Loading St. Nick's List
Your information, clearly explained
This policy describes the real data flows behind accounts, households, guest access, wish lists, gift exchanges, group gifts, referrals, support, and private gift coordination on St. Nick's List.
St. Nick's List is operated by Baldwin Industries in Ontario, Canada (“St. Nick's List,” “we,” “us,” or “our”). This policy applies to stnickslist.com and the St. Nick's List services reached through it. Baldwin Industries is responsible for the personal information described here.
The service helps people organize households, recipient profiles, occasions, wish lists, and private gift coordination. It is designed so list recipients do not see giver-only coordination details, such as who reserved or purchased a gift.
We ask you not to enter highly sensitive information in profile notes, lists, or comments. Do not add government identifiers, financial account numbers, medical records, or another person's private information unless it is necessary and you have authority to do so.
Where a law requires a legal basis, we rely on performing our agreement with you, legitimate interests in operating and securing the service, consent for optional analytics or particular profile uses, and legal obligations. You can withdraw consent where consent is the basis, but withdrawal does not make earlier lawful processing unlawful. Some essential processing is required to provide the service.
Household owners and authorized guardians can manage the profiles assigned to them. Profile fields have separate visibility controls, so sharing a name or wish list does not automatically share an address, sizes, or private notes. A giver link is a bearer credential: anyone who possesses it may use the access it grants until it expires, is exhausted, or is revoked. Send these links privately.
Guests receive a management link and a separate recovery link. Those links are shown when issued and are not recoverable by our staff in readable form. A guest can later claim their membership with an authenticated adult account without gaining access to past giver-only activity that their guest role could not see.
Gift exchange assignments are revealed only to the participant who owns that draw. A recipient can attach a private list through a revocable, exchange-scoped grant. Exchange messages use role labels instead of revealing the other participant's identity and are encrypted before database storage.
Kindness programs, household-authored prompts, recorded moments, and optional reflections remain within the household. A person must be able to manage the connected profile, and the profile must belong to the program's household. Completing or archiving a program closes it to new moments. Removing a moment removes its stored reflection, while aggregate operational history may continue to record that an action occurred without its profile, prompt, or reflection.
Guardian coverage shows a child's household how many of each wished item are reserved, bought, and still needed. It shows counts only, never who reserved or bought anything. It is on by default for children's lists, and the household owner or organizer can turn it off. For a teen's list it stays off unless the household turns it on and the teen consents from their own account, and a teen never sees coverage of their own list.
Children under 13 (under 14 for households whose province is set to Quebec) may not create an account or guest identity. An adult guardian may create and manage a recipient profile for a child when the adult has authority to do so. The child does not need to sign in, and we do not use child profiles for advertising or direct marketing.
Teens aged 13–17 (14–17 for households whose province is set to Quebec) may use a linked teen account only with recorded guardian consent. Teen profiles use protective defaults and restricted management rights. A teen profile does not silently become an unrestricted adult profile: the controlled transition requires the appropriate authenticated approvals and keeps an audit record without expanding historical visibility.
A guardian can revoke active consent in the profile controls. Revocation may restrict or suspend the linked teen's access while we preserve only the records needed for safety, legal compliance, and proof of the consent decision. If you believe a child has created an account or supplied information improperly, email [email protected].
We retain information for the shortest period reasonably needed for the purpose shown below, then delete or irreversibly de-identify it. A legal hold, active dispute, security investigation, or mandatory recordkeeping rule can temporarily override the normal schedule for the affected records.
| Record | Normal retention |
|---|---|
| Active account, household, profile, and list data | While the account or authorized household relationship remains active. |
| Guest identity and membership | Deleted after 365 days without guest activity; a warning is scheduled 30 days before expiry when a verified destination is available. |
| Sign-in challenges and raw access links | Raw secrets are not retained after issue. Challenges and grants expire on their short configured deadlines; limited hashed security evidence may remain. |
| Expired or revoked invitations and giver grants | Access stops immediately on expiry or revocation. Minimal issuance, use, and revocation evidence remains as part of the security audit record. |
| Referral attribution | The first-party referral cookie expires after 30 days. Account deletion removes referral links you created and anonymizes conversion linkage to your account. |
| Support conversations | Kept while needed to answer the request, maintain service and safety evidence, or resolve a dispute. Verified account deletion removes the requester's support cases and their encrypted messages unless a valid legal hold applies. |
| Account deletion | The account enters a closing state immediately, active access is revoked, and a durable deletion job removes authentication and product data. Deletion evidence is retained without preserving erased profile content. |
| Consent, privacy, deletion, fraud, and audit evidence | Only as long as reasonably necessary to demonstrate compliance, protect users, resolve disputes, and meet applicable limitation or recordkeeping periods. |
| De-identified service measurements | May be retained for long-term reliability and planning when they can no longer reasonably identify or be linked back to a person. |
We use layered safeguards appropriate to the information, including encrypted network connections, encrypted address, support, exchange-draw, and exchange-message content, one-way hashing for bearer credentials, passkey-compatible authentication, short-lived challenges, role and row-level access controls, anti-forgery controls, rate limits, secret redaction, idempotent payment handling, audit events, and monitored deletion jobs. Administrative and service access is limited by environment and purpose.
No online service can guarantee absolute security. If you believe a secret link or account has been compromised, revoke it in the service where possible and contact [email protected].
Depending on where you live and subject to legal exceptions, you may ask us to provide access, correct information, export data, delete information, restrict or object to processing, withdraw consent, or explain a decision. You may also complain to the privacy or data-protection authority where you live. We do not discriminate against anyone for exercising a privacy right.
Signed-in users can use the Privacy Center to export, correct, or delete account information. You can also email [email protected]. We verify requests in proportion to their sensitivity. An authorized agent may submit a request where local law permits, but we may require proof of authorization and direct identity confirmation.
Some requests cannot be completed exactly as submitted—for example, when information belongs to another household member, disclosure would reveal giver-only activity, or a record must be kept for security or law. We will explain applicable limits.
We are based in Canada, but personal information is stored and processed outside Canada. Primary hosting, the database, authentication, and backups are in Finland (Helsinki). An encrypted offsite backup copy is kept in the United States (Ashburn, Virginia). Resend (email delivery), PostHog (page counts and, with consent, product events), and Google Analytics (with consent) process information in the United States, and Stripe (payments) and Sentry (error monitoring) may also process it there.
Those countries have different privacy laws, and courts, law enforcement, and national security authorities there may be able to access information under their laws. We use contractual, organizational, and technical protections appropriate to each transfer, including encryption of backups and of sensitive fields before storage.
We may update this policy as the service or law changes. We will update the effective date and version. If a change materially affects how account information is used, we will provide a prominent notice and request renewed acceptance or consent when required. Earlier versions and acceptance evidence are retained as needed to show which policy applied.
Contact the Baldwin Industries Privacy Officer at [email protected]. We will acknowledge and investigate privacy complaints, explain our decision, and describe available escalation options.
Questions about this policy, requests to access, correct, or port your personal information, withdrawals of consent, and privacy complaints can be sent to the Person in charge of the protection of personal information at [email protected].
Quebec residents may also file a complaint with the Commission d'accès à l'information du Québec.