How the links and the claims work

Two links

A list has two links. The owner link lets you change and delete the list. The share link lets your friends see the list and take gifts. Send only the share link to your friends. Keep the owner link for yourself.

The secret of each link is the part after the # sign. A browser never sends that part to a server. So the secret is not in the request, not in the server logs and not in the Referer header. The page reads the secret in your browser and sends it in the body of a request.

The server keeps only a hash (SHA-256) of the owner key and of the share key. It cannot read them back. The share key comes from the owner key, so the owner page can show you the share link again at any time.

How friends take gifts

A friend opens the share link and presses Take on a gift. The friend types a name. The server saves the claim. If two friends press Take on the same gift at the same time, the server accepts one. The other friend sees that the gift is taken.

The server gives the friend a secret claim token. The browser of the friend keeps it. With it, the same friend can give the gift back or mark it as bought. The server keeps only a hash of the token. Nobody else can change the claim.

The owner does not see the claims

The owner page never shows who took which gift. This is not only a choice of the page. The server does not read the claims for the owner page. The answers to the owner page have no claim in them, not even a count.

If you edit or delete a gift that a friend took, it works with no message. If you delete a gift, its claim is deleted too.

What the page cannot hide

The owner has the share link, as every friend does. If you open the share link in the browser where you made the list, the page hides the claims. It shows a notice, and you can choose to see them. But if you open the share link on another device, the page cannot know that you are the owner. You will see the claims. The page cannot stop that.

If you want to keep the surprise, do not open the share link on another device. Ask a friend for the list if you must check it.

Pairs with Secret Santa

Wish List pairs with Secret Santa. Draw names there. Then each person can share a wish list from here. The two tools are separate. They share no data and no account.

Links to shops

You can add a link to a gift. The page shows it as you wrote it. It does not change it and does not add affiliate codes. The link opens in a new tab and tells search engines not to follow it. The page does not sell anything and has no payments.

Read the privacy page for what the server stores and for how long.