Privacy Policy
Last updated 29 October 2026. This policy explains how Appreci Pty Ltd (“Appreci”, “we”, “us”) handles personal information in the Appreci mobile apps for iOS and Android, the web application at portal.appreci.io, the Verandah ordering site, and Appreci for Slack and Microsoft Teams. It is written to meet the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Who we are
Appreci Pty Ltd (ABN 29 631 324 804) of Brisbane, Queensland, Australia. We are responsible for the personal information described here. Contact us at hello@appreci.io with the subject “Privacy”.
What we collect
| Information | When | Why |
|---|---|---|
| Name and email address | When you create an account, or when someone sends you a gift | To run your account and deliver gifts and replies to you |
| Sign-in identifiers | When you sign in with Google, Microsoft or Apple | To confirm it is you. We receive a token and your email and name from the provider; we never see your password for that provider |
| Phone number | Optional: if you add it, or if you receive gift or order alerts by SMS | Sign-in codes and order alerts by text message |
| Delivery address | If you give one for a physical gift | To ship the gift. It is passed to the store or courier fulfilling it |
| Payment details | When you pay | Cards are entered into Stripe's secure payment form. We receive a Stripe customer reference and the last four digits, never the full card number |
| Gifts, orders and credit | When you send, receive, redeem or bank a gift | To run the service and keep records of purchases |
| Messages and replies | When you write a message with a gift, record a voice or video message, attach a photo or GIF, tag a song, or reply | To deliver them to the other person on the gift |
| Location | Only while the app lists stores near you, and only if you allow it | To show nearby cafés. We use it for that one request and do not keep it |
| Device details | When you use the app | A push-notification token so we can notify you, an install identifier so sign-in codes reach the right device, and the device type and app version for support |
| Technical logs | When our servers handle a request | Error logs, and on our test systems a request log, to keep the service working and investigate problems. Passwords, cards and session keys are never written to logs |
| Web analytics | On portal.appreci.io only | Google Analytics tells us which pages are used. The mobile apps contain no analytics or advertising software |
Where you tell the Assistant about the person you are buying for (their interests, size, favourite team), that description is sent to the AI and search providers we use to find gift ideas. Give it only what you would be comfortable sharing with a shop assistant; it does not need the person's name.
How we use it
- To provide the service: accounts, sending and delivering gifts, redemption at stores, ordering ahead, replies, wallets and credit.
- To send you emails and notifications about your gifts, orders and account. These are part of the service.
- To prevent fraud and abuse, keep the service secure, and meet our legal obligations, including tax and consumer-law records.
- To improve the service, using aggregated information that does not identify you.
We do not sell personal information, and we do not use it for advertising or for tracking you across other companies' apps and websites.
Organisations and teams
When an organisation (an employer or a company) sends you a gift from its Appreci account, that organisation's administrators can see the gift, who it went to, and its message. If you choose Share with team on a gift or a reply, it appears in that organisation's recognition feed for its members. Messages that are not shared stay between the two people on the gift. People in an organisation see only what belongs to their own organisation.
Appreci for Slack and Microsoft Teams
When your organisation adds Appreci to Slack or Microsoft Teams, we receive the workspace or team's id and name, and an access token that lets Appreci post messages there. We store the token encrypted.
When you use Appreci in Slack or Teams, we receive your user id, name and work email from that service, so we can link it to your Appreci account and deliver gift cards to the right people. We keep that link until you unlink it (/appreci disconnect), delete your Appreci account, or your organisation removes the app.
In Slack conversations Appreci has been added to, Appreci receives new messages so it can notice when someone says thanks and privately offer to send a gift card. We check the text at that moment and don't store it, log it, or send it to any AI provider.
When your organisation removes Appreci from Slack or Teams, we delete the access token and every account link for that workspace immediately. Gift cards already sent stay with the people who received them.
Gift ideas from /appreci find are generated by an AI provider (see “Who we share it with” below) from what you type. We don't use Slack or Teams data to train AI models.
Questions or deletion requests: hello@appreci.io
Accounts you connect: Google, Microsoft and Canva
You can connect a Google, Microsoft (Outlook or Microsoft 365) or Canva account to Appreci, under your avatar → Profile → Connectors or while you send a gift. Connecting is optional; everything else in Appreci works without it. Each one is used only for the feature you connect it for:
- Gmail (permission to send email): when you choose to send a gift from your Gmail address, we send that one gift email through your Gmail account. We can't read, list or delete your mail.
- Google Photos and Google Drive: you pick a photo in Google's own picker, and we receive only the photo you pick. We can't see the rest of your library or your Drive.
- Outlook or Microsoft 365 (permission to send email, and your name and email address): when you choose to send a gift from that address, we send that one gift email through your Microsoft account. We can't read your mail.
- Canva: we list your designs so you can choose one, and export only the design you pick as an image for your gift card. We never change or delete your designs.
What we keep: the access tokens the provider gives us, stored encrypted; the email address or name of the connected account, so you can see which one is connected; and a record of each connection and each action taken with it (for example “gift email sent”), without the content. A photo or design you pick is copied, with location and camera details removed, and kept with the gift card as part of the gift.
We don't sell information from these accounts, use it for advertising, or use it to train AI models, and nobody at Appreci reads it unless you ask us to for support, it is needed for security, or the law requires it.
Appreci's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect at any time under Profile → Connectors: we delete the tokens straight away and, where the provider supports it, cancel them with the provider too. You can also remove Appreci's access in your Google, Microsoft or Canva account settings. Deleting your Appreci account removes every connection.
Who we share it with
We share personal information only with providers that help us run the service, and only what each needs:
| Provider | What for | Where |
|---|---|---|
| Stripe | Card payments, saved cards, and paying stores | Australia / United States |
| Google (Firebase) | Sign-in with Google, Microsoft and Apple; push notifications | United States |
| Amazon Web Services | Sending email (Sydney) and storing attached media | Australia |
| Twilio | SMS codes and order alerts | United States |
| Railway | Hosting our servers and database | Netherlands (European Union) |
| Cloudflare | Delivering our websites and protecting them | Global network |
| Stores, cafés and gift partners | Fulfilling the gift: the store sees the order, the item, and for delivery the recipient's name and address. Our ordering partner and our gift-card partner receive the details needed to issue a code | Australia |
| Square | Sending order-ahead tickets to a café's point of sale, when the café uses Square | United States |
| Shopify | When a store connects its Shopify shop to Appreci, order details for that store's products | Canada / United States |
| AI and search providers (xAI, Anthropic, Google, Serper) | Finding gift ideas when you use the Assistant | United States |
| Google (Gmail) and Microsoft (Outlook, Microsoft 365) | Only when you choose to send a gift from your own address: the recipient's email address and the gift email go through that account | United States |
| Spotify and Giphy | Looking up songs and GIFs you choose to attach | United States |
Some of these providers are outside Australia. By using Appreci you agree that your information may be stored and processed in those countries. We choose providers with recognised security practices and only send them what they need.
We will also disclose information where the law requires it, for example to a regulator or under a court order, and we may disclose it to a buyer if Appreci's business is sold, who would then be bound by this policy.
How long we keep it
- Account details, replies and gifts: while your account is open. A message sent with a gift stays with that gift for the person who received it.
- Purchase and payment records: seven years after the transaction, as Australian tax and consumer law require, even if the account is closed. These records are kept to the minimum needed and are not used for anything else.
- Error and request logs: up to 14 days.
- Database backups: kept for security and recovery and expired on a rolling basis; anything deleted is gone from them within 14 days.
- Connected Google, Microsoft and Canva accounts: until you disconnect them or delete your Appreci account.
- Unopened gifts: for the gift's validity period, so the recipient can still claim it.
Security
Information travels over encrypted connections (HTTPS) and is held in access-controlled systems. Passwords are stored hashed, never in plain text. Card numbers are handled by Stripe and never reach our servers. No system is perfectly secure; if we learn of a breach that is likely to cause you serious harm we will tell you and the Office of the Australian Information Commissioner, as the Privacy Act requires.
Your choices and rights
- Access and correction: your details are in the app under your avatar → Settings. You may also ask us for a copy of the personal information we hold about you, or to correct it, at hello@appreci.io. We respond within 30 days.
- Deletion: in the app, avatar → Settings → Delete my account, or by email as described on the deletion page. The page explains what is removed and what we must keep.
- Location: you can refuse or revoke the location permission in your phone's settings; the Stores list then shows a default area instead.
- Notifications: turn push notifications off in your phone's settings.
- Complaints: write to hello@appreci.io with the subject “Privacy complaint”. We will acknowledge it within 7 days and aim to resolve it within 30. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Children
Appreci is not for people under 16, and we do not knowingly collect their information. Alcohol gifts require the sender and the recipient to be 18 or over. If you believe a child has given us personal information, contact us and we will remove it.
Cookies on the web app
portal.appreci.io uses a cookie or local storage to keep you signed in, and Google Analytics to measure which pages are used. The mobile apps do not use cookies or analytics.
Changes
When this policy changes we update the date at the top. For a change that affects how we use your information in a way you would not expect, we will tell you in the app or by email first.