THE FINE PRINT, PLAINLY

Privacy Policy

Last updated: 3 September 2026

Bags That ("Bags That", "we", "us" or "our") is an independent project operated by Lindsay Evans in New South Wales, Australia.

We respect your privacy and aim to be clear about the information we collect and how we use it.

This Privacy Policy applies when you use the Bags That website, application and related services (the "Service").

1. What Bags That does

Bags That helps groups of family members, friends and others share gift ideas and coordinate gift purchases without spoiling the surprise.

Users can create groups, invite other people, create recipient profiles and occasions, add gift ideas, reserve gifts, leave private coordination notes and ask recipients questions.

Some information within a group is intentionally hidden from a recipient, such as reservations and buyer discussions.

2. Personal information we collect

Depending on how you use Bags That, we may collect:

Account information

This may include:

• your name;
• email address;
• profile name or display name;
• profile image, if supported;
• authentication and account information; and
• account preferences.

Group and recipient information

This may include:

• groups you create or join;
• group membership and invitations;
• invitation email preferences, stored using a keyed hash rather than as a plaintext suppression list;
• recipient names and profile information;
• your relationship with recipients or other group members;
• occasions such as birthdays, Christmas or baby showers; and
• information you enter about a recipient.

A recipient does not necessarily have their own Bags That account. For example, an adult may create and manage a wishlist for their child.

Wishlist and gift information

This may include:

• gift names and descriptions;
• product links;
• images;
• approximate prices;
• sizes, colours and other preferences;
• gift priorities;
• quantities;
• comments or notes; and
• other information provided with a gift idea.

Gift coordination information

This may include:

• gifts you have reserved or released;
• whether a gift is being considered, reserved or purchased;
• private notes between potential gift buyers;
• questions asked of recipients;
• answers provided by recipients; and
• activity associated with an occasion or wishlist.

Technical and usage information

When you use Bags That, we may automatically receive limited technical information such as:

• IP address;
• browser and device type;
• operating system;
• dates and times of access;
• pages or features used;
• referring pages;
• application errors; and
• security and diagnostic information.

We use Plausible Analytics to understand aggregate website usage. Plausible does not use cookies or store raw IP addresses, and Bags That removes group, occasion, recipient and gift identifiers from the page locations sent to Plausible.

Retailer and outbound links

Gift ideas may include links to retailers or other websites. Bags That does not currently track outbound retailer clicks or use affiliate or referral tracking.

We generally do not receive your payment card details or complete purchase details when you buy something directly from a third-party retailer.

3. Information about children

Bags That accounts are intended for people aged 18 years or older.

An adult may create a recipient profile or wishlist for a child.

If you provide information about a child or another person, you should only provide information that is reasonably necessary for organising their wishlist and gifts, and you should have appropriate authority to provide that information.

Please avoid adding sensitive or unnecessary personal information about children, such as home addresses, school details, medical information or other information that is not needed to organise gifts.

If you believe information about a child has been added to Bags That inappropriately, contact privacy@bagsthat.gift.

4. How we collect information

We may collect information:

• directly from you when you create or use an account;
• when you create or interact with groups, wishlists, recipients and occasions;
• from another Bags That user who invites you to a group or creates a recipient profile;
• automatically when you use the Service;
• from authentication, hosting, analytics, email and other service providers; and
• when you contact us for support.

5. Why we use personal information

We use personal information where reasonably necessary to operate and improve Bags That, including to:

• create and manage accounts;
• authenticate users;
• create and manage groups;
• deliver invitations;
• display recipient profiles and wishlists;
• coordinate reservations and gift purchases;
• maintain information that should be hidden from recipients;
• allow users to ask and answer questions;
• send service notifications and reminders;
• honour requests to block future group invitation emails;
• prevent abuse, repeated invitations, fraud and unauthorised access;
• investigate technical problems;
• provide support;
• understand and improve how the Service is used;
• maintain and secure the Service;
• comply with legal obligations; and
• enforce our Terms & Conditions.

Bags That does not currently send marketing communications. If this changes, we will only send them where permitted and with appropriate consent, and will provide a way to unsubscribe. Transactional or service messages needed to operate Bags That may continue while you maintain an account.

6. Who can see information within Bags That

Bags That is designed around group sharing. Information you add to a group may therefore be visible to other members of that group.

For example, group members may see:

• your name;
• your group membership;
• gift ideas;
• recipient preferences;
• questions and answers; and
• relevant group activity.

Information hidden from recipients

Where Bags That indicates that information is private from a recipient, the recipient will not ordinarily be shown information such as:

• whether one of their gift ideas has been reserved;
• who reserved it;
• purchase status; or
• private buyer comments.

Other eligible members of the group may be able to see this information.

You should still exercise care when using shared groups. Bags That cannot control information that another group member independently copies, screenshots, repeats or discloses outside the Service.

7. Service providers

We use the following third-party providers to operate Bags That. They may process information on our behalf in order to provide their services.

We do not currently use a separate error-monitoring provider, file-storage provider, advertising network or affiliate-tracking provider.

8. Third-party retailers and websites

Gift ideas may contain links to third-party retailers and websites. Those sites are operated independently from Bags That and have their own privacy practices.

When you leave Bags That and visit another website, information collected by that website is governed by its own privacy policy.

9. Affiliate links

Bags That does not currently use affiliate or referral links. If affiliate links are introduced, we will identify them where appropriate and update this Privacy Policy before using related tracking technologies.

10. Cookies and similar technologies

Bags That and Kinde use cookies or similar technologies that are necessary to keep you signed in, maintain application state, protect accounts and prevent abuse.

Plausible Analytics measures aggregate website use without cookies or persistent identifiers. Bags That does not currently use advertising cookies or affiliate tracking.

If non-essential analytics, advertising or other tracking technologies are introduced, additional controls or notices may be provided where appropriate.

11. Communications

We may send service-related communications such as:

• account verification messages;
• sign-in links;
• group invitations;
• notifications about wishlists or occasions;
• security notices; and
• important changes to the Service.

Every group invitation email includes a link to block future Bags That invitation emails. You can later request a verification link from the Invitation emails page to allow them again. This preference does not prevent account sign-in, security or other essential service messages.

We do not currently send promotional or marketing communications.

12. Storage and security

We take reasonable technical and organisational steps to protect personal information from misuse, loss and unauthorised access, modification or disclosure.

These measures may include access controls, encryption, secure authentication and limiting access to personal information. No online service can guarantee absolute security.

If you become aware of unauthorised access to your Bags That account, please contact us promptly.

13. Overseas processing

Some service providers used by Bags That store or process information outside Australia. Based on our current providers, information may be processed in Australia, the United States, Germany and other parts of the European Union, the United Kingdom, and other regions used by those providers.

Provider infrastructure and subprocessors may change over time. Where reasonably practicable, we take steps to use reputable providers and protect information handled overseas.

14. How long we keep information

We retain personal information only for as long as reasonably necessary to operate the Service, maintain security, resolve disputes or meet legal obligations.

Users may be able to archive or delete individual wishlists, occasions, gifts and recipient profiles. Some information may remain temporarily in backups or technical logs after deletion.

Where you block group invitation emails, we retain a keyed hash of your normalised email address for as long as needed to honour that preference. We remove it when you confirm that invitations should be allowed again.

We may retain de-identified or aggregated information that can no longer reasonably identify an individual.

15. Account deletion

You may request deletion of your Bags That account by contacting us.

When an account is deleted, we will delete or de-identify personal information associated with the account where reasonably practicable and where we are not required to retain it.

Some content may need to remain so that shared groups continue to make sense. For example, historical group activity or comments may remain but be attributed to a deleted user.

If you manage recipient profiles, those profiles may need to be transferred to another eligible group member or deleted.

16. Access and correction

You may ask us for access to personal information we hold about you or ask us to correct information that is inaccurate or out of date.

Some information can be reviewed or changed directly through your account. For other requests, contact privacy@bagsthat.gift. We may need to verify your identity before fulfilling a request.

17. Privacy concerns and complaints

If you have a privacy concern or believe your personal information has been handled incorrectly, please contact us and provide enough information for us to understand and investigate your concern. We will aim to respond within a reasonable period.

Depending on the circumstances and the laws applicable to Bags That, you may also have rights to raise a privacy complaint with an appropriate regulator.

18. Australian privacy law

Depending on the nature and scale of Bags That's activities, some Australian privacy legislation may or may not apply to the Service.

Regardless of whether a particular privacy law requires us to do so, Bags That aims to handle personal information responsibly, transparently and consistently with good Australian privacy practices.

Nothing in this Privacy Policy is intended to limit any privacy rights you have under applicable law.

19. Changes to this Privacy Policy

We may update this Privacy Policy as Bags That develops, our service providers change or legal requirements change.

The latest version will be published on the Bags That website and will show the date it was last updated.

If a change materially affects how we handle personal information, we will take reasonable steps to notify affected users where appropriate.

20. Contact

Questions about this Privacy Policy can be sent to: