Privacy policy
Last updated: 2026-10-25
This privacy policy explains what personal data NoruGidas collects when you use norugidas.lt, why we collect it, who we share it with, how long we keep it and what rights you have. NoruGidas helps people plan events and share wishlists: an organiser makes a list of what is needed or wanted, shares a link, and guests pick what they will bring or give.
1. Who is responsible for your data
The controller of your personal data is M. Ž., a self-employed individual in Lithuania (individual activity certificate No. 1387241), who runs NoruGidas.lt.
For any privacy question or request, write to [email protected].
2. What data we collect
Account data. When you sign in we receive your email address and, if you sign in with Google, your name and profile picture address from Google. We also store your preferred language and time zone, and whether your account is an administrator account. We do not use passwords: you sign in with a one-time email link or with Google.
Lists and items. The lists you create (title, description, visibility dates, custom address, theme, optional list password, which we store only in hashed form) and their items (title, description, link, price, quantity and photos you upload). Photos are resized and stripped of hidden information such as location and camera details before they are stored.
Choosing items on someone's list. When you pick an item on a list, we store that your account chose it and whether you marked it as "got it". If you choose an item anonymously (a paid option), we store your email address in encrypted form only so we can send you updates about that item.
Purchases. What you bought, the amount, the currency and the date. Payments are handled by Stripe; we never receive or store your card details.
Reports. If you report a list, we store your account and the reason you gave.
Emails we send. We keep a record that a notification was sent (its type, time and the related list or item), but not its content, so that we do not send the same email twice.
Technical and security data. To protect the service from abuse we use Cloudflare Turnstile on the sign-in page, and we limit repeated actions using scrambled (keyed hash) versions of IP addresses and account identifiers, kept only for a few minutes. Cloudflare tells our server which country a visit comes from; we use it only to show the right language and currency and do not store it. Our hosting provider keeps standard server logs.
Analytics. If enabled, we use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, lists, items and choices; sending sign-in links and emails about your lists and choices | Performance of our contract with you (Art. 6(1)(b)) |
| Processing payments and activating the features you bought | Performance of a contract (Art. 6(1)(b)) |
| Keeping purchase records for accounting | Legal obligation (Art. 6(1)(c)) |
| Protecting the service from spam, fraud and abuse; handling reports and moderating content | Our legitimate interest in a safe service (Art. 6(1)(f)) |
| Showing the site in your language and prices in your currency; counting visits anonymously | Our legitimate interest in a working, understandable service (Art. 6(1)(f)) |
| Signing in with Google | Performance of a contract (Art. 6(1)(b)), at your choice |
We do not sell your data, we do not show advertising and we do not make decisions about you by automated means.
4. Who can see your data
- Anyone with a list's link can see the list and its items (and, if the owner set a password, only after entering it). They see which items are already taken, but not who took them.
- List owners see that an item was chosen. With the paid "Guest visibility" feature, an owner can also see the name and email address of guests who chose items on that list, including choices made before the feature was bought. You are told about this before you choose an item. Owners never see who made an anonymous choice.
- Administrators of NoruGidas can view all lists, including drafts and disabled lists, to moderate content, handle reports and process refunds.
5. Service providers
We use these providers to run NoruGidas. They process data only on our instructions or, where stated, as independent controllers under their own privacy policies:
- Hostinger – website hosting, database, photo storage and sending emails (servers in the European Union).
- Cloudflare – content delivery, protection against attacks, sign-in protection (Turnstile) and, if enabled, cookie-free visit statistics.
- Stripe – payment processing. Stripe acts as an independent controller for payment data.
- Google – only if you choose to sign in with Google.
Cloudflare, Stripe and Google are based in the United States and may process data outside the European Economic Area. Such transfers are protected by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
6. Cookies
We use only cookies that are needed for the site to work or for features you ask for. We do not use advertising or tracking cookies, so we do not show a cookie banner.
| Cookie | What it does | How long |
|---|---|---|
Sign-in session (better-auth.session_token, may be prefixed with __Secure-) |
Keeps you signed in | Until you sign out, or about 7 days without use |
locale_choice |
Remembers the language you picked in the language menu | 1 year |
list_access_… |
Remembers that you entered a list's password | 7 days |
Cloudflare may set its own security cookies (for example __cf_bm) to tell people from bots. When you pay, sign in with Google or complete the sign-in check, you use Stripe's, Google's or Cloudflare's own pages and widgets, which follow their own cookie policies.
7. How long we keep data
| Data | How long |
|---|---|
| Account data | Until you delete your account |
| Lists, items and photos | Until you delete the list or your account. Lists stop being visible when their visibility period ends but are not deleted automatically; you can ask us to delete a published list at any time. Photos are deleted from our server once no item uses them. |
| Your choices on other people's lists | While the list exists; if you delete your account, they stay on the list without your name or email |
| Purchase records | 10 years, as required by Lithuanian accounting law; after you delete your account they are no longer linked to you |
| Reports | Until you delete your account |
| Record of sent emails | Until you delete your account, after which it is no longer linked to you |
| Sign-in links | 15 minutes |
| Rate-limit data (hashed) | A few minutes |
| Hosting server logs | As set by our hosting provider |
8. Your rights
You have the right to access your data, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive it in a portable format.
- On your Account page you can download all your data and delete your account yourself.
- For anything else, write to [email protected]. We will reply within one month.
If you believe we handle your data unlawfully, you can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, [email protected], vdai.lrv.lt, or to the data protection authority in the country where you live.
9. Children
NoruGidas.lt is not intended for children under 14. If you are younger, please use it only with a parent's or guardian's permission.
10. Changes to this policy
We may update this policy when the service changes. We will show the date of the latest change at the top, and tell signed-in users by email about important changes.