Cascabel — Privacy Policy
Last updated: October 17, 2026
This policy explains what data Cascabel ("the app") and its link pages handle. The app is published by Yabin Alejandro Lagunes Cuevas, trading as The Alchemist Code ("we"), who is responsible for your data. Contact: [email protected].
The short version
- There is no account. Nobody, organizer or participant, gives us a name, email or password.
- Your exchanges, the participants' names, gift hints, rules (couples, households), budgets, dates, places, messages, the draw itself, your wish list and settings are stored only on your device. We do not upload them anywhere and we don't run a server that stores groups.
- Each participant's private link carries their own result inside the link, after the "#". Browsers never send that part to a website, so our web host never sees it.
- Reminders are scheduled on your phone. No server sends them.
- The app does not read your contacts or use your location.
- The app shows ads and uses analytics and crash reporting. Those services, run by Google, collect some technical data, described below.
Data stored on your device
Your exchanges (name, occasion, date, place, budget, message and card design), the participants' names and the gift hints you write for them, households and exclusions, the result of each draw, which links you marked as sent, pairs from past years, your wish list, reminders and settings. They stay on your phone.
- Backup file: the app creates it only when you ask. You decide where to save it and who to share it with. We never receive it.
- Android backup: if backup to your Google account is turned on in your phone's settings, Android may include the app's data in your device backup so it comes back when you move to a new phone. Android makes that backup and stores it encrypted in your Google account. We have no access to it.
You can erase everything at any time in Settings › Delete all my data. Uninstalling the app also removes it from the phone.
The private links
When you send a participant their link, the app builds it on your phone and hands it to the app you choose (WhatsApp, Messages, email…). We are not involved in sending it.
- What a link contains: the exchange's name, date, place, budget and your message, the name of the person who receives the link, the name of the person they give a gift to, that person's gift hints, the card design and the language. A wish-list link contains a name and a list of wishes.
- How it is protected: that data travels after the "#" in the address. Browsers keep that part on the device and never send it to the website, so our web host never receives it. The data is also scrambled so it can't be read at a glance. It is not encrypted: anyone who has the link can open it, so each link is meant only for its participant.
- What our web host sees when a link is opened: the same as any website, a request for the
page
cascabel.alekla.com/r/or/w/with the IP address, browser type and time, kept in the host's standard access logs. Never the names or the result. - The link pages have no ads, no analytics, no cookies and load nothing from other websites. If a participant writes a wish list there, it stays in their browser until they share the wish-list link themselves.
Data collected by third-party services (in the app)
| Service | What it collects | Why |
|---|---|---|
| Google AdMob (ads) | IP address (used to estimate approximate location), Android advertising ID and app set ID, interactions with ads and the app, performance diagnostics | Showing ads, measuring them, preventing fraud |
| Google Analytics for Firebase | App-instance ID, advertising ID, approximate location derived from a masked IP address, screen views, sessions and purchase events | Understanding how the app is used |
| Firebase Crashlytics | Crash stack traces, device metadata at the time of a crash, app state, an installation identifier | Finding and fixing crashes |
| Firebase Remote Config | Country, language, time zone, OS and app version | Adjusting app settings remotely |
| Google Play Billing | Payment details and your purchase | Processing your Premium subscription or one-time purchase (we never see your card) |
None of these services receives the participants' names, the draw, the hints or your wish list. All of this data is encrypted in transit. Each provider handles it under its own privacy policy:
- Google: https://policies.google.com/privacy
- How Google uses data from apps that use its services: https://policies.google.com/technologies/partner-sites
Your choices
- Ad personalization (EEA, UK, Switzerland): the app asks for your consent before showing personalized ads, and you can change your choice anytime in Settings › Ad privacy options.
- Advertising ID: you can reset or delete it in your Android settings under Privacy › Ads.
- Notifications: exchange-day and unsent-link reminders are optional. You can deny the permission and still use everything, or revoke it anytime in your phone's settings. Reminders never say who anyone is giving a gift to.
- Premium removes all ads.
If you received a link
You don't need the app or an account. The organizer typed your name in their app; we never received it. To have your name or hints removed, ask the organizer: they can delete you from the exchange or delete the exchange. Your link keeps working for whoever has it until it is deleted from the conversations it was sent to.
Your rights
You can ask us about your data or to delete it by writing to [email protected]. Because there are no accounts and the data stays on the organizer's phone and inside the links, we hold nothing that identifies you; deleting your data in the app removes it for good.
Children
The app is not directed at children under 13 and we do not knowingly collect data from them.
Changes
If this policy changes, the new version will be posted at this address with an updated date.
Contact
Yabin Alejandro Lagunes Cuevas (The Alchemist Code), Mexico · [email protected]