GiftingStack
Sign in Get started
Docs menu

Docs

Users and privacy

GiftingStack never sees your users' credentials or profiles. This page explains the user ids you send, what deleting a user does, and what happens when you delete a project or an account.

Checked against the API and the live OpenAPI on 2026-10-21.

This is a technical description of how the product behaves. The legal wording is in the Privacy Policy, the DPA and the Terms; if they differ, those win.

Users

  • A user is created the first time you credit them (or when they receive a gift). You never create one explicitly.
  • You identify a user with your own external_id: 1 to 128 characters of letters, digits and _ . : -. Use an opaque id from your system. Do not use an email address or a name: GiftingStack does not need them, and ids appear in ledgers and webhooks.
  • Do not put personal data in metadata. Gift message and metadata are user content that GiftingStack does not write to its logs.
  • Read a user with GET /v1/users/{id} (balance), GET /v1/users/{id}/ledger and GET /v1/users/{id}/received-gifts. There is no single "export everything" call; those three together are the data we hold about one user.

Delete a user

DELETE /v1/users/{id} (needs an Idempotency-Key) removes the personal data of one user and keeps the economic history under a pseudonym, so your books still add up. In one step:

  • A balance that is not zero is set to zero by a forfeit ledger entry (reason user_deleted). The coins are gone for good; this is not a payout.
  • The user's external_id becomes a deleted_… pseudonym. Your original id is not stored anywhere afterwards. If you use it again, it creates a new, empty user.
  • The user's metadata, and the message and metadata of every gift they sent or received and of their ledger entries, are erased. Amounts, ids, dates, reasons and references stay.
  • Stored webhook payloads (also what GET /v1/events returns) and stored idempotent responses that name the user are redacted the same way.
  • The user disappears from leaderboards and gift walls, and their "away" cursor is removed.
  • Store receipts verified with this user (POST /v1/receipts/verify with user) keep no link to them: verifying the same purchase again answers first_seen.same_user: null. The receipt itself stays, so it still credits only once.
  • A user.deleted webhook is sent with the new id and pseudonym.
curl -X DELETE https://api.giftingstack.com/v1/users/ava \
  -H "Authorization: Bearer $GS_KEY" \
  -H "Idempotency-Key: $(node -e "console.log(crypto.randomUUID())")"

# {"id":"usr_…","external_id":"deleted_…","deleted":true,
#  "forfeited_balance":500,"forfeit_entry_id":"led_…","deleted_at":"2026-10-20T12:00:00.000Z"}
  • Store the returned id if you need to match the webhook later.
  • Deleting a user is not refused while the live environment is suspended, not when a test cap has been reached, and not while the project is scheduled for deletion (the ledger still accepts it until the purge, then it answers 410 project_deleted). A project scheduled for deletion stops its keys, see below.
  • Deleting again: with the original id you get 404 not_found (it is no longer stored); with the deleted_… pseudonym, 422 user_deleted; a retry with the same Idempotency-Key within 24 hours returns the first answer.
  • Every other change to a deleted user (credit, debit, sending or receiving a gift) is 422 user_deleted. Gifts the user sent can still be reversed (fraud, moderation): the receiver's counts, wall and leaderboards drop as usual, and the refund is forfeited in the same step (a gift_refund entry followed by a forfeit entry), so the deleted user's balance stays 0 and sender_balance_after is 0. No metadata is stored for that reversal.

Delete a project

Only the project owner can do this, in the dashboard under Settings, by typing the project name.

  1. Immediately (within about 30 seconds): every API key of both environments, and the client tokens they minted, stop working (401, "scheduled for deletion"). The ledgers refuse writes (409 project_deletion_pending; only deleting a user still works) and the dashboard becomes read-only for that project. Nothing is erased yet.
  2. Seven days to change your mind. The owner can cancel in that time, and the keys work again. Pending team invitations are cancelled when the deletion starts and do not come back.
  3. After the 7 days: a daily job erases the project. The first daily run after the seventh day takes it, so allow up to about 8 days from your request. Once the job has started there is no cancelling.

What is erased: both ledgers (end users, balances, ledger entries, gift transactions and events, the gift catalog), API keys, webhook endpoints and delivery logs, team members, store records and receipts and the project's audit trail. The records the dashboard keeps for the project in its database are removed too. Gift room data is erased 6 hours after a room empties. After the purge the API answers 410 project_deleted.

Delete an account

In the dashboard, an account can be deleted by typing its email address. If the account still owns a project, it is refused (409 account_owns_projects): delete the projects first or ask support to transfer them. Otherwise it is immediate: the account record, sessions, sign-in links, memberships and invitations sent to it are erased. Where the account appears in other customers' project records (for example as the person who made a change), the record stays but is anonymised as a deleted account. Team members of a project the account did not own keep their access.

What cannot be purged

  • Webhooks in flight. An event waiting for a retry can sit in the queue for up to about 5 days. For a deleted project it is never delivered: the endpoint no longer exists, and the message expires.
  • Backups. Our infrastructure provider keeps point-in-time backups of the databases: 30 days on the paid plan we use (7 days for the D1 database on the free plan). Deleted data can only be reached through a restore, which we do not use to bring a deleted project back.
  • Operational logs and metrics. They carry no end-user data and no ids of your users. Metrics are indexed by project id and kept about 3 months.
  • Your own copies: webhook events you already received, your own database, anything you exported. That is yours to delete.
  • Our payment and email providers keep their own records under their own rules (invoices, sign-in emails).

Retention periods of third-party infrastructure can change; the binding statement of what we keep and for how long is in the Privacy Policy and the DPA. For a request that these tools do not cover, write to support@giftingstack.com.

Questions or something unclear? support@giftingstack.com.