The short version
We ask for the minimum needed to send invitations, reminders and draw notices, and for organizers to sign back in. We use Google AdSense to help fund the free service; Google may use cookies, similar identifiers and ad-related signals to serve, measure and protect ads, including personalized ads where your consent or settings allow. We do not sell Cuchumbo exchange data, and we do not send names, emails, hints, assignments, budgets or reveal dates to Google for ads. Assignments are encrypted at rest; the service decrypts one assignment only to show an authenticated participant their own result. Every Cuchumbo is automatically deleted about six months after its reveal date.
What we collect
Organizers give a verified email address; that email lets them sign in with one-use links and receive organizer notices. Participants give one contact email so the service can send invitations, reminders when enabled, draw-ready notices and personal-page links. They also provide the display name and any gift hints they choose to share. Reveal date, budget and Cuchumbo name are the other fields entered by the organizer. We do not collect postal addresses. For ads, Google AdSense may process technical or ad data such as IP address, browser or device information, page URL, ad interactions, cookies or similar identifiers. Cuchumbo does not add names, emails, hints, assignments, budget, reveal date or Cuchumbo contents to ad requests.
How contact data is protected
Contact values (organizer email, participant email) are stored in two forms: a one-way hash to recognize returning invitations, and an encrypted copy so the service can send messages. Neither form is readable by looking at the database alone. Assignment records are encrypted at rest with a per-Cuchumbo key wrapped by the site key; they are not exposed to organizers or listed in dashboards.
How long we keep it
Each Cuchumbo — players, hints, assignments, every trace of it — is automatically deleted about six months after its reveal date. Organizer sign-in sessions last thirty days and then expire on their own. If you ask us to delete an account or a Cuchumbo sooner, we will; see your rights below.
Who sees it
We do not sell exchange data. Infrastructure providers such as hosting and email delivery process only the data needed to operate the service, under data-processing agreements. Google AdSense is our advertising provider and may process ad-related data under Google’s advertising terms and your consent or settings. Assignment records, names, emails, hints and Cuchumbo contents are not shared with Google for ad targeting.
Your rights
If you are in the EU or a comparable jurisdiction, you have the right to access the data we hold about you, to correct it, to export it, to have it erased, and to object to processing. Write to the contact below and we will respond within thirty days. You can also file a complaint with your national data protection authority.
Cookies
We use strictly necessary cookies for organizer sessions, CSRF protection, language preference and the consent choice itself. We also use Google AdSense, which may set or read advertising cookies, local storage or similar identifiers to serve ads, prevent fraud and abuse, measure ad performance and, when allowed, personalize ads. On your first visit we show a consent choice; where consent is required, advertising storage and personalized ads are used only according to that choice. You can change browser settings or Google ad settings, or leave before using the service.
Learn more: How Google uses data · Google Ad Settings
Contact
Write to privacy@cuchumbo.com for any privacy question, access request, or erasure request.