Privacy Policy

1. Who is responsible#

KiftMe is published by KIFTME LTD, a company registered in England and Wales under number 17037940, registered office 20 Wenlock Road, London, N1 7GU, United Kingdom. KIFTME LTD decides how your information is used: it is the “controller”.

For any question about your information or to exercise your rights: [email protected].

Representative in the European Union (Article 27 GDPR): being appointed. In the meantime, write to the same address.

This policy covers the KiftMe app (website and mobile apps). The former “Kift” gift service has its own policy.

2. The information we use#

What you give us

• Your account: email address, password (stored encrypted by our sign-in service, we never see it), or your Apple or Google account if you sign in with one of them (we then receive your email address, or Apple’s relay address if you choose to hide yours).
• Your profile: first name, username, date of birth, and if you wish gender, bio and photo.
• What you post: your Subjects (title, text, up to 35 images, link), your expressions, your messages, your answers to shared subjects.
• Your city, if you pick it from the list. If you don’t, we infer one, at city level only, from your IP address, using a database installed on our own servers.
• Your settings: notifications, quiet hours, profile visibility, Resonances on or off, expressions included in your Portrait or not.
• Your reports, blocks and appeals, with the text you write in them.
• Your requests to the team: in the app (Settings → Assistance), the topic you chose, your message, your replies and the images you attach, linked to your account; without an account (Help form), your name, email address, topic and message.
• Your answers to our feedback emails, if you answer.

What we compute

• The Mirror: the main ways of seeing on a Subject, built from the expressions of everyone who answered, and the group your own expression belongs to.
• Your Portrait: the themes that recur in the expressions you chose to include. Only you can see it.
• Resonances: people whose expressions resonate with yours (shared subjects, close positions, age band, city or country).
• The times you open the app, so notifications reach you at a good moment.
• Where your Resonances began: we keep a record of the people in your very first Resonance (only the internal identifier of their accounts). It is never shown to anyone.

What is recorded automatically

• Sign-in and security: IP address, device and browser type, approximate city and country of sign-in, open sessions.
• Your time zone, for notifications.
• Your phone’s or browser’s notification token, if you allow notifications.
• Usage events, without the text of what you write: for example “a Subject was created”.
• Audience measurement described in the cookie policy.
• The campaign that brought you, if you arrive through a link from one of our campaigns: the source, medium, campaign and ad names written in the link (for example “meta”), the type of landing page and the time. It is attached to your account if you create it within 24 hours. On Android, if you install the app from one of our campaigns, the Play Store passes the same campaign information to the app, and nothing else: the app keeps it on your phone for at most 7 days and attaches it to your account if you create it within that time.
• Only with your “advertising” consent: Meta’s click identifiers (fbclid, _fbc and _fbp cookies) and TikTok’s (ttclid, _ttp cookie), your IP address and your browser type at the moment this information is sent to us.

If you report a copyright infringement

The form can be filled in without an account. We use your name, email, organisation and description only to handle the request and answer you; your identity is not shared with the person concerned. This information is kept until the request and any appeal have been dealt with.

KiftMe Plus

If you subscribe, payment goes through Stripe on the web, or through the App Store and Google Play in the apps. We never see your card number. We keep the status of your subscription, your payment history, and your statement if you withdraw or cancel.

3. Why we use it#

Each use relies on a legal basis under the EU General Data Protection Regulation (GDPR):

4. Artificial intelligence#

KiftMe uses artificial intelligence models provided by other companies to:

• bring out and word the main ways of seeing on a Subject (the Mirror);
• identify a Subject’s themes, used for the Portrait, Resonances and search;
• search Subjects by meaning and bring similar subjects and expressions together;
• estimate the tone of an expression (the emotions that come through in the words, such as joy or worry), used for Resonances and, only as group totals, in KiftMe Plus; never what you feel, which no one can know for you;
• check texts and images before they are published (prohibited or dangerous content).

Before sending, we remove email addresses, phone numbers, links, usernames (@), postal addresses and bank numbers. No account identifier is sent. A first name written inside an expression may be sent.

This also applies to 15-17 year-olds.

AI-written texts can be imperfect. No decision that seriously affects you is made by AI alone: an automatic check may hold or refuse a Subject before it is published, but you can always ask a person to review the decision (see the terms of use).

If an expression contains words suggesting distress, KiftMe shows you where to find help. This detection runs on our servers and nothing is kept. If an expression contains a threat, a member of the team reviews it.

5. Who it is shared with#

Other people on KiftMe

• A public Subject is visible to everyone, even without an account. A Subject shared by link is visible to those who have the link.
• Your expressions are never shown as written: others see the Mirror’s summary, without your name. An expression is shown to another person only if you both agree to discover each other.
• Your profile can be found only if you chose so (adults only). Your Portrait is visible only to you.
• Your messages are visible to the people in the conversation.

Our service providers

They process your information on our behalf, only for the service they provide to us:

When you tap “Play” on a YouTube or TikTok video linked to a Subject, that site’s player loads and the site receives your browsing information under its own rules.

Meta and TikTok, to measure our ads

There are no ads inside KiftMe. To become known, KiftMe runs ads on Facebook and Instagram (Meta Platforms Ireland Limited, Ireland) and on TikTok (TikTok Technology Limited, Ireland). Only if you accept advertising, and only if you are 18 or over:

• Meta’s and TikTok’s pixels load on the KiftMe website and report the pages you view, except pages whose address contains an access code or an identifier (invitation link, conversation, Mirror, profile);
• our server tells them five steps of your journey: creating your account, creating a Subject, a Subject that at least 3 other people answered, opening the KiftMe Plus payment, and your first KiftMe Plus payment with its amount and currency;
• with each step, we send them your email address and your account identifier transformed by hashing (SHA-256): they do not receive your address in plain text, but can recognise it if it matches an account they hold. Click identifiers, your IP address and your browser type are added.

Meta and TikTok never receive what you write: not your expressions, not your messages, not the title or content of a Subject. What you do in the mobile app (signing up, starting a subject, subscribing to KiftMe Plus) is never sent to them, even if you accepted advertising on the website.

For the collection by their pixels and the sending of this information, KIFTME LTD and each of these companies are joint controllers (Article 26 GDPR). What Meta and TikTok then do with this information is governed by their own policies: Meta and TikTok, which also describe their transfers outside the European Union.

You can withdraw your consent at any time in the cookie policy: the pixels go silent, their cookies are cleared from your browser and our server sends nothing more, including steps still waiting. If your browser sends the Global Privacy Control signal, it counts as a refusal.

Authorities

If the law requires it, or to protect someone’s life or safety, we may share information with the competent authorities.

We do not sell your information. It is used for no advertising beyond the measurement described above, done with your consent.

6. Transfers outside the European Union#

KIFTME LTD is in the United Kingdom, which the European Commission recognises as providing adequate protection. Some providers are in the United States or elsewhere outside the EU: these transfers rely on the EU–US Data Privacy Framework when the provider takes part in it, or on the European Commission’s standard contractual clauses.

7. How long we keep it#

When your account is deleted, your username stays blocked for 30 days (so nobody can take it right away), then becomes free again. We erase your expressions, Portrait, Resonances, images, settings, messages and your requests to the team (Assistance), with their replies and images. What remains, detached from your identity: a Subject other people have answered, the messages others wrote to you (in their conversation), and reports. If you paid (KiftMe Plus), a minimal record (email address, first name, date of birth) is archived securely for 10 years for our accounting obligations, then erased; without a payment, nothing is archived. Messages linked to an open safety case are kept until it is closed. The record of a very first Resonance (the accounts’ internal identifier, with no name or other information) is kept, including after an account is deleted.

8. Your rights#

• See and download your information: from your settings, you receive a file.
• Correct your first name, username, bio, gender, city and email address in settings. Your date of birth: write to us.
• Delete your account from settings (90 days to change your mind).
• Object to Resonances (a switch in settings), remove an expression from your Portrait, turn off the email digest or notifications.
• Withdraw your consent to session recording and to the measurement of our ads, in the cookie policy.
• Restrict the use of your information or ask for it to be sent to another service: write to us.

Write to [email protected] for anything else. We answer within one month. You can also contact the French data protection authority, the CNIL (cnil.fr), or the authority of your country.

9. If you are 15 to 17#

You must be at least 15 to use KiftMe. From 15 to 17:

• your profile can never be found or made public;
• Resonances only suggest people aged 15 to 17;
• you do not receive our feedback emails and KiftMe Plus is not offered to you;
• nothing is ever passed to Meta or TikTok, even if advertising was accepted on your device;
• your answers never appear in KiftMe Plus analyses (Mirror exploration, subject statistics): they only count in the Mirror everyone sees;
• your expressions go through the same AI tools as adults’ (see above), without your name.

If you find out that a child under 15 uses KiftMe, write to us: the account will be deleted.

10. If you live in the United States#

You have the same rights as described above. We do not sell your information. We share it for advertising only with your consent, given in the cookie banner (Meta and TikTok, see “Who it is shared with”): without that consent, nothing is shared. Your browser’s Global Privacy Control signal counts as a refusal.

What you express may be about your physical or mental health. This information is used only to run KiftMe (Mirror, Portrait, Resonances) and is shared with the providers listed above for that purpose only. If you live in Washington State or Nevada, you can ask to see it or delete it at [email protected].

Do Not Track: KiftMe does not respond to this signal, but our audience measurement works without cookies until you accept the banner.

11. Security#

Connections are encrypted (HTTPS), notification tokens are encrypted in our database, images are stripped of their metadata (including GPS location) on upload, and access to moderation tools is limited to the team, with two-factor authentication.

12. Changes and contact#

If this policy changes significantly, we will tell you in the app or by email before the change applies. The date at the top of the page shows the version in force.

Contact: [email protected] - KIFTME LTD, 20 Wenlock Road, London, N1 7GU, United Kingdom.