Privacy Policy

1. Who we are

Hostynets (hostynets.app, the mobile app and the browser extension) is operated by the individual entrepreneur (FOP) Козачок Ксенія Андріївна, registered in Ukraine ("we", "us"). We are the controller of the personal data described in this policy.

For any privacy question or request, write to privacy@hostynets.app.

2. Data we collect

• Account data: email address, username, display name, avatar, and the profile details you choose to add, such as birth date, timezone, language, currency, interests and gift preferences.
• Sign-in data: when you sign in with Google, Apple, Discord or GitHub, that provider sends us your name, email address and an account identifier. We never receive your password for that account.
• Content you create: gift ideas, wishlists, occasions, shop links, notes, people you track and the feedback messages you send us.
• Billing data: your plan, subscription status and payment history. Card details are entered on and stored by our payment provider; we keep only a payment reference and a masked card identifier.
• Technical data: IP address, browser and device information, and server logs. We derive an approximate location (country, region, city) from your IP address using a database hosted on our own servers; your IP address is not sent to a third party for this.
• Usage data: which recommendations you open or dismiss, and, only if you accept analytics cookies, aggregated usage statistics collected by Google Analytics.

3. Information about other people

Hostynets lets you keep notes about the people you buy gifts for, such as their name, birthday, sizes and preferences. Only add information you are entitled to share. We use it solely to provide the service to you. Anyone who believes we hold data about them can contact us to access or remove it.

4. How we use your data and why

• To provide the service - your account, lists, occasions, reminders, notifications and sharing with your connections (performance of our contract with you).
• To process payments and keep the records tax law requires (contract and legal obligation).
• To personalise gift suggestions, including by your region when you allow it in Settings (legitimate interest; you can switch regional personalisation off at any time).
• To keep Hostynets secure - rate limiting, abuse prevention and a security audit log (legitimate interest).
• To understand how the site is used through Google Analytics, only after you accept analytics cookies (consent, which you can withdraw).
• To send service emails such as reminders, digests and billing notices. You can turn digests off in Settings; essential account and billing emails cannot be disabled while you have an account.

We do not sell your personal data and we do not use it for third-party advertising.

5. Who sees your data

• Other users see what you choose to share: your public profile, public wishlists and gift ideas, and occasions you share with your connections. Everything else is private by default.
• Service providers that process data on our behalf: Hetzner Online (hosting, servers in the EU), Monobank / JSC Universal Bank (payments), Resend (email delivery) and Google (analytics, only with your consent).
• Sign-in providers (Google, Apple, Discord, GitHub) only when you choose to sign in with them.
• Authorities, when the law requires it, or when needed to protect our users or our rights.

Some of these providers are located outside Ukraine and the European Economic Area, for example in the United States. Where that happens, the transfer relies on the safeguards those providers offer, such as the European Commission's standard contractual clauses.

6. Cookies

We use a small number of cookies:

• hostynets_session - keeps you signed in (14 days). csrftoken - protects forms against cross-site request forgery.
• theme - remembers your light or dark mode (1 year). hn_consent - remembers your analytics choice (1 year). A short-lived cookie (a few seconds) keeps what you see consistent right after you save a change.
• _ga and _ga_* - Google Analytics, set only after you accept analytics cookies.

The first group is strictly necessary and does not need consent. You can change your analytics choice at any time with the "Cookie settings" link at the bottom of the page.

7. How long we keep data

• Account data and content: for as long as your account exists. When you request deletion, the account enters a 14-day grace period during which you can cancel; after that it is permanently deleted.
• Notifications: 180 days. Recommendation activity: 365 days.
• Security audit log: 2 years. Entries are kept without a link to your account after it is deleted.
• Payment records: for the period required by tax and accounting law.

8. Your rights

Under the Law of Ukraine "On Personal Data Protection" and, where it applies, the EU General Data Protection Regulation, you can ask to access, correct, export or delete your data, object to or restrict its processing, and withdraw consent at any time.

You can edit most data and delete your account yourself in Settings. For anything else, write to privacy@hostynets.app - we reply within 30 days. You also have the right to complain to the Ukrainian Parliament Commissioner for Human Rights or, if you live in the EU, to your local data protection authority.

9. Security

All traffic is encrypted with HTTPS, access to production systems is restricted, and API requests from our apps are signed. No system is perfectly secure, so please tell us right away if you notice anything suspicious.

10. Children

Hostynets is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service changes. We will change the date at the top and, for significant changes, notify you in the app or by email before they take effect.

This policy is translated for convenience; if versions differ, the English version prevails.