Privacy Policy

Wishery runs this website (wishery.io) and the Wishery app (app.wishery.io), a service for creating wishlists, sharing them with friends and family, and reserving gifts. We are based in the United Kingdom, and for the purposes of UK data protection law we are the controller of the personal data described in this policy.

If you have any question about this policy or your data, email us at hello@wishery.io.

Account information. When you sign up we collect your email address, display name and password. Passwords are stored only in hashed form by our authentication provider; we never see them. If you sign in with Google or Facebook, we receive your name, email address and profile picture from that provider. We do not receive your password for those services or access to anything else in your account there.

Content you create. Wishlists, the items on them (names, links, prices, images and notes), friend connections, gift reservations, group gift boards, the items and votes on them, and the notifications we send you about this activity.

Product links you add. When you add an item by pasting a link or scanning a barcode, our servers fetch that product page to fill in the title, image and price. When a link points to a retailer we do not yet have an affiliate arrangement with, we record the link and the retailer's domain alongside your account, so we can decide which retailers to partner with.

Technical information. Like most websites, our hosting providers automatically log basic request information such as IP address, browser type and the pages requested. We use this to keep the service running and secure.

We use your information to:

• Provide the service: create your account, store your wishlists, show them to the people you choose to share them with, and handle reservations and group boards. This is necessary to perform our contract with you.
• Keep the service secure, prevent abuse, and fix problems. This is in our legitimate interest.
• Understand how the service is used and improve it, including deciding which retailers to partner with. This is in our legitimate interest.
• Send you messages about your account, such as email confirmations and password resets.

We do not sell your personal data, and we do not use it for advertising profiles.

You choose the visibility of each wishlist. Depending on that setting, a list may be visible only to you, to your friends on Wishery, or to anyone who has its link. Anyone who can view a list can see the items on it.

Reservations are designed to stay secret from the list's owner, so that gifts remain a surprise. Other people viewing the list may be able to see that an item has been reserved.

Some product links on Wishery, both in the app and on our blog, are affiliate links. For example, Wishery participates in the Amazon Services LLC Associates Program. When you click an affiliate link and buy something, the retailer pays us a small commission at no extra cost to you. To track this, the retailer may set its own cookies on your device once you reach its site; their privacy policy governs that. Retailers report commissions to us in aggregate. They do not tell us who you are or what you bought.

We use only the cookies and browser storage needed to make the service work: keeping you signed in, remembering your preferences, and caching your lists so the app works offline. We do not use advertising or third-party analytics cookies.

We use a small number of providers who process data on our behalf, under contracts that require them to protect it:

• Supabase: database and authentication. Your account and content are stored on servers in the European Union (Ireland).
• Vercel: website and app hosting.
• Google and Facebook: only if you choose to sign in with them.

We may also disclose information if the law requires it, or to protect the rights and safety of our users or others.

Some of our providers may process data outside the UK, including in the United States. Where that happens, we rely on recognized safeguards such as UK adequacy regulations or the UK International Data Transfer Agreement and Addendum.

We keep your account and content for as long as your account is active. If you ask us to delete your account, we will delete your personal data within 30 days. Copies in backups are removed when those backups expire. We may keep limited information for longer where the law requires it.

Under UK data protection law, you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted, including your whole account.
• Restrict or object to how we use your data.
• Receive your data in a portable format.

To exercise any of these rights, email hello@wishery.io. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Wishery is not intended for children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has created an account, contact us and we will delete it.

We protect your data with encryption in transit, access controls in our database that limit each user to the data they are allowed to see, and providers that follow industry security practices. No system is perfectly secure, but we take reasonable steps to keep your information safe.

If we make significant changes to this policy, we will update the date at the top and, where appropriate, notify you in the app. Please also read our Terms of Service.