A toggle is a promise, not a lock
Every gift list site has a privacy page full of switches. Flip this one for private. Flip that one to hide your address.
A switch is only a promise. Something behind it has to actually keep that promise, and that something is never on the settings page.
So here are the questions nobody puts there. If you flip "private," what stops a stranger who already has the link? Where do your images actually live, and who can reach them? Is your permission checked when the page loads, or only when the menu gets drawn? What can a browser add-on you installed six months ago still do today? And when you hit delete, what actually leaves the building?
This piece walks through what happens on Belovity's side of each of those, in plain language.
It is not a security marketing page. It is a description of the machinery, and what each piece means for you. If there is one line worth carrying away, it is this one: the browser add-on's access expires on a fixed schedule whether or not you ever use it.
Four questions worth asking any gift list site
1. How do I prove I'm me?
Is it a password you invented, reused across a dozen sites, and then forgot? Something that can leak in a breach on a completely different website and end up here?
2. Where are my images?
Are they in a folder anyone can browse if they guess a filename? Is the link that shows them one that keeps working forever once somebody copies it out of the page?
3. When is my permission checked?
Before the page is built, or after it is built, with the button simply hidden from view? And does a visitor who never signed in go down a different, looser path?
4. What happens when I delete?
Is it gone, or flagged as hidden and quietly kept? Does it take a deliberate action, or one misclick on a bad day?
How Belovity approaches it
There is no password to steal
You never create a password on Belovity. That means there is no password of yours to reuse, guess, phish, or lose in someone else's breach.
There are three ways in, and none of them is a password: a sign-in link sent to your email, Google, or Facebook.
There is no password field anywhere in sign-in or sign-up. Not hidden, not optional. Accounts are created with a long random value sitting in the password slot that nothing can ever type in.
The sign-in pages are also guarded against automated attempts, before your email address is even looked up.
The emailed sign-in link is tamper-proof and short-lived
A forwarded or intercepted link is close to worthless within minutes, and an edited one is worthless immediately.
The link carries a seal that covers the whole address. Change one character of the email inside it and the link is rejected outright.
It also expires on a clock. Fifteen minutes, by default.
A rejected link does not produce a hint or an error page. It just puts you back at sign-in. And when you sign out, the session is cleared and rotated behind the scenes, so the old one cannot be picked back up.
Your images aren't sitting in an open bucket
A copied image link goes dead instead of living forever, and there is no public folder for anyone to walk through.
Images live on private cloud storage, not in a publicly readable web folder.
Every image the app shows you — your family picture, your cover image, your profile picture — is displayed through a temporary link that is generated fresh when the page loads. Those links expire on their own after a few minutes by default. Attachments you send to support work the same way, on their own longer clock.
Which makes every "right-click, copy image address, paste it into the group chat" scenario a dead end within minutes.
The metadata never leaves with the picture
Pictures can carry invisible extras: location coordinates, device identifiers, editing history. None of that rides along with your upload.
Every original image is stripped of that embedded metadata before it is written to storage. JPEG, PNG, and WebP are all handled, and the strip happens at the byte level, so image quality is untouched.
The color information your browser needs to render the picture correctly is deliberately kept, so nothing comes out looking washed out. And if a strip ever produced a file that no longer reads as an image, the original bytes are put back rather than saving something broken.
It sits at the single point every upload has to pass through. A new upload path cannot accidentally skip it.
Every page checks your permission before it loads
The answer to "can this person see this?" is settled before a single line of your family's content gets assembled.
Pages that carry family content run their permission check as the request comes in, not as the page is drawn. The check resolves the actual thing you asked for — the family, the specific gift list — and asks the rules about that.
Fail it and you are redirected before the page ever exists. There is no "page loaded, button hidden" state left over for someone to poke at.
Where you land is the first page you are genuinely allowed to see, rather than an error screen that quietly confirms something is there. This covers the family page, an individual gift list, the followers screen, page settings, gifts received, analytics, and billing.
Signed-out visitors are judged by exactly the same rules
There is no looser side door for people who never signed in.
The rules are written to treat "no one is signed in" as a normal case, not a special one. A private family page returns the same refusal to a signed-out stranger as it does to a signed-in person who is not a member.
The one difference is your family's own choice. A family set to public is readable by anyone, because that is what public means.
A switched-off gift list, and a list with nothing published in it yet, stay invisible to followers no matter which link they try. Owners and admins are the only people who can see a list before it is switched on, by design, so you can build it in private.
The browser add-on can only touch gift lists
Installing the add-on does not hand a browser extension the keys to your whole account.
Its access is issued with exactly two permissions: read gift lists, write gift lists. Every one of the four things it can call is individually gated on holding the right one of those two.
It cannot read your followers, your settings, your billing, or anyone else's family. It can only see families you own or administer, never a family you merely follow.
Its separate renewal credential holds one permission and one only: renew. It cannot touch a gift list at all.
Your ordinary signed-in browser session is deliberately not accepted by that interface either, so an add-on's limits cannot be side-stepped just by being logged in. And every call is rate limited, so a misbehaving or hijacked add-on cannot hammer your account.
Its access expires on a fixed schedule, no matter how much you use it
An add-on you installed and forgot about goes quiet on its own.
The working credential lasts fifteen minutes, then has to be renewed. The whole connection has a hard thirty-day ceiling from the day you connected it.
Renewing issues fresh credentials inside that same connection. It never pushes the thirty-day ceiling back.
Every renewal is single-use, consumed the moment it is exchanged. Renewing also immediately kills the previous working credential, so only one is ever live.
After thirty days the connection is simply over, and you reconnect deliberately with the same one-click flow.
If the access looks copied, the connection shuts itself off
You do not have to notice a theft for it to be stopped.
Presenting an already-used renewal credential is the signature of a copied one.
A short grace window separates the innocent case from the suspicious one. If the add-on lost a network response and is simply retrying, it gets the same answer as the original attempt.
Outside that window, the entire connection is revoked on the spot, the attempt is refused, and the event is logged. Revoking is a mark rather than an erasure, so the trail that detected the reuse is still there afterward.
You can see every connection and cut any of them
"Which browsers can add to my lists?" is a page you can open, not a mystery.
The Browser extension connections screen lists every live connection, with the browser name and when it was connected. Each row has a disconnect button behind a confirmation.
Disconnecting takes effect immediately for that connection and touches no other. And you can only disconnect your own connections. The screen cannot be pointed at somebody else's.
There is a cap on how many browsers can be connected at once. Connect a new one past the cap and your oldest is retired automatically.
The credential is handed to the add-on by your own browser, and only to the specific add-on IDs Belovity allows. It is never posted anywhere else. If that handoff fails, the connection that was just created is thrown away rather than left sitting there live.
Changes are on the record
"Who turned that setting off?" has an answer.
Creates, updates, and deletes are recorded across sixteen kinds of record, including the family, its members, their permissions, pending follow requests, and gift lists.
Each entry captures who did it and from where.
Sensitive values in recorded web addresses are redacted before they are stored. A sign-in callback is recorded as having happened, not with its contents.
Deleting really deletes
Delete means removed, not hidden. And it cannot happen by accident.
Deleting a family page requires typing DELETE FAMILY PAGE. Deleting your account requires typing DELETE MY ACCOUNT.
Nothing in Belovity is quietly soft-deleted. There is no hidden copy sitting behind a flag.
Deleting a family page takes down its gift lists, every item on them including archived ones, every gift record attached to those items, its members, their individual permissions, pending follow requests, and its stored images. Any paid subscription is canceled first, so a deleted family cannot keep being billed.
Deleting your account takes your owned family pages with it, plus your saved notification settings, your push notification registrations, and any browser add-on connections.
Where you contributed to a family you do not own, that family is not destroyed as collateral. A gift list you built inside someone else's family transfers to that family's owner, and your name comes off the records that have to survive — support requests, page views, gift records — rather than those records being kept under your name.
Putting it together: three scenarios
"Someone forwarded my sign-in email"
The link only works for the email address baked into it, and only for fifteen minutes.
Editing that address to their own breaks the seal, and the link is rejected.
And nothing about the attempt tells them whether the account exists in the first place.
"I right-click-copied an image off my own page to check"
The link you copied is a temporary one, not a permanent file address.
Paste it anywhere a few minutes later and it is dead.
The picture never carried location coordinates in the first place. Those came off at upload.
"My laptop was stolen with the add-on installed"
Open Belovity anywhere else, go to Browser extension connections, disconnect that browser. Done, immediately.
If you do not get there first, the working credential dies within fifteen minutes, and the whole connection dies inside thirty days regardless.
If anyone tries to reuse a captured renewal credential, the connection revokes itself and the attempt is refused.
Either way, the add-on could only ever have added items to your gift lists. Never read your followers, your settings, or your billing.
Checklist: what to ask about any site holding your family's list
Do they make you create a password? If yes, what happens when it turns up in a breach somewhere else?
Copy an image address off the page and open it in a private window tomorrow. Does it still load?
Open a private list's address while signed out. Do you get a clean refusal, or a page that loads and hides things?
Find the list of connected apps and browsers. Is there one? Can you cut one off?
Find the delete option. Does it say delete, or deactivate? Does it ask you to confirm that you mean it?
Ask what expires on its own. Not what you can revoke, but what dies without you doing anything at all.
Ask what's back there
Privacy settings are only as good as the thing enforcing them, and enforcement is invisible by design. Which makes it entirely fair to ask what is back there.
On Belovity: no password to steal, sign-in links that expire, image links that expire, permission checked before the page exists, the same rules for signed-out visitors, an add-on on a short leash that revokes itself if it looks copied, and deletion that removes rather than hides.
Create your family page, share it with the people you choose, and know that the settings you picked are being enforced by something, not just displayed.
