Privacy Notice
Who we are
SIT (Stuff I Like.) at sit.onl is run by Doomed Productions Ltd, registered in England and Wales, company number 16983542, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. We are the controller of the personal data described here. Privacy questions: privacy@sit.onl. Everything else: support@sit.onl.
What we collect
- Your account: your name, a username, your email address, your password (stored only as a secure hash), and two-factor or passkey details if you turn them on.
- Things you SIT: links, titles, pictures, shop names, prices, stock, sizes, colours, variants, notes, the lists you put things on, your alert choices, and when you saved or changed them.
- Sharing and gifting: each list's privacy setting, your groups (for example Family and Friends) and who is in them, invitations, and gift reservations.
- Price checks: the latest price and stock we found for things you saved, whether we checked from our server or the SIT button checked from your browser.
- Security and running the service: IP addresses, browser details, sign-in events and error logs, needed to operate SIT and protect it from abuse.
- Messages you send us, if you email support or privacy.
We don't ask for your address book, we don't use analytics or advertising trackers, and we don't sell personal data.
Where it comes from
From you; from your browser when you use SIT; from the public shop pages you ask SIT to read; from the SIT button, if you install it; and from someone who invites you to see their lists.
The SIT button (browser extension)
When you click the SIT button, it reads that page's product details (structured product data, product and sharing tags, the page's main link and title) and sends only those to SIT. It does not read anything else on the page, your cookies or anything you have typed into forms. If you allow price checks for a shop, your browser opens only the pages you saved at that shop, reads them inside the extension, and sends us only the price, currency and stock. Those readings are used only for your own items. You can remove the permission or the extension at any time.
Why we use it, and our lawful basis
| What for | Lawful basis |
|---|---|
| Your account, saving, lists, sharing, groups, gift reservations, price and stock alerts | Contract: it's the service you signed up for |
| Security, preventing abuse, fixing faults, support, improving how product details are read | Legitimate interests in running a safe, working service |
| Occasional SIT news and offers, only if you tick the box | Consent, which you can withdraw at any time |
| Meeting legal obligations, and dealing with legal claims | Legal obligation and legitimate interests |
Who can see your things
Everything you save is private unless you put it on a list and share that list. Lists start Private. Friends & Family lists are visible only to the groups and people you choose: a list shared with Friends is not visible to Family. Public lists are visible to anyone with the link, and show your name only if your profile is public. Pressing Share never changes who can see a list by itself. People in your groups are not told which group you put them in.
Gift surprises
When gift reservations are on, the list owner is never shown what has been reserved, who reserved it, or whether it was bought. This is enforced by our servers, not just hidden on screen.
Who we share it with
We use these providers to run SIT. They process data on our behalf and under our instructions:
| Provider | What for | Where |
|---|---|---|
| netcup GmbH | The server SIT runs on, including its database and backups | Austria (EU) |
| BunnyWay d.o.o. (bunny.net) | Content delivery, DNS and the firewall in front of SIT. It sees IP addresses and requests. | Slovenia (EU), with a global delivery network |
| Postmark (ActiveCampaign, LLC) | Sending email: sign-up confirmation, password resets, price and stock alerts | USA |
| Migadu | Our support@ and privacy@ mailboxes | Switzerland |
| Google (Google Workspace) | Storing our offsite backup copy. It is encrypted before it leaves our server, so Google can't read it. | EU and USA |
Transfers to the EU and Switzerland rely on the UK's adequacy decisions for them. Transfers to the USA rely on safeguards recognised under UK law for those transfers. We may also share data with professional advisers, or where the law requires it. Shops only receive what you send them yourself when you visit their site.
How long we keep it
- Your account and everything in it: while your account is open. When you delete your account, we delete it from the live service straight away. Gifts you marked as bought on someone else's list stay marked as covered, without your name.
- Backups: kept for 90 days (copies stored away from the server are encrypted), after which deleted data is gone from them too.
- Security and error logs: normally 14 days, longer only if we need them to deal with an incident or a claim.
- Invitations: an invite link works until it's used or you withdraw it. The record of it stays with the list or group until that's deleted.
- Marketing opt-outs: only what we need to respect your choice.
Cookies and storage
SIT uses only what it needs to work:
| Name | What it does |
|---|---|
| sit-session | Keeps you signed in for your visit |
| XSRF-TOKEN | Protects your account from forged requests |
| remember_web_… | Only if you tick "Remember me", to keep you signed in |
| appearance, sidebar_state | Only if you change them: remember your light/dark choice and whether the side menu is open |
The SIT button keeps its sign-in token and settings in your browser's extension storage. We use no analytics, advertising or tracking cookies, so there's nothing to consent to. If that ever changes, we'll ask first.
Emails
Emails you ask for (account emails, invitations you accept, price and stock alerts you turn on) are part of the service. Every alert has a link to stop it, and you can switch each kind off in Settings. Marketing emails are separate and only sent if you tick the box. Turning marketing off never turns off the alerts you asked for.
Your rights
You can ask to access, correct, delete, restrict or move your data, object to our use of it, or withdraw consent. You can delete your account yourself in Settings. For anything else, including a copy of your data, email privacy@sit.onl. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, but please talk to us first.
Automated decisions
SIT doesn't make automated decisions about you that have legal or similarly significant effects.
Children
SIT is for adults aged 18 and over, and everyone confirms their age when signing up. Adults can save gifts for children in their own account.
Security
Connections are encrypted, passwords are hashed, two-factor sign-in and passkeys are available, access is checked on our servers for every request, backups stored away from the server are encrypted, and access to our systems is restricted.
Changes
We'll update this notice when how we use data changes, and tell you before any important new use begins.