who sees what

People in the same event can see each other's names, lists and event details. Claims on your own list are hidden from you by design and are never included in the data sent to your device. Claims are visible to the other members of the event. The organizer of an event can see its invite code. Nobody outside an event can see anything in it.

How Heaps uses this information

Only to run the app: showing lists to the right people, sending sign-in links, sending reminders you have turned on, and keeping your events in sync. Heaps does not sell personal information, does not share it with advertisers, and does not use it to train any model.

Amazon

Browsing Amazon inside Heaps happens in a web view that talks directly to Amazon, under Amazon's own privacy policy. Product details you add are read on your device. Links to Amazon carry an Amazon Associates tag; as an Amazon Associate, Heaps earns from qualifying purchases, which never changes the price you pay.

Service providers

• Cloudflare hosts the Heaps servers and database (United States and global network).
• Resend delivers sign-in emails.
• Apple delivers the app and, if you opt in, push notifications.

These providers process data only to provide their service to Heaps.

Retention and deletion

Your data is kept while you have an account. Leaving an event removes you and your list from it. Deleting an event removes it for everyone. To delete your account and everything tied to it, email hello@useheaps.com from the address you sign in with; deletion is completed within 30 days.

Children

Heaps is for adults. A list kept for a child is created and controlled by the adult who manages it, and holds only the name that adult chooses and the items they add. Heaps does not knowingly collect information from children under 13.

Security

Traffic is encrypted in transit. Sign-in links work once and expire in 15 minutes. Sessions are signed tokens stored in the iPhone keychain.

Your rights

You can ask to see, correct or delete your information at any time by emailing hello@useheaps.com.

Changes

If this policy changes in a way that matters, we will note the new date at the top of this page and, for significant changes, tell you in the app.