Privacy policy

Last updated October 9, 2026

Wishlists lets people make gift wishlists and share them with a link. This page explains what we collect, why, and what you can do about it. The short version: we collect what's needed to run the service, we don't sell it, and there are no ads or third-party trackers.

What we collect

• Account details, if you make lists: your email address, the display name you choose, and your avatar icon and color. If you sign in with Google, we receive your name, email address, and profile photo from Google, nothing else. Your Google photo is shown as your avatar unless you turn it off on your account page; it's loaded from Google's servers, so Google can see the IP address of anyone viewing your lists.
• Your lists: titles, descriptions, and items (links, images, notes, and the other details you add).
• Purchase marks from givers: when someone marks an item as purchased, we store that it was purchased and, only if they type one, the name they give. Givers don't need an account, and we don't ask for their email.
• List views: when someone opens a share link, we add one to that list's view count for the day and note the time. We don't record who viewed it. The list's owner and collaborators see the total and when it was last viewed.
• Technical data: our hosting providers keep standard server logs (like IP address, browser type, and pages requested) for security and troubleshooting. If you try to sign up without an invite, the email address you used is logged too. We use cookies only to keep you signed in.
• On the giver's own device: the share page remembers, in the browser's local storage, which items that browser marked, so it can say “You marked this,” and the last day it counted a view, so a visit counts once a day. Neither leaves their device.

How it's used and who can see it

• Anyone with a list's share link can see that list and its items, and whether each item has been purchased. Share links are unguessable and kept out of search engines, but treat them like you'd treat an invitation: share them with people you trust. You can replace a link at any time, which turns the old one off.
• Givers never see who bought what. A buyer's name is visible only to the list's owner, and only if the owner chooses to see purchases.
• When you paste a store link, our server visits that page once to read its title and image. The store sees a request from our server, not from you.
• We don't sell your information, show ads, or use third-party analytics. If that ever changes (for example, adding ads to keep the service free), we'll update this policy first and ask for consent where the law requires it.

Service providers

We use Supabase to store data, handle sign-in, and send sign-in emails, and Vercel to host the website. Both store data in the United States and process it only to provide their services to us.

Keeping and deleting your data

• You can edit or delete any item or list at any time.
• You can delete your account from the Account page. That immediately and permanently deletes your profile, every list, every item, and every purchase mark on your lists. Copies in our providers' backups, if any, are removed within 30 days.
• Givers who want their name removed from a purchase can ask the list's owner, who can unmark it.

Children

Lists are often for kids, but accounts are for adults. You must be at least 16 to create an account. Please don't put a child's full name, address, or other identifying details in a list.

Changes

If we change this policy, we'll update the date at the top. For significant changes, we'll let account holders know by email before they take effect.

Contact

A contact email will be listed here before Wishlists opens beyond its first testers.