Privacy Policy

Introduction

Wishlist is a gift list app made by one person. This policy explains what the app collects, why, and who else touches it. It covers the iPhone app, the Mac app, and getwishlist.app.

What you give us

• Account details. An email address or phone number, and optionally a display name and profile picture. Wishlist never asks you to create a password: you receive a sign-in link or a short code and use that. An account that already has a password can sign in with it instead.
• Your lists. Item names, links, prices, notes, quantities, occasions, budgets, and any images you upload.
• People you add. Names of people you track gifts for, and optionally their email address or phone number.
• Gifts you were given. What you received and who from, including a name you type in for somebody who has no Wishlist account, and their postal address if you are recording a thank-you note to send. This is information about another person, and you are the one deciding to keep it.
• Reservations. When you reserve a gift on someone else's list, we record that you reserved it. Choosing to reserve anonymously hides you from the list's owner, on their screen and in the thank-you they write later. It does not hide you from us: the reservation is still stored against your account, so that you can see and change it.

Contacts, on iPhone and Mac

The app asks for access to your contacts only so you can pick a person instead of typing their details. Your address book is not uploaded, and no contact is read until you open the picker and choose someone.

When you pick a contact, the app reads that one person's name and, where you have them saved, their email address, phone number, postal address and birthday. Their contact photo is shown in the picker on your own device and is never sent anywhere.

What is saved to your account is what the app needs for the thing you were doing: the person's name, plus their email address or phone number when you are inviting or linking them, and their postal address when you are recording a thank-you note you plan to send. Nothing is saved until you make that choice.

So, concretely: when you pick a contact to name a person or to name who gave you a gift, that name is sent to our servers and stored with that person or that gift, on your account.

You can decline contacts access and use every part of the app normally by typing the same details yourself.

What is collected automatically

• Usage events. Basic records of what happens in the app, such as a shared list being opened, so we can tell which parts are used.
• Links you save, read again. When you save a product link, the app reads that page to fill in the name, price, and picture. A link you have already saved may also be read again automatically in the background, without any action from you, to fill in a picture that is missing. Nothing about you is sent to the site; only its page is read.
• Crash and error reports. When something breaks on the website, a short record of the failure is written to our own database so it can be fixed. It notes what the app was doing and which page or list was involved. The iPhone and Mac apps do not report crashes at all, and no error report is sent to an outside service.

Who else processes your data

Your information is not sold. These providers handle parts of it so the app can work:

• Clerk: accounts and sign-in.
• Neon: the database your lists live in.
• Vercel: hosting and image storage.
• GitHub: a nightly copy of the database is kept in a private repository there, so that a bad day is recoverable. It holds the same information the database does.

Information may also be disclosed if the law requires it.

Who can see your lists

A list is private until you share it. You choose whether to make one visible to friends or to hand out its link. Reservations on your own list are deliberately hidden from you, so that a surprise stays a surprise; the person who reserved a gift can always see their own reservation.

Keeping and deleting your data

Your information is kept while your account exists. You can delete your account from inside the app on any platform, without asking anybody. The app shows you exactly what will be destroyed before it happens, and deletion cannot be undone.

Two things outlive it, and it would be dishonest not to say so. Images you uploaded stay in storage at their own web addresses; nothing links to them once your lists are gone, but they are not erased. Usage events and website error records are kept apart from your account and are not reached by deleting it. Neither carries your name or email address, though an event recorded while you were signed in can carry your account id. Write to us and both are cleared by hand.

Your choices

• Ask what is held about you, and get a copy.
• Correct anything wrong.
• Delete your account, and ask for the two leftovers above to go with it.
• Decline contacts access and still use the app.

Security

Data is encrypted in transit, and access to the production database is limited. No system is perfect, and this policy does not promise one is.

Children's Privacy

Wishlist is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has an account, write to us and it will be removed.

Changes to This Policy

This policy will change as the app does. The date at the top always says when it last did.

Contact Us

Questions about this policy, or about your data, go to support@getwishlist.app. For anything else, see Support.