Privacy policy

1. Who is responsible

Emir Dupovac, as an individual, Sarajevo, Bosnia and Herzegovina. Šarena Laža is a project name, not a registered company. Contact: podrska@sarenalaza.com.

2. What we keep

• Account: email, name, username, language and currency. Optionally a photo, a short bio and your birthday. Only you see your birth year.
• Lists and wishes: titles, notes, links, prices and photos, plus sizes and preferences you choose to show.
• Friends and notifications: who your friends are and your in-app notifications. If you turn on notifications on a device, we keep that browser’s subscription.
• Reservations: the name and email of the person who reserves a gift, even without an account, so they can manage the reservation and get reminders.
• Group gifts and Secret Santa: who takes part, shares, card notes and, in Secret Santa, the pairs that only the giver sees.
• Reports you send, or that we receive about you.
• Technical data: a sign-in cookie and server logs needed to run the service and keep it safe.
• Wishes are stored once and belong to you; you decide which lists they are on, and a wish on no list is visible only to you. When you add someone else’s wish to your list, we keep only whose list it came from, and only you can see that.

3. Why we use it

To provide the service (lists, reservations, emails, groups), based on the terms of use. For optional things (public profile, gift ideas, notifications), based on your consent, which you can withdraw in Settings. For security and preventing abuse, based on our legitimate interest.

4. Who sees what

• Privacy is set per list: public, friends only, or link only. Public lists and public profiles can be found by search engines; nothing else can.
• A list owner never sees reservations on their wishes until the giver marks the gift as given.
• Only friends see your exact birthday. Everyone else sees the month. Only you see the year.
• In Secret Santa only the giver sees who they drew. The organizer sees who is in the group, but not the pairs.
• Who sees a wish depends on the lists it is on: a public list is seen by anyone, a friends list by friends only, a link list by whoever has the link. Neither you nor someone you share a list with can see who reserved a gift until they mark it given.

5. Gift ideas

If you have a public list or a public profile (a wish on any public list), our team may turn one of your wishes into an anonymous idea (title, link, shop, price and, only after our team has checked that it shows just the product and no person, the photo; never your name). An idea is only published after approval and can’t be linked to you. It stays when you delete a wish or your account, because it no longer belongs to you.

6. Emails

We only send emails about the services you use: confirmations, reservation reminders, group invites and gift updates. The email of someone who reserves without an account is used only for that gift and its reminders, and is deleted 60 days after the gift is given or cancelled, when the manage link stops working too. The private link to manage a reservation is valid until 60 days after the gift is given or cancelled, and can be requested again.

7. Who else handles data

We use trusted providers: Supabase (database, sign-in and file storage; data is in the EU), Resend (sending email), hosting and Cloudflare (delivering pages), and Google if you sign in with a Google account. When you add a shop link, our server fetches that public page to get its title and picture. We don’t sell data and there are no ads. We record app errors with Sentry (EU); only the error text and the kind of page is sent, with no personal data, cookies or secret links. Some of them (for example Google and Cloudflare) may handle data outside the EU; they rely on safeguards approved by the EU, such as standard contractual clauses.

8. Cookies

We only use necessary cookies: sign-in, your language and appearance, and returning to a page after signing in. No advertising or tracking cookies. If we add cookie-free analytics, we’ll say so here.

9. How long we keep data

While you have an account. When you delete it (Settings → Delete account), your profile, lists, wishes and photos are deleted, and people who reserved a gift from you are told. Anonymous ideas stay, with no connection to you. Copies in our database provider’s backups are overwritten on its regular schedule. Reports are kept only as long as needed to handle them.

10. Your rights

You can ask for access to your data, correction, deletion, portability, restriction or object to its use, and you can withdraw a consent you gave at any time. You can do most of this yourself in the app (edit profile, Settings, Delete account). For anything else, contact us at podrska@sarenalaza.com and we will answer within one month. You may also complain to the data protection authority of the country where you live (in the EU) or to the Personal Data Protection Agency of Bosnia and Herzegovina.

We don’t make automated decisions about you and we don’t profile you.

11. Children

Šarena Laža is meant for people aged 16 and over. A list for a child is made and looked after by a parent or guardian, who decides what is on it. If you think a child has made an account, write to us and we will delete it.

12. How we protect data

Data travels over encrypted connections (HTTPS). The privacy rules are enforced in the database itself, so a list owner can’t see reservations even by asking the server directly. Only our team can use the admin area, and it needs a second step at sign-in.

13. Changes

If this policy changes in a meaningful way, we’ll tell you in the app or by email and change the date at the top.