Privacy Policy

1. Introduction

Wish Well ("we," "us," "our") respects your privacy. This Privacy Policy explains how we collect, use, store, and protect information when you use our Service.

2. Information We Collect

2.1 Account Information (from Parents)

When you create an account, we collect:

• Name
• Email address
• Password (stored as a secure hash; we never see your actual password)
• Google account information (if you use Google Sign-In — email, name, Google ID)
• Account creation date and last login date

2.2 Information About Children (from Parents)

When you create a child profile, we collect only what you provide:

• Child's first name
• Child's birthday (month and day required; year optional)
• Child's gender (optional)
• Child's interests (optional, selected from our preset list)
• Child's clothing and shoe sizes (optional, free text)
• Saturated and welcome gift categories (optional)

We do NOT collect:

• Child's last name
• Child's photographs (avatars are generated illustrations, not photos)
• Child's contact information
• Child's location beyond what the parent provides
• Child's biometric data

2.3 Wishlist Content

• Items added to wishlists (title, price, URL, notes, image)
• Uploaded screenshots (processed for extraction, then deleted or replaced with a clean product image)
• Gift claim records (who claimed what, but only visible to the parent if they've enabled visibility)
• Stories attached to claimed gifts (from gift-givers)

2.4 Gift-Giver Information

When someone claims a gift as a guest:

• Name (required)
• Email (required)
• Shipping address (optional, only if they choose "Ship to home" delivery)
• Any notes or stories they leave

2.5 Usage Data

• Pages visited and actions taken within the Service
• Device type and browser
• IP address (used for rate limiting and security, not stored long-term)
• Timestamps of activity

We use standard analytics and advertising measurement tools (Google Analytics, Google Ads, TikTok, and Meta measurement) to understand how people find and use Wish Well and to measure our advertising. We do not build behavioral advertising profiles of our users.

3. How We Use Information

We use information only to:

1. Provide the Service (display wishlists, send reminders, generate AI suggestions, process claims)
2. Communicate with you about your account and the Service
3. Improve and maintain the Service
4. Enforce our Terms and protect against fraud or abuse
5. Comply with legal obligations

4. Third-Party Services

Wish Well uses a limited number of third-party services to operate. The services we use and what they receive:

4.1 Anthropic (AI Features)

What they receive: De-identified context about children (e.g., "a child who likes dinosaurs and LEGO"), screenshots for product extraction (without child metadata), user questions to the gift concierge (without child names).

What they do NOT receive: Children's names, exact ages, birthdays, sizes, photos, or any other direct identifiers about children.

Retention: Anthropic does not retain prompts for model training under our agreement.

4.2 Resend (Email Delivery)

What they receive: Email addresses of account holders and the content of transactional emails (welcome, birthday reminders, thank-you messages, email verification).

Retention: Standard email delivery logs retained by Resend per their privacy policy.

4.3 Google (OAuth Sign-In)

What they receive: When you choose "Continue with Google," Google verifies your identity and sends us your Google account email, name, and Google ID. We receive nothing else.

Retention: Per Google's privacy policy.

4.4 Replit (Hosting)

What they receive: All data necessary to host and operate the Service, stored in a PostgreSQL database on Replit's infrastructure.

Retention: Per Replit's terms of service.

4.5 Analytics & Advertising Measurement

We use the following measurement services across our site. They receive standard technical information (pages visited, device and browser type, IP address, and their own cookie identifiers); they are never given information about a child (see Section 7).

• Google Analytics & Google Ads: How visitors find and use the site, and which of our ads lead to signups and other account activity. At signup, the account holder's email address is shared in hashed form so Google can attribute the signup to an ad ("enhanced conversions").
• TikTok: Signup conversions from our TikTok ads, measured via a pixel on the site and a server-side event that includes the account holder's email address in hashed form.
• Meta (Facebook/Instagram): Page views on our public marketing pages only (homepage, login, signup, and informational pages) and signup conversions. The Meta pixel does not load on pages that display wishlist or child-profile content, and it receives no user identifiers.
• Skimlinks: When you click certain outbound product links, the click is routed through Skimlinks so we can earn an affiliate commission. Skimlinks receives the product link and standard click information; no account or child information.

4.6 Other Services

We also use the following services, which receive limited technical or product information rather than information about you or your children:

• Amazon Product Advertising: when we suggest party supplies or read a product link you paste, we send the search terms or the product identifier to Amazon. No account or child information is sent.
• Firecrawl: when you paste a product link we cannot read directly, we send that link to Firecrawl to extract the product details. No account or child information is sent.
• Google Fonts: our pages load fonts from Google's font service, which receives your IP address and browser type as part of that request, as it does for any website using the service.

Together with Sections 4.1 through 4.5, this describes the third-party services that receive information from or about you. We will update this list if it changes.

5. Data Retention

We retain your information only as long as necessary to provide the Service:

• Active account data: Retained while your account exists
• Deleted account data: Removed from our active database immediately when you delete your account or a child profile
• Recovery copies: Our database provider keeps point-in-time recovery history, so copies may persist there for a short period before expiring automatically. We cannot delete data from that history directly
• Usage analytics: We retain anonymous usage events, which contain no name, email, or child information
• IP addresses: Used transiently in memory for rate limiting and abuse prevention. They are not stored in our database
• Email delivery logs: Held by our email provider (Resend) under their privacy policy

6. Your Rights

6.1 Access and Correction

You can view and edit all information about yourself and your children at any time through your account settings.

6.2 Deletion

You can delete your account at any time through your account settings ("Delete All My Data").

Upon deletion, your records are removed from our active systems immediately. Residual copies expire automatically from our provider's recovery history a short time later.

Please note: if you reserved a gift on someone else's wishlist, the name and email you provided to that list's owner remain part of their wishlist records, since that information belongs to their gift history.

6.3 Data Portability

You may request a copy of your data by emailing wishwellteam@wishwellapp.com. We will compile and provide it in a machine-readable format within 30 days of your request.

6.4 Emails From Us

Every email we send includes an Unsubscribe link that opens your email preferences without requiring you to log in. You can choose “Stop reminder and promotional emails” to stop birthday and occasion reminders, re-engagement messages, sizing reminders, gift-invite reminders, and similar promotional messages while continuing to receive emails about activity on your own account. Or you can choose “Stop all emails except ones you request” to stop those messages as well as account-activity emails such as reservation notifications, RSVP messages, friend requests, invitations, and thank-you delivery. You can use the same page to resubscribe at any time.

Password resets, email verification, consent requests, and consent confirmations continue regardless of either choice because they are necessary to recover or set up an account. These preferences are stored by email address, so they also apply if you received a reminder, reserved a gift as a guest, or later create an account with that address.

6.5 State-Specific Rights

See the State-Specific Privacy Rights section in our Terms and Conditions for rights available to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Illinois, and other states.

7. Children's Privacy

Wish Well is a service for parents and guardians. It is not directed to children, and children do not have accounts on Wish Well.

7.1 How information about a child reaches us

Every detail about a child on Wish Well — first name, date of birth, interests, and optional details such as gender or clothing sizes — is entered by that child's parent or guardian. We do not collect information directly from children. Children cannot register, sign in, or use the Service.

7.2 Parental confirmation

Before creating a child profile, the account holder confirms that they are the parent or legal guardian of that child.

7.3 We do not share children's information with third parties

We do not share children's information with third parties. We do not sell information about children, and we do not disclose it to advertisers, data brokers, or other third parties. Like most websites, we use standard analytics and advertising measurement tools across our site to understand how people find and use Wish Well; these tools measure how our site is used and are never given information about a child.

One exception applies when you choose to share: when a parent shares a wishlist link, messaging and social platforms (for example WhatsApp, iMessage, or Facebook Messenger) may fetch and cache a link preview showing the child's first name, age, and party details, and those cached previews are held by the platforms and are not revocable by Wish Well.

7.4 Your rights as a parent or guardian

At any time you may review all information we hold about your child, correct or update it, delete any or all of it, or stop any further collection or use. Use your account settings, or email wishwellteam@wishwellapp.com.

7.5 How long we keep it

We keep information about a child only as long as needed to provide the Service. When you delete a child profile or your account, we delete the associated information.

7.6 If we learn a child has given us information directly

We do not knowingly collect personal information from children under 13. If we discover we have, we will delete it promptly.

8. Security

We implement reasonable administrative, technical, and physical safeguards to protect your information:

• Passwords are hashed using industry-standard algorithms
• Data is transmitted over HTTPS with TLS encryption
• Access to production systems is restricted
• Regular security updates and patches
• Third-party services are selected based on their security practices

However, no system is 100% secure. If we discover a data breach affecting your information, we will notify you as required by applicable law.

9. International Data Transfers

Wish Well is hosted in the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States. The Service is intended for users in the United States, and we do not currently offer it to users in the European Union or European Economic Area.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will:

1. Notify you via email at least 30 days in advance
2. Require you to affirmatively re-accept the updated Privacy Policy before continuing to use the Service

For non-material changes (typos, clarifications), we will update the "Last Updated" date.

11. Contact Us

Questions about this Privacy Policy or your data:

Email: wishwellteam@wishwellapp.com

For requests about a child's information: wishwellteam@wishwellapp.com with "Children's Privacy Request" in the subject line.