Privacy Policy
Last updated September 21, 2026
Gotcha.gift lets you hide a photo and a message behind a jigsaw puzzle and share it as a link. This policy explains what we collect, why, and the choices you have. We keep it short because we collect little.
What we collect
If you create an account
Sign-in is through Google. We receive your name, email address, and profile picture from Google and store your name and email so you can find your puzzles again. We never see your Google password.
What you put in a puzzle
The photo, the title, the message, and the signature you add. Photos are stored in our file storage and are reachable by anyone who has the puzzle link or the photo's own address. Treat a puzzle link like a photo you hand to someone: it is unlisted, not private.
When someone plays a puzzle
We record that the puzzle was completed, how many moves it took, and how long it took. This is attached to the puzzle, not to the person playing, and we do not ask players to sign in. We also keep the internet address (IP) a puzzle was created from and the address each completion came from, only to tell whether a puzzle was completed by its own sender or by someone else. These addresses are never shown to senders or players.
Usage analytics
We use Vercel Web Analytics to understand which pages are visited, roughly where visitors come from, and whether puzzles get created and solved. It does not use cookies and does not identify individual visitors.
Cookies
We set cookies only to keep you signed in and to remember your language. Puzzle progress for players is saved in their own browser and never sent to us.
How we use it
- To create, host, and show your puzzles to the people you share them with.
- To show you your own puzzles, photos, and solve history when you are signed in.
- To keep the service working and understand how it is used.
We do not sell your data, and we do not use your photos or messages for advertising or to train models.
Who else sees it
Your data is processed by the providers that run Gotcha.gift: Vercel hosts the site, Supabase stores the database and files, and Google handles sign-in. Each processes data on our behalf under their own terms. Both Vercel and Supabase store our data in the United States.
How long we keep it
Puzzles stay available until you delete them or ask us to, so a link you send does not stop working. If you want your account, puzzles, or photos removed, email us and we will delete them within 30 days.
Your choices and rights
You can ask us what we hold about you, ask for a copy, correct it, or have it deleted. Depending on where you live you may have additional rights under laws such as the GDPR, the LGPD, or the CCPA; we honor these requests for everyone. Email us and we will respond within 30 days.
Children
Gotcha.gift is not directed at children under 13 and we do not knowingly collect their data. Anyone can play a puzzle without an account; creating one requires being old enough to hold a Google account.
Changes
If we change this policy in a meaningful way we will update the date above and, for account holders, say so in the app.
Contact
Questions or requests: hello@gotcha.gift. See also our Terms of Service.