Privacy Policy

1. Introduction

Wish Well ("we," "us," "our") respects your privacy. This Privacy Policy explains how we collect, use, store, and protect information when you use our Service.

2. Information We Collect

2.1 Account Information (from Parents)

When you create an account, we collect:

• Name
• Email address
• Password (stored as a secure hash; we never see your actual password)
• Google account information (if you use Google Sign-In — email, name, Google ID)
• Account creation date and last login date

2.2 Information About Children (from Parents)

When you create a child profile, we collect only what you provide:

• Child's first name
• Child's birthday (month and day required; year optional)
• Child's gender (optional)
• Child's interests (optional, selected from our preset list)
• Child's clothing and shoe sizes (optional, free text)
• Saturated and welcome gift categories (optional)

We do NOT collect:

• Child's last name
• Child's photographs (avatars are generated illustrations, not photos)
• Child's contact information
• Child's location beyond what the parent provides
• Child's biometric data

2.3 Wishlist Content

• Items added to wishlists (title, price, URL, notes, image)
• Uploaded screenshots (processed for extraction, then deleted or replaced with a clean product image)
• Gift claim records (who claimed what, but only visible to the parent if they've enabled visibility)
• Stories attached to claimed gifts (from gift-givers)

2.4 Gift-Giver Information

When someone claims a gift as a guest:

• Name (required)
• Email (required)
• Shipping address (optional, only if they choose "Ship to home" delivery)
• Any notes or stories they leave

2.5 Usage Data

• Pages visited and actions taken within the Service
• Device type and browser
• IP address (used for rate limiting and security, not stored long-term)
• Timestamps of activity

We do NOT use tracking cookies, third-party analytics beyond basic operational needs, or behavioral advertising profiles.

3. How We Use Information

We use information only to:

1. Provide the Service (display wishlists, send reminders, generate AI suggestions, process claims)
2. Communicate with you about your account and the Service
3. Improve and maintain the Service
4. Enforce our Terms and protect against fraud or abuse
5. Comply with legal obligations

4. Third-Party Services

Wish Well uses a limited number of third-party services to operate. The services we use and what they receive:

4.1 Anthropic (AI Features)

What they receive: De-identified context about children (e.g., "a child who likes dinosaurs and LEGO"), screenshots for product extraction (without child metadata), user questions to the gift concierge (without child names).

What they do NOT receive: Children's names, exact ages, birthdays, sizes, photos, or any other direct identifiers about children.

Retention: Anthropic does not retain prompts for model training under our agreement.

4.2 Resend (Email Delivery)

What they receive: Email addresses of account holders and the content of transactional emails (welcome, birthday reminders, thank-you messages, VPC confirmation).

Retention: Standard email delivery logs retained by Resend per their privacy policy.

4.3 Google (OAuth Sign-In)

What they receive: When you choose "Continue with Google," Google verifies your identity and sends us your Google account email, name, and Google ID. We receive nothing else.

Retention: Per Google's privacy policy.

4.4 Replit (Hosting)

What they receive: All data necessary to host and operate the Service, stored in a PostgreSQL database on Replit's infrastructure.

Retention: Per Replit's terms of service.

We do not use any other third-party services that receive user data.

5. Data Retention

We retain your information only as long as necessary to provide the Service:

• Active account data: Retained while your account exists
• Deleted account data: Removed from active systems within 7 days, removed from backups within 30 days
• Email logs: Retained for 90 days for troubleshooting
• Security logs (IP addresses, etc.): Retained for 30 days for abuse prevention
• Backups: Rolling 30-day backup retention

6. Your Rights

6.1 Access and Correction

You can view and edit all information about yourself and your children at any time through your account settings.

6.2 Deletion

You can delete your account and all associated data at any time through your account settings ("Delete All My Data"). Upon deletion:

• Active records are removed within 7 days
• Backup records are removed within 30 days

6.3 Data Portability

You may request a copy of your data by emailing wishwellteam@wishwellapp.com. We will provide it in a machine-readable format within 30 days.

6.4 Opt-Out of Marketing

Wish Well does not send marketing emails. All emails from us are transactional (account confirmations, birthday reminders, thank-you delivery, VPC flows). You can unsubscribe from birthday reminders through your account settings.

6.5 State-Specific Rights

See the State-Specific Privacy Rights section in our Terms and Conditions for rights available to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Illinois, and other states.

7. Children's Privacy (COPPA)

Wish Well complies with the Children's Online Privacy Protection Act (COPPA).

7.1 Our COPPA Practices

• We do not knowingly collect personal information directly from children under 13
• All information about children is provided by parents or legal guardians who have completed our Verifiable Parental Consent (VPC) process
• We use the Email Plus VPC method, which is permitted because we do not disclose children's personal information to third parties
• We collect only the minimum information reasonably necessary for the Service
• Parents have the right to review, correct, delete, and refuse further collection of their children's information at any time
• We maintain reasonable security measures to protect children's information
• We maintain a written data retention schedule

7.2 Parental Rights Under COPPA

As a parent or legal guardian, you have the right to:

• Review all personal information we have collected about your child
• Correct or update any information
• Delete any or all information
• Refuse to allow further collection or use of your child's information

To exercise these rights, use your account settings or email wishwellteam@wishwellapp.com.

7.3 If We Discover Unverified Children's Data

If we discover that we have collected personal information from a child under 13 without proper parental consent, we will delete that information as soon as possible.

8. Security

We implement reasonable administrative, technical, and physical safeguards to protect your information:

• Passwords are hashed using industry-standard algorithms
• Data is transmitted over HTTPS with TLS encryption
• Access to production systems is restricted
• Regular security updates and patches
• Third-party services are selected based on their security practices

However, no system is 100% secure. If we discover a data breach affecting your information, we will notify you as required by applicable law.

9. International Data Transfers

Wish Well is hosted in the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States. We currently restrict access from the European Union and other jurisdictions with specific data transfer requirements.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will:

1. Notify you via email at least 30 days in advance
2. Require you to affirmatively re-accept the updated Privacy Policy before continuing to use the Service

For non-material changes (typos, clarifications), we will update the "Last Updated" date.

11. Contact Us

Questions about this Privacy Policy or your data:

Email: wishwellteam@wishwellapp.com

For COPPA-specific requests: wishwellteam@wishwellapp.com with "COPPA Request" in the subject line.