Last updated: September 24, 2026 This Privacy Policy explains what Lightning Gifts collects, why it is held, and what you can do about it. Who runs this service Lightning Gifts is operated by a single person, on infrastructure they pay for themselves. The small fees we collect, alleviate some of the costs. It is a fork of the open-source Lightsats project. What we collect Sign-in data, and only what the method you choose requires: - Email address, if you sign in by email - Public key, if you sign in with LNURL-Auth or with a Nostr key (your Nostr private key never leaves your device) Gift data, because a custodial gift is a record of money being held for someone: - The amount, the fee and the expiry of each gift, and its status as it changes - The message written when the gift was created, and the recipient's name if the giver supplied one - The Bitcoin payment details needed to move the money: the funding invoice, and the invoice or Lightning address supplied for a withdrawal - A dedicated wallet per custodial gift, and the key to it, so the gift can be funded, claimed, refunded or reclaimed - On the receiving side, when a gift was first seen, whether it was claimed, and when it was withdrawn We do not use analytics, advertising or tracking tools, and there is no third-party script on this site. Our web server keeps ordinary request logs that include IP addresses, so that the service can be kept running and abuse stopped; those logs are not used to build profiles. Why we hold it Sign-in data exists to authenticate you. Gift data exists because we cannot pay a recipient, refund a giver, or show what was owed without it. Onboarding and withdrawal records exist to operate the service and to investigate failures. Where it is stored On servers we operate in the United States. Backups are encrypted before they leave those servers, and a second copy is held on separate hardware. Cloudflare provides our DNS and edge, so requests pass through their network. Who else sees it - Transactional email is sent through Resend, which receives the email address and the contents of the message it is sending. No other email provider is used. - No other third party receives your personal data. Payments run on our own Lightning node; the provider that helps open a payment channel receives no personal data. - We disclose data to law enforcement only where we are legally required to, and we will tell you when that happens unless the law forbids us to. Retention and deletion Account and gift records are kept for as long as the service operates and they are needed: a gift that is still claimable, refundable or withdrawable has to stay resolvable. You can ask for your account and its personal data to be deleted at any time by writing to [email protected]. We will delete what we can straight away and tell you what a live gift prevents us from deleting yet; records tied to money in flight are removed once the money has moved. Your rights Write to [email protected] to ask for a copy of your data, a correction, or its deletion. Every such request gets an answer. Cookies Cookies are set only for signing in, all of them by the authentication library: one that protects sign-in forms, one that remembers where to return you, and one that keeps you signed in. Signing out, or clearing cookies in your browser, removes them. They are not used for advertising, analytics or tracking, which is why there is no cookie banner. Changes to this policy If this policy changes materially we will update the date above, and where the change affects you we will say so by email or on this page. Continued use after a change means you accept the updated policy. For any privacy question, write to [email protected].