Privacy and sensitive information

Content reviewed 2026-10-27. This page describes the current website and the limits we know. It does not publish an unverified retention period or an external service’s configuration.

The website and the Windows client handle different data

The GiftVeri website provides the account, software plan, orders and instructions. It has no gift card check form and no upload for client files. Gift card fields, client tasks, CSV results and work progress belong to the Windows client on your computer. The account page on this website does not read those local files.

The platform account is separate from an Apple account or any other brand account. Signing in to GiftVeri does not require a brand password, a gift card number or a PIN.

Website download statistics

The website counts requests through its download entrance by version, UTC date and page language for the administrator report. These aggregates do not store IP addresses, account identifiers, cookies or card data. They do not measure unique people, completed downloads or successful installations. Hosting services may still record technical requests under their own configuration.

Website account information

Registration and account features handle the sign-in email, display name and verification status. The account page also reads your own account status, software plan and order records. You can change the display name there. To run accounts and authorization, a platform administrator with the matching permission can view and manage user records, and those actions are written to an audit record.

Sign-in and registration passwords are received and checked by the Supabase Auth flow. The website profile table does not store a plaintext password. Website authentication uses a browser session cookie. Password-reset email is sent by the account authentication service. Whether it arrives depends on that service and the recipient.

The steps for sign-in, registration, email confirmation and password recovery are in the account and password recovery guide.

What the current website flow does not ask you to submit

The website has no card check, CSV upload or diagnostic-file upload. Do not paste the following into a name, a problem description or a public report:

• A full gift card number, PIN, security code or card expiry.
• A GiftVeri platform password, an Apple or other brand password, or an email password.
• An SMS or email verification code, a password-reset link, a cookie, a sign-in token, an access token or a refresh token.
• A proxy address that includes a username or password, proxy credentials, or any other connection secret.
• A full CSV, work-progress file, screenshot, diagnostic note or raw diagnostic package that may contain a card number, PIN, email, amount or account details.

How to describe a problem safely

These details are usually enough to start:

• The client name and the version you can see.
• When it happened, with the time zone.
• The brand, card type and region you selected, without the card number or PIN.
• Whether you were signing in, initializing, submitting, reading a result or exporting.
• The error text after you redact it, and whether the request may already have been sent.
• If a screenshot is actually needed, cover the email, card fields, order number, amount and account identifier first.

Network records, request headers and response bodies in browser developer tools can contain session tokens or full business data. Do not export or share them as they are. Start with the troubleshooting guide and the help center.

This website has no upload-style support ticket and no separate privacy mailbox. Ordinary questions can go to the GiftVeri contact address hello@giftveri.com. Send only a redacted description. Do not send sensitive information to some other unverified address, a public code repository, a forum or a chat group.

Cookies, providers and technical logs

Account pages use an authentication cookie to keep you signed in. The current website source does not configure advertising or product-analytics scripts. That does not mean the host, network protection, Supabase Auth or the mail service will not process request, security and delivery logs under their own configuration.

The repository does not define the production host or the exact log fields and retention of the external authentication and mail services, so this page does not promise one retention period. Before launch, add the provider notes that match the real host, CDN, security and Supabase configuration.

Account changes and the data boundary

The account page currently lets you change the display name and view your own account, plan and orders. The website has no self-serve way to change the sign-in email or delete the account. A platform administrator can change account status and plans with the existing admin tools.

Local CSV files, work progress and the client session are stored separately from the website sign-in session. File scope and how to back up before an update are in the sessions, CSV and work progress guide. Registration, sign-in and recovery can all return here for the sensitive-information notes.