How Quokit collects, uses and protects your personal information
Last updated: September 2026
1. Introduction
Quokit is committed to protecting your privacy and handling personal information responsibly. This Privacy Policy explains how Quokit collects, uses, stores, discloses and protects personal information in connection with the Quokit wishlist and gift-coordination service.
This policy applies to Quokit at https://www.quokit.com.au and related web app, admin and account features.
2. What information we collect
We collect the information needed to provide wishlist saving, list sharing, gift coordination, AI-assisted product features, subscription management and support.
Account information, including your email address and display name.
Wishlist information, including lists, saved item URLs, product names, images, retailer metadata, notes and other saved product metadata.
Gift coordination information, including shared list access, claim status, claim information and reveal choices.
Subscription information, including plan, subscription status, trial status and billing identifiers needed to reconcile Stripe subscription records.
Usage analytics, including product events, device and browser information, app interactions, feature usage and diagnostic events.
Instagram integration information when you connect that feature, including your Instagram-scoped sender ID, Instagram username, link status, and the messages or post attachments you deliberately send to the @quokit Instagram account.
Support and communication information you send to hello@quokit.com.au or through account support flows.
Payment card details are processed by Stripe. Quokit does not store your full card number, CVC or other sensitive payment credentials on its own systems.
3. How we collect information
We collect personal information when you sign up, sign in, create or edit a wishlist, save an item URL, use AI-assisted features, share a list, make or manage a gift claim, start a free trial, subscribe to Premium, cancel a subscription, request support, export data or delete your account.
We also collect technical and usage information automatically when you use the service, including authentication session events, application logs, analytics events and error reports. We may receive product metadata from retailer APIs and safe webpage extraction services when you ask Quokit to save a product URL.
If you choose to connect Instagram, Quokit receives messaging webhook data from Meta only when you message or share content to the @quokit Instagram account. Quokit does not scrape your Instagram profile, feed, followers, private messages with other accounts or content you have not sent to @quokit.
4. How we use your information
We use your information to provide, secure and improve Quokit.
To create and manage your account.
To save product URLs, enrich saved item metadata and display wishlist content.
To share lists and coordinate anonymous or revealed gift claims.
To send transactional emails, such as sign-in links, account notices, claim notifications, subscription notices and support replies.
To process Premium subscriptions, free trials, cancellations and refunds through Stripe.
To operate AI-assisted product features and improve item search, tagging and enrichment.
To link your Instagram sender identity to the Quokit account you explicitly choose, save posts you send to @quokit, and reply with the result of that save.
To detect abuse, troubleshoot errors, maintain security and protect user accounts.
To understand product usage and improve reliability, onboarding, search, list management and sharing workflows.
To comply with legal obligations and enforce our Terms of Service and Fair Use Policy.
We do not sell personal information.
We do use advertising and measurement cookies. Quokit runs paid advertising, and the advertising platforms listed in section 5 receive information about visits to our site and about two events: creating an account and starting a paid subscription. This lets us measure which advertising works and show ads to people who have visited Quokit. It never includes the contents of your lists, the items you save, who you share with, or what anyone has claimed.
5. Third-party services
Quokit uses trusted third-party processors to operate the service. These providers process information only as needed for their role in delivering Quokit.
Supabase provides database and authentication services in the Sydney region.
Vercel provides hosting and deployment services in the Sydney region.
Resend provides transactional email delivery.
Sentry provides error tracking and reliability monitoring in the EU region.
OpenAI provides AI features and product enrichment support in the US.
Firecrawl provides webpage extraction and scraping support for user-supplied product URLs.
Stripe provides payment processing, subscriptions, invoices and customer billing tools in Australia.
eBay API provides product data used to enrich saved wishlist items.
PostHog provides product analytics in the US region.
Meta provides the Instagram messaging, webhook and public oEmbed services used by the optional Instagram integration.
Meta also provides advertising measurement through the Meta Pixel, which records page views and the two conversion events described in section 4.
Google provides analytics and, where we run paid search advertising, advertising measurement.
Some processors are located outside Australia. When information is processed overseas, we take reasonable steps to use reputable providers and limit the information shared to what is necessary for the service.
6. Anonymous gift coordination
Quokit includes anonymous gift coordination features for Premium users. Claimer identities are protected at the database layer so list owners on Premium cannot see who claimed gifts until they choose to reveal the relevant claim information. This helps preserve surprise while still reducing duplicate purchases.
Anonymous coordination depends on users following the intended sharing and claim flows. If users disclose information outside Quokit, share screenshots, use another account or otherwise circumvent the system, Quokit cannot guarantee that a surprise will be preserved.
### Shared Secret Santa draws
When you share a link from the free Secret Santa generator, we store the first names that you and the people joining enter, who each person is buying for, and any guesses people make. Everyone in a shared draw, including the person who starts it, signs in with Google or by confirming their email address with a one-time code. That creates a free Quokit account if they do not have one. We link each name to that account so that one person holds one name and only they can see who they drew, and we link the draw to the account that started it so only that person can control it. The person who made the draw sees the names, never the email addresses. To limit abuse we store a one-way hash of the network address that created a draw, and for one day a one-way hash of each email address a sign-in code was requested for. The draw and everything in it is deleted automatically 90 days after it is made, and the person who made it can delete it sooner. Your account stays until you delete it. Drawing on the screen instead of sharing a link needs no sign in and sends us nothing.
7. Instagram integration and deletion
The Instagram integration is optional. Linking uses a short-lived, single-use code created while you are signed in to Quokit. Quokit uses the Instagram-scoped sender ID supplied by Meta to route a message to the linked Quokit account. Your Instagram username is display information only and is not used to decide account ownership.
Processed Instagram webhook payloads are deleted after 30 days. Your Instagram account link is retained until you unlink it or delete your Quokit account. Saved wishlist items remain in your Quokit account until you remove them or delete the account.
You can stop the integration and delete the stored Instagram link at any time from Quokit Settings or by replying UNLINK in the @quokit Instagram conversation. You can delete all Quokit account data from account settings. Meta may also send a signed data-deletion request to https://www.quokit.com.au/api/webhooks/instagram-data-deletion, which removes the matching Instagram link and stored webhook events. For help, contact hello@quokit.com.au.
8. AI assistants
You can connect an AI assistant, such as ChatGPT, Claude, Muse or Gemini, to your Quokit account. Nothing is shared with an assistant until you connect it yourself on the Quokit consent screen.
Once connected, the assistant can read your lists, saved items and the occasions you track, read lists other people shared with you, and save, share, claim or release items when you ask it to. It never receives who claimed gifts on your own lists, and it cannot change your plan, payment details, email or password, or delete your account. What the assistant receives from Quokit is then handled by the assistant's provider under its own privacy policy.
For security and to limit misuse, Quokit records the name of each assistant action, the time and which assistant made it. We do not record what you asked or what Quokit returned. These records are deleted after 90 days.
You can disconnect an assistant at any time from Settings in Quokit. It loses access straight away.
9. Data retention
Active account data is kept while your account exists so Quokit can provide your lists, saved items, claims, subscription state, account settings and support history. You can delete your account from account settings or contact hello@quokit.com.au for assistance.
Account deletion starts with an immediate soft delete that disables normal account access and removes the account from active use. Quokit then hard deletes personal account data after 30 days, unless retention is required for legal, security, fraud-prevention, billing or dispute-resolution reasons.
Anonymised and aggregated analytics may be retained indefinitely because it no longer identifies a specific individual and helps us understand product reliability and usage trends.
10. Your rights
You may request access to personal information we hold about you, ask us to correct inaccurate information, request deletion of your account, or ask questions about how your information is handled. Data export is available as JSON from account settings so you can download your account, list and saved item information.
We will respond to privacy requests within a reasonable time. We may need to verify your identity before fulfilling access, correction, deletion or export requests.
11. Cookies
Quokit uses cookies and similar technologies for three purposes.
**Necessary.** Authentication, session management, account security and basic service operation. These cannot be switched off without breaking sign-in.
**Analytics.** Understanding reliability and product usage, so we can fix what is slow or confusing.
**Advertising.** Measuring which advertising brings people to Quokit, and showing ads to people who have visited. These are set by the advertising platforms named in section 5.
Advertising and analytics cookies never carry the contents of your lists, the items you save, or anything about who you share with. You can block them in your browser, or use its Do Not Track or Global Privacy Control setting, and Quokit will keep working.
12. Children
Users under 16 cannot create paid accounts. Quokit does not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to Quokit, contact hello@quokit.com.au and we will take reasonable steps to delete it.
13. Changes to this policy
We may update this Privacy Policy as Quokit changes, including when we add features, processors, regions, payment options or legal requirements. If we make material changes, we will notify users by email and update the lastUpdated date on this page.
14. Contact
For privacy questions, access requests, correction requests, deletion requests, complaints or data export help, contact Quokit at hello@quokit.com.au.
Microsoft Clarity provides anonymised session and interaction diagnostics.
