Privacy Policy
Hat Trick is a gift exchange app run by Cascadia Digital Inc. ("we", "us"). This policy explains what we collect when you use hat-trick.app, why, and what you can do about it. The short version: we collect what it takes to run your group's gift exchange, we keep your draw secret, and we don't sell your information or show you ads.
What we collect
When you have an account
- Account details: your name, email address, and a securely hashed password. If you set up two-factor authentication or a passkey, we store what's needed to verify it.
- Your groups and events: which groups you belong to, your role in them, the events you take part in, and your partner if you name one.
- The draw: who is giving a gift to whom. Nobody sees the pairings except each person seeing their own match. An organizer can open them deliberately to sort out a problem.
- What you write: wish list items, anonymous messages with your match or Secret Giver, and bulletin board posts, replies and reactions.
- Notifications and preferences: the in-app notifications we've sent you and which ones you've chosen to receive by email.
When you buy Pro
Payments are handled by Paddle, our reseller (see below). You give your payment details, email address and billing country to Paddle, not to us, and we never see or store your card details. From Paddle we keep a record of each purchase: Paddle's IDs for the transaction and for you as a customer, the amount and currency, and the dates your Pro pass covers.
To show you the Pro price in your currency, we send Paddle the country your request comes from (or your IP address, if the country isn't known) when you view a page with prices.
When someone invites you
The person inviting you gives us your name and email address so we can send you an invitation. If you don't accept, the invitation can be revoked and deleted by the group's organizers.
When you ask for early access
We store the email address you give us, and the type of group if you choose one, so we can invite you when there's room.
Automatically
- Sign-in sessions: while you're signed in, we record your IP address and browser details with your session to keep your account secure.
- Server logs: like most websites, our servers keep short-lived technical logs (for example, errors and request details) to keep the service running.
How we use it
- To run the service: draw names, show you your match, deliver wish lists, messages and posts, and remind you about events.
- To send you email you need (invitations, sign-in links, "names are drawn" notices) and email you've chosen to receive (message and board notifications, and reminders before your Pro pass ends, all of which you can turn off in Settings).
- To sell and provide Pro: show local prices, confirm your payment with Paddle, and show your purchases and receipts in Settings.
- To keep accounts and the service secure, and to prevent abuse (for example, rate-limiting sign-in attempts and form submissions).
We don't sell your personal information, we don't use it for advertising, and we don't run ad trackers on Hat Trick.
Who else handles it
We use a small number of service providers to run Hat Trick, and they only process your information on our behalf:
- Laravel Cloud hosts the application and its database.
- Postmark (ActiveCampaign, LLC) delivers our email.
- Paddle (Paddle.com Market Ltd and its affiliates) is our reseller and Merchant of Record. It takes payments, handles tax and receipts, and processes your payment information under its own privacy policy.
- Fathom Analytics counts page visits so we can see how Hat Trick is used. Fathom doesn't use cookies, doesn't collect personal information, and doesn't track you across other websites. It isn't loaded on invitation or password-reset pages.
When you add a link to your wish list, our server visits that link to fetch a preview (its title, description and image). The site you linked to will see that request coming from our server, not from you.
We may disclose information if required by law, or to protect the rights, safety or property of our users or others.
Cookies
Hat Trick uses only the cookies it needs to work: a session cookie that keeps you signed in, a security token that protects forms, and, if you tick "Remember me", a cookie that keeps you signed in longer. We don't use advertising or analytics cookies; our analytics (Fathom) works without cookies. Your browser may also store small preferences for this site (such as dismissing a prompt), which stay on your device.
How long we keep it
We keep your information while you have an account. Past events stay in your group's history (so that, for example, next year's draw can avoid repeating last year's match) until the event or your account is deleted. Early-access requests are kept until we invite you or you ask us to remove them. Our record of your Pro purchases is deleted with your account; Paddle keeps its own records of your payments for as long as tax and accounting law requires. Server logs are kept only briefly.
Your choices and rights
- Update your name and email in Settings, and change which notifications you receive.
- Delete your account from Settings → Profile. This removes your account, your wish lists, and your messages and posts. Past draws you were part of may lose your side of the pairing.
- Ask us for a copy of your information, to correct it, or to delete it by emailing support@hat-trick.app . Depending on where you live, you may have additional rights under local law, and we'll honour them.
Children
Hat Trick accounts are for people aged 13 and over, or older where local law sets a higher minimum age. Younger children shouldn't create their own account; a parent or guardian can take part on their behalf. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has given us their information, email support@hat-trick.app and we'll delete it.
Teens who have their own account should use Hat Trick with a parent's or guardian's permission. A parent or guardian can ask us at any time to see, correct or delete their teen's information.
Security
We protect your information with encryption in transit (HTTPS), hashed passwords, optional two-factor authentication and passkeys, and access controls that keep each group's data separate. No system is perfectly secure, but we work to keep yours safe and will tell you if something goes wrong that affects you.
Where your data is stored
Your information is stored and processed in the United States (Virginia) by our hosting and email providers. If you live outside the United States, including in Canada, your information is transferred there, and it may be accessible to authorities under the laws of the United States.
Changes to this policy
If we make meaningful changes, we'll update the date at the top and let you know by email or in the app.
Contact
Cascadia Digital Inc. is responsible for the personal information Hat Trick holds. For questions, requests or complaints about privacy, email support@hat-trick.app . If you're in British Columbia and we can't resolve a concern, you can also contact the Office of the Information and Privacy Commissioner for British Columbia.