Last updated: October 8, 2026
This website is operated by Lukas Imhof, based in Switzerland. We respect your privacy and are committed to protecting your personal data in compliance with the Swiss Federal Act on Data Protection (nFADP) and the European Union’s General Data Protection Regulation (GDPR).
We collect and use personal data for the following purposes:
We process this data based on your consent where required, the performance of a contract, compliance with legal obligations, and our legitimate interest in operating, securing, and defending the platform.
Your data is stored on systems operated or managed by us and by service providers that help us run and protect the Service. We do not sell personal data for money. Sharing identifiers with advertising providers may be considered a sale or sharing under U.S. state privacy laws, and you can opt out as described below. We may share data with third parties only where necessary to operate, secure, investigate, defend, or comply with legal obligations relating to the Service, including:
Some data, such as IP addresses, may be processed by Cloudflare when you access the site. Cloudflare is certified under the EU-U.S. Data Privacy Framework and provides appropriate safeguards under GDPR. We ensure data transfers outside of Switzerland or the EU are protected through standard contractual clauses or equivalent safeguards where required.
We may disclose relevant information, including account data, uploaded content, logs, or report records, where necessary to enforce our Terms, investigate suspected abuse or illegal activity, protect our rights or the safety of others, or comply with legal obligations, lawful requests, court orders, or regulatory requirements.
If you choose Google to create an account or sign in, we send Google an authorization request using the openid and email scopes. We receive a one-time code and exchange it with Google for an identity token. We verify the token, use your verified email address to create your account, and use Google's stable account identifier (the sub value) to recognize your account when you sign in again. We do not automatically link an existing password account based on a matching email address.
We store your email address in your account and the Google identifier in a separate account-link record. We use a session cookie to keep you signed in. The one-time code, identity token, and temporary security values are used to complete and protect sign-in; we do not keep them after the flow ends. Deleting your account also deletes its Google account-link record. We do not request your Google password or the profile scope, and do not use Google profile photos, contacts, files, or other Google account content.
Google receives and processes the authorization request under its own privacy terms. Google sign-in itself does not grant permission for optional Google Analytics, advertising measurement, or customer matching; those uses have separate settings and disclosures below. For questions or help, contact [email protected].
If you create, upload, or share content through the Service, that content and related metadata may be processed to host and deliver the Service, secure the platform, investigate misuse, respond to complaints, and enforce our Terms. We may review user content and related account information when reasonably necessary to investigate suspected abuse, illegal content, non-consensual intimate imagery, infringement claims, fraud, or other Terms violations.
If you contact us with a complaint, abuse report, or takedown request, we may use the information you provide to investigate the matter, communicate with the reporting party, preserve evidence where appropriate, and take action on the affected account or content.
We use essential cookies to enable core site functionality, such as login sessions. Outside the United States, and when your location is unknown, optional analytics and advertising cookies require your consent. For visitors detected in the United States, these cookies are enabled by default unless you have opted out or send a Global Privacy Control signal. You can control cookie settings in your browser. Disabling cookies may affect your experience on the site.
We use Google Analytics 4 (“GA4”) to understand how visitors use our website and to improve user experience. GA4 is provided by Google LLC, USA. GA4 collects information such as pages visited, time spent, and device/browser type. Your IP address is anonymized before storage. Data may be transferred outside Switzerland and the EU, with safeguards under the EU-U.S. Data Privacy Framework and standard contractual clauses. Analytics cookies follow the regional choices described in this section.
When optional tracking is enabled, we also use Meta Pixel and the Meta Conversions API to measure ad performance and subscription conversions. Depending on the event and what is available, Meta may receive identifiers such as cookies, URL parameters, IP address, browser metadata, email address, and subscription identifiers for attribution and reporting. Meta tracking is disabled if you decline optional cookies or opt out.
When optional measurement is enabled under the choices above, we measure completed account registrations, checkout starts and confirmed purchases. We use browser and session identifiers and an internal account identifier to connect these steps. Reports may include traffic source and campaign, country, language, device category, checkout entry point, checkout format, product, transaction value and currency. We distinguish subscription starts, renewals and site extensions. We do not send names, email addresses in ordinary analytics events, private page content, partner details or relationship information. Email matching requires the separate permission below.
For server-side revenue reporting without optional measurement, we do not attach browser/session identifiers, browser device details or checkout-entry details. Such payments and automatic renewals are labelled separately from browser-linked purchases. They do not establish that a person visited the site or used a desktop device, and payment events do not measure time spent on the site.
We also record transaction-related events server-side via GA4 Measurement Protocol based on our legitimate interest (Art. 6(1)(f) GDPR) in measuring revenue and optimizing the service. This server-side processing does not rely on cookies. It includes an internal account identifier, transaction identifier, product, value, currency and billing country for purchase and subscription revenue reporting. Optional advertising use follows the permissions described here.
Analytics data in Google Analytics 4 is retained for a maximum of 14 months, after which it is automatically deleted. Event-level data is stored for up to 2 months. Data retention is automatically extended when a user engages again with the site, unless you have deleted your account.
For visitors detected in the United States, the initial prompt asks only about Google customer matching. “Allow matching” permits that matching; “No thanks” declines it. Neither button changes your separate analytics and ad-measurement setting. Use “Do Not Sell or Share My Personal Information” below the prompt or in the footer to turn off optional tracking and customer matching. Previous opt-outs and Global Privacy Control remain in effect.
With your separate, optional permission, we share a SHA-256 hash of your account email, an internal account identifier, website activity and future purchase details with Google through Google Analytics. Purchase details include the transaction identifier, product, value and currency. Google can match the hashed email with Google accounts to improve advertising measurement and help us build purchaser audiences for personalized advertising in Google Ads. This can include purchases from organic search, referrals and other sources. Hashing does not make this information anonymous. We do not share the private content of your pages, partner details or relationship information for this purpose.
This permission is separate from email newsletters and ordinary cookie choices, and is required for customer matching in every country, including the United States. An earlier cookie acceptance or completing a purchase does not grant it. You can choose Accept all on the banner or select individual options in Show options. Google customer matching is not preselected for a new choice. Declining does not affect your account, purchases or access to the service. We use consent as the legal basis for this optional sharing.
Open Privacy settings to change your choice. When signed in, withdrawal applies to future account-linked matching on all devices. We also honor Global Privacy Control and our Do Not Sell or Share control. A browser opt-out applies to accounts linked to that browser's privacy record; if you cleared cookies or are using another device, sign in to withdraw for your account. After withdrawal, we stop future matching uploads and request deletion of the account-linked data already shared with Google Analytics. Google's processing is not instantaneous. Contact [email protected] if you need help.
Google LLC and its relevant affiliates receive this data, including processing in the United States, under the transfer safeguards described above. See how Google uses information from sites that use its services. We retain a record of your choice, the wording and version presented, and the time of the choice to demonstrate and manage consent. Matching permission expires after one year unless you renew it. Local delivery payloads are removed seven days after delivery or final failure. Consent and withdrawal records are retained as needed to demonstrate compliance and resolve disputes.
We use browsing activity, device information, cookie and advertising identifiers, and conversion details for analytics and advertising measurement, including sharing with Google and, when enabled, Meta and TikTok. Click Do Not Sell or Share My Personal Information to disable optional browser tracking and future consent-dependent advertising events for this browser. No account is required. We honor Global Privacy Control signals, even if you previously accepted cookies. Your choice is saved in this browser; apply it on other browsers or devices as well. Essential service and payment processing continue.
Depending on your state and applicable law, you may have rights to access, correct, delete, or receive a copy of your personal data, opt out of sale, sharing, or targeted advertising, and appeal a denied request. Contact [email protected] to exercise these rights or appeal a decision. We will not discriminate against you for exercising your privacy rights.
If you manually delete a One Gift page, its published content is removed. We retain the purchase record and any unused online time credit on your account so you can apply it to a replacement page. The credit's timer does not run while no page is assigned to it.
We retain personal data only as long as necessary for the purposes described in this policy or as required by law. Published pages and their content can expire and be deleted while your account remains active: new pages normally have a seven-day expiry, while a One Gift page has a 12-month term from publication unless its online time is extended. An unpublished builder draft is saved in your browser's local storage and may be lost if you clear browser data or use another device. Account and purchase records may be kept longer where needed to provide an unused purchase, handle disputes, prevent fraud, secure the Service, or meet legal obligations. Stripe may retain payment-related data for up to 10 years due to financial regulations.
Where content, account activity, or report information is relevant to abuse investigations, legal claims, safety reviews, or compliance obligations, we may retain the relevant data for longer than ordinary account data where reasonably necessary to investigate, document, enforce, or comply with those obligations.
You have the right to:
If you have any questions about this policy or your personal data, please contact:
Lukas Imhof
Email: [email protected]