Information we use
We store your email address, unique username, display name, password hash, account security settings, orders, GiftMint Credit ledger, and support history so we can run the service. Optional profile pictures and banners are stored only when you upload them.
Information we do not want
GiftMint does not ask for or store your Epic Games password, Epic authentication codes, or payment card numbers. Payment details are handled by the payment provider. We only need the Epic display name required for a manual gift.
Email and payments
We use Resend to send account verification, sign-in security, and password-reset email. When enabled, a payment provider such as Skrill processes payment on its own secure systems. Provider credentials are kept on the server and are never sent to your browser.
Security and deletion
Passwords are hashed, sessions use httpOnly cookies, sensitive two-factor secrets are encrypted, and security-sensitive actions are rate limited and audited. You can disable your account or schedule deletion from Account settings. For verified accounts, deletion is scheduled for the configured window (7 days by default, with a reminder on day 4). The account is restricted for purchases immediately; personal details are eligible for anonymization at or after the deadline once financial safeguards are clear. Required financial and historical records remain. Unverified registrations expire after 72 hours by default and can be recovered through verified email for 30 days.
Questions
For privacy questions or a data request, use the support email listed in the GiftMint account or site settings and include the email on your account.