Our Privacy Promise
Last updated: 12 November 2026
The List is made for children, so we keep as little information as we possibly can. This page has two parts: the short version for kids and the full privacy notice for grown-ups.
🎄 The short version (for kids)
- We only keep your first name, the first letter of your last name, your list code, your wishes, and a scrambled password that nobody can read. Not even us!
- We never ask for your email, address, phone number, school, birthday or photos.
- Anyone you give your list link to can see your first name, last initial and wishes. Only share it with family.
- No ads. No tracking. We never sell or share your information.
- Want to share your list on Instagram, TikTok or WhatsApp? Ask a grown-up! They answer a grown-up question to unlock sharing.
- You can download everything we keep, or delete your list forever, from the bottom of your list page.
- If nobody uses your list for 12 months, the elves tidy it away (we delete it).
- If something worries you, talk to a grown-up you trust.
👨👩👧 Full privacy notice (for parents & carers)
Who we are
The List (thelist.christmas) is run by 45press (“we”, “us”). We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We follow the ICO's Age Appropriate Design Code (the Children's Code).
Contact for anything about privacy: joel@45press.com
What we collect and why
| Information | Why we need it |
|---|---|
| First name and first letter of last name | To label the list so family know whose it is. |
List code (e.g. maddiek123) | It's the list's web address and the username for opening it. |
| Password | To stop anyone else changing the list. Stored only as a salted, one-way hash (PBKDF2). We cannot see the password. |
| Wishes, any links added, and short notes (e.g. "I'm a size small") | This is the wish list itself. |
| Dates: created, last changed, last used, sent to Santa | To show the list's status and to delete inactive lists on time. |
| Count of wrong password attempts | To pause sign-in after 5 wrong tries and keep the list safe. |
We do not collect email addresses, phone numbers, home addresses, dates of birth, schools, photos, location or any special category data. We do not store IP addresses. There are no analytics, advertising, tracking pixels, social media plug-ins or third-party fonts or scripts. We do no profiling and make no automated decisions about anyone.
Please help children avoid typing personal details (such as an address, phone number or full surname) into their wishes or list code.
Our lawful basis
We rely on legitimate interests (Article 6(1)(f) UK GDPR): providing the wish-list service the child has chosen to use and keeping it secure. We have weighed this against children's interests and rights in a Data Protection Impact Assessment, keeping the data to the minimum the service needs, with high-privacy defaults. We never use children's data for marketing, and we never sell it.
Who can see the information
- Anyone with the list link can see the first name, last initial and wishes. Sharing with family is the purpose of the service. Lists are hidden from search engines and we do not publish a directory of lists.
- Cloudflare, Inc. hosts the website and database as our processor, under its Data Processing Addendum. Our database is stored in the European Union. To deliver and protect the website, Cloudflare's network may briefly process connection data (such as IP addresses) in other countries; such transfers are protected by the international transfer safeguards in Cloudflare's Data Processing Addendum.
- Nobody else, unless the law requires it.
Sharing to social media
The share button can make a picture or short video of a list for Instagram, TikTok, WhatsApp and similar apps. Social apps are for ages 13 and over, so these options are behind a grown-up check. The picture or video is made on your own device: we don't upload it, we don't send anything to Instagram, TikTok or any other service, and we don't use their tracking tools or "share" plug-ins. Your device's share menu hands it to the app you choose. Once something is posted, that service's privacy policy applies, and anyone who sees the post can see the list's link.
The share icons at the bottom of each page share that list's link when you're on a list, and our homepage everywhere else. They are ordinary links: nothing from Facebook, Instagram, TikTok, X, WhatsApp, Pinterest or Threads is loaded on our site, so those services can't see you here unless you click an icon. If you do, you go to their website or app, and their privacy policy applies there.
When someone shares a list's link in an app such as WhatsApp, iMessage or Facebook, that app may visit the page to show a preview card (the list's title and our standard picture).
Links added to wishes go to other websites (such as shops). Those sites have their own privacy policies. When family click a link, we tell the other site nothing about the list.
How long we keep it
- A list is kept until it is deleted using the Delete my list button, which erases it immediately.
- Lists that nobody opens or changes for 12 months are deleted automatically.
- Sign-in sessions end after 14 days, or immediately when you log out.
Cookies
We use one cookie, called sid, to keep you signed in while you edit your own list. It is strictly necessary, cannot be read by scripts, and expires after 14 days or when you log out. Because it is strictly necessary, the law does not require us to ask for consent, so there is no cookie banner. We use no analytics or advertising cookies, and no other similar technologies.
Your rights
You, and a parent or carer acting for a child, have the right to:
- access the data and take a copy (data portability): use Download my data on the list page;
- erase it: use Delete my list on the list page;
- correct it, restrict how we use it, or object to us using it: contact us at the address above.
We will reply within one month. If we need to confirm a request comes from the right person, we will ask for the list's password, not for extra personal details.
Security
The site only works over encrypted HTTPS. Passwords are salted and hashed, sign-in is limited after repeated wrong attempts, and pages use strict security headers. If a personal data breach ever put anyone at risk, we would tell the ICO within 72 hours and let affected families know.
Complaints
Please contact us first so we can put things right. You can also complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Changes
If we change how we use information, we will update this page and the date at the top. We will never start collecting more information about children without making that clear first.