Privacy Policy

TrendDoodle has no user accounts. Its image tools process the choices you make in the browser so they can display and export your creation. The Secret Santa and Gift Exchange generators store the exchange name, participant names, date, optional budget and message, exclusions, fixed assignments, claim status, and access credentials needed to operate the private draw. They do not collect email addresses for the draw.

Exchange data is stored in TrendDoodle's connected PostgreSQL database. The shared group link reveals event details, participant names, and claim status, but not assignments. After a participant claims their own name, server-side checks allow that browser to view only that participant's recipient.

This is a trust-based game without identity verification. Anyone who has the group link could claim another participant's name first. Organisers should share the link only with their intended group.

The private management link allows its holder to view claim status, reset participant access, or delete the exchange. Secret access tokens are stored as cryptographic hashes where appropriate. Management secrets are carried in a URL fragment so browsers do not send them in page request URLs.

Images you upload stay in browser memory while you use the tool. Their temporary object URLs are used only to show and export your grid, and TrendDoodle does not upload those files to permanent storage.

Draft settings, category labels, ordering, and supported image metadata can be saved in your browser's localStorage so the grid can be restored later. Uploaded files are not restored after a refresh. You can clear the draft with Reset grid or through your browser storage controls.

Pexels search queries pass through TrendDoodle's server-side API route. Selected Pexels images are loaded through a restricted same-origin proxy for use in the tool. Pexels remains a third-party service and its own terms and privacy practices apply to its service.

Generated PNG files are created in your browser. TrendDoodle does not currently upload completed grids to permanent storage. When you use native sharing, the file is sent only to the destination you choose. Copy actions use your browser's clipboard APIs where supported.

Like most web services, the hosting environment may create standard technical logs such as request details, IP addresses, error information, and timestamps. The exact logs and retention depend on the hosting configuration.

TrendDoodle does not intentionally write exchange links, access tokens, participant names, or assignments to application logs. IP-derived rate-limit identifiers are one-way hashed with a server secret before they are stored.

TrendDoodle uses Vercel Analytics and Speed Insights to collect anonymous usage and performance measurements without identifying individual visitors. These services do not create advertising profiles or track visitors across websites.

Private Secret Santa group and management routes are excluded from TrendDoodle's Vercel Analytics and Speed Insights events. The image tools rely on browser localStorage for drafts rather than a cookie-based account or tracking system.

The exchange tool uses secure HttpOnly cookies to remember participant and organiser access in a browser. Cookie names are scoped by exchange so the same browser can participate in multiple exchanges. These are access cookies, not advertising cookies.

Browser-memory uploads last only for the current browser session. Local draft information remains until you reset the grid or clear browser storage. Exchange access is denied immediately after expiry, 30 days after the exchange date. Expired database records are deleted by an authenticated cleanup mechanism when that mechanism is configured and run; this notice does not imply that a cleanup schedule is currently active. Organisers can delete an exchange earlier through their private management link. Any standard hosting logs may be retained according to the active hosting configuration.

Pexels is used to provide image search results. When you choose to use that search, your query is handled through TrendDoodle's server-side route and Pexels provides the results. Your use of Pexels content is also subject to Pexels' terms.

You can avoid uploading images, choose not to use Pexels search, clear local drafts, and control sharing and clipboard permissions in your browser. An exchange organiser can delete an exchange and all associated records using the private management link. A participant can ask the organiser to reset their browser access, although resetting cannot undo a recipient that was already viewed.

TrendDoodle is not designed to collect personal information from children. If you are responsible for a child using the tool, supervise any images or information they choose to use.

This notice may change as the tool changes. The Last updated date shows when this version was published.