Privacy

Hanker is a small wishlist site run by Ted Armstrong in Portland, Maine, USA. This page says what Hanker keeps about you, who else handles it, and for how long. Questions go to hello@hanker.dev.

If you make a list

Hanker keeps your email address, your display name, your password as a one-way hash (never the password itself), and your list: its title, items, links, prices, photo addresses, notes and tags. When you paste a shop link, Hanker’s server visits that page to fill in the title, price and photo, so the shop sees a visit from Hanker, not from you. For Amazon, Etsy and eBay product links, Hanker asks Bright Data (Amazon), Etsy or eBay for the details instead, and sends only the product’s ID (and, for eBay, the option’s ID when the link names one). Unless you turn it off in Settings, Hanker sends an item’s title, note, the shop’s web address (not the full link) and the shop’s product description, with your list’s tag names, to Cloudflare’s AI to suggest tags for it.

When you share your list’s link, Hanker’s server fetches photos of up to eight of your items from the shops to draw up to four in the link’s preview picture, and keeps none of them. Apps that show the preview, like Messages, Slack or Discord, keep their own copy.

If you claim a gift

Hanker keeps the name you type and how many you’re getting. Anyone with the list’s link sees your name next to the item, so nobody doubles up. Hanker never shows it to the list’s owner while they’re signed in. If they’ve turned it on, they see only how many have been claimed. Your browser keeps your claim link so you can change or cancel your claim later; Hanker keeps only a scrambled copy of it.

If you’re signed in when you claim

If your email is confirmed, Hanker can keep your claims on Your gifts, a page that follows you to any device you sign in on. Hanker never shows anyone else whose gifts a claim is on, whether they own the list or are another gifter.

• When you claim while signed in, or open a claim’s link while signed in and the page has loaded, Hanker links that claim to your account so it appears on Your gifts. Not mine takes it off again and leaves the claim alone.
• Bought ticks are stored and seen only by you.
• When a claim disappears (the list’s owner removes the item, the list or their account, or someone cancels it through its link), Hanker keeps the item’s title and its owner’s name on Your gifts for about 30 days, or until you clear it.
• Deleting your account deletes these links, ticks and notes. Your claims stay, so the people you’re buying for aren’t affected.

What Hanker doesn’t do

No ads, no analytics, no tracking. Your information is never sold or shared for marketing.

Your list and settings pages link to Buy Me a Coffee. Hanker sends it nothing and doesn’t learn who follows the link. If you follow it, its own privacy policy applies.

Cookies and storage

One cookie, which keeps you signed in. Claim links, and the name you last claimed with, stay in your browser’s own storage. Cloudflare’s security check on sign-ups and email-link requests keeps a small value in its own part of your browser’s storage. Nothing else, which is why there’s no cookie banner.

Who else handles your information

Hanker runs on a few services, and each sees only what it needs:

• Vercel hosts the site. Its logs record requests, including IP addresses, and keep them for a day or less.
• Neon stores the database.
• Resend sends Hanker’s emails, so it sees your email address and the message, and keeps a record for 30 days.
• Cloudflare checks that sign-ups and email-link requests (password resets and new confirmation links) come from a person, which means it sees your IP address and browser details. It also stores Hanker’s encrypted backups. Cloudflare’s AI reads the title and note of items you add or edit, the shop’s web address and product description, and your list’s tag names, to suggest tags. It isn’t told who you are, doesn’t keep what it reads, and doesn’t train on it. You can turn this off in Settings.
• Bright Data looks up Amazon product links. It sees the product’s ID, and nothing about who pasted it.
• Etsy looks up Etsy listing links. It sees the listing’s ID, and nothing about who pasted it.
• eBay looks up eBay item links. It sees the item’s ID, and the option’s when the link names one, and nothing about who pasted it.
• GitHub runs the nightly backup, which is encrypted before it leaves GitHub’s machine.
• Sentry receives error reports, with the secret parts of links, email addresses and IP addresses removed.
• Have I Been Pwned checks new passwords against known leaks. It receives the first five characters of a scrambled copy of your password, never the password.

Photos on lists

Item photos load straight from the shop’s website, so that shop can see the IP address of whoever views the list.

How long it’s kept

• Delete your account in Settings, and your account, your list and every claim on it are removed straight away. A gifter who had one of your items on Your gifts keeps a note with its title and your display name for about 30 days, or until they clear it.
• Cancel a claim from your claim link, and it’s removed straight away.
• Encrypted backups keep a copy for up to 30 days, and then it’s gone.
• Accounts whose email is never confirmed are deleted after 7 days.
• To slow down abuse, Hanker counts requests using a scrambled copy of your IP address or email, and deletes those counts within two days.

Children

Hanker is for people 13 and older, whether you make a list or claim a gift. If you think a child under 13 has given Hanker information, email hello@hanker.dev and it will be deleted.

Changes

If this page changes, the date at the top changes too. The terms cover the rest.