Privacy

Your email address, because it is how you sign in — there are no passwords here at all.

A name you choose, shown to everyone you share a list with ("Anna's list"). A first name is enough, and you can change it whenever you like.

The lists themselves: titles, occasions, gifts, notes, prices and links you paste.

If you sign in with Google, Google tells us your email address, your name and a link to your profile picture. Nothing else, and Miria never gets access to anything in your Google account.

The first name you type, so the other people with that link know the gift is spoken for. It is shown only to people in the same group, and never to the owner of the list.

A random secret kept on your device, which is how Miria recognises you again without an account. Your device sends the secret to Miria when it asks to manage a reservation; only its sha-256 hash is stored in the database. You may copy a recovery code to use the same membership in another browser. Treat it like a password: anyone with that code can act as you.

If your group chips in together, Miria also stores the target and each person's pledged amount. People in that group see the organiser, names and pledges; other groups only see that the gift is taken. The list owner sees only the same total count as for reservations. A pledge is a promise — Miria does not receive money or learn whether it was paid.

A session while you are signed in, with the time, your IP address and your browser's user agent. It keeps you signed in and is the only way to notice somebody attacking the service.

Counters that stop floods — of sign-in emails, of reservations. They are keyed by a sha-256 of an email address or an IP address, never by the address itself, and they expire within minutes.

Pictures of gifts, fetched once from the shop when the gift is added and stored here. That is deliberate: it means the page you open never talks to the shop, so the shop learns nothing about you.

All set by Miria itself, none for advertising or measurement: one that keeps you signed in, one per list you joined as a guest (the secret above), one that remembers whether you chose light or dark, one that remembers the language you picked, one that holds a new list's name for an hour while you sign in to keep it, and one that remembers you said “Not now” to the donation card, for a year.

The database is in Frankfurt (Neon), and the site runs in Frankfurt (Vercel). Sign-in emails are sent through a mail provider. Those three, and Google if you choose to sign in with Google, are the only companies that touch any of this — each as a supplier, none for their own purposes.

Lists and gifts stay until you delete them. Archiving hides a list without deleting anything; deleting an archived list removes it for good, with its gifts, groups, reservations and the names of everyone who joined. A sign-in link lasts fifteen minutes and works once. A session lasts thirty days. The token that hands a phone its session lasts three minutes.

Use the account deletion page to permanently remove your account and its data immediately. For a copy or correction, or if you cannot sign in, write to ialacritydev@gmail.com.

Miria is not meant for children under 13, and nothing here is built to collect anything from them.