Privacy Policy

Wish List Project (“Wish List”), at wishlistproject.com, lets you make a wish list and share it with friends and family, either as one public link or as personal invite links. This policy explains what we collect, why, who helps us run the service, and the choices you have. Wish List Project is run by Jason Lynn (“we”, “us”). Using Wish List is also subject to our Terms.

The short version

• We collect only what the app needs to work: your contact details, your lists, and the people you share them with.
• We use analytics and advertising cookies to understand how Wish List is used and to advertise it. You can opt out, and we honor Global Privacy Control.
• Shared list pages, invite pages and sign-in pages don’t load analytics or advertising tools, so what’s on your lists isn’t sent to them.
• We text you only about your own account and lists, and only if you agreed to texts. We never text a number someone else gave us. You can reply STOP at any time.
• We never share your mobile number or text-message consent with anyone for marketing.

What we collect

If you have an account (list owners)

• Contact details: the email address and/or mobile number you sign up with, and your name if you add it.
• Your lists: list names, descriptions, expiration dates and settings, and each item’s name, link, comment and status.
• Your contacts: the names, email addresses and mobile numbers of people you add so you can invite them.
• Items you send in: when you email or text a link to Wish List, we keep the link and any note with it. We use the sender’s address or number to check the message came from you.
• Thank-you notes you write and send through the app.
• Your agreement: when you confirmed you’re 18 or older and accepted our Terms, and which version of the Terms you accepted.

If someone invited you to a list (invitees)

The list owner gave us your name and your email address or mobile number. If they gave us an email address, we email you a personal link. We never text a number the owner gave us: if they gave only a mobile number, they copy your link and send it to you themselves. When you use your link, we record when you open it and which items you mark as Filled or set back to Open. The list owner can see this activity, and other invitees on the same list can see which items you filled, so you can coordinate. If the owner turned on Surprise mode, the owner doesn’t see who filled what until the list expires.

If you view a public list

Viewing a public list doesn’t require an account, and we don’t record who views it. If you use “Ask if available”, we collect the email address or mobile number you enter and pass it to the list owner with the item you asked about.

Collected automatically

• Sign-in cookie: a cookie that keeps owners signed in. It is required for the app to work.
• Analytics and advertising data: on our other pages, such as the home page, cookies, pixels and similar tools from our analytics and advertising partners collect device and usage information, such as pages visited, links clicked, browser and device type, approximate location from IP address, and the site that referred you.
• Bot protection: on our sign-in and account forms, Vercel BotID checks your browser for signs of automated abuse before we send a message.
• Service logs: our hosting providers keep standard request logs, such as IP address, browser type and the time of a request, to run and secure the service.
• Message records: for each email or text we send, we keep the recipient, the type of message and whether it was delivered.

How we use it

• To sign you in with one-time links, without passwords.
• To show, share and update your lists, and to send the messages you ask for: invites, edit links, “Ask if available” requests, thank-you notes, expiry reminders and confirmations for items you send in.
• To keep the service secure, for example by limiting how many messages can be sent and preventing abuse.
• To honor opt-outs: if you reply STOP or an email bounces, we stop sending to that address or number.
• To measure how Wish List is used and improve it, and to advertise Wish List and measure how well those ads work.

Text messages (SMS)

If you tick the SMS consent box when you sign up with or add a mobile number, you agree to receive texts from Wish List about your account and lists, such as sign-in links, edit links and expiry reminders. The box is never ticked for you, and you can always use email instead.

We never text a mobile number that someone else gave us, such as a number a list owner added for an invitee. Invites and thank-you notes go by email, or the list owner sends the link themselves.

• Message frequency varies with how you use the app.
• Message and data rates may apply.
• Reply STOP to stop receiving texts. After STOP, we send no more texts to that number.
• Reply HELP for help, or email support@wishlistproject.com.
• Carriers aren’t liable for delayed or undelivered messages.
• We don’t sell or share mobile numbers or text-message opt-in information with third parties or affiliates for marketing or promotional purposes.

See the text message terms in our Terms.

Who we share it with

We share information only as described here:

• People you share a list with. A public link shows the list and its items to anyone who has it. An invite link shows the list to that invitee, including who filled each item.
• List owners see their invitees’ activity, as described above, and the contact details of anyone who uses “Ask if available” on their list.
• Service providers who process data for us under contract:
  • Vercel, which hosts the website and app;
  • Supabase, which provides our database and sign-in system;
  • Twilio, which sends and receives text messages;
  • Amazon Web Services, which sends and receives email (Amazon SES) and stores incoming email (Amazon S3).
• Analytics and advertising partners, which receive the device and usage information described above through cookies and pixels on our pages. They may combine it with information they collect elsewhere to show ads for Wish List and measure them. We don’t give them the contents of your lists, your contacts, or your email address or mobile number.
• Legal reasons: when required by law, or to protect the safety, rights or property of our users, the public or us.

None of the above includes mobile numbers or text-message opt-in data and consent. We never share that information with third parties or affiliates for marketing or promotional purposes. Twilio receives mobile numbers only to deliver our texts.

Our service providers may process data in the United States and other countries where they operate.

Links and tokens

Share links, invite links and sign-in links contain long random codes that can’t be guessed. Anyone who has one of these links can use it, so share them only with the people you mean to. Invite links are personal: actions taken through an invite link are recorded under the invitee’s name. Shared list pages ask search engines not to index them. You can create a new share link at any time, and the old one stops working at once.

How long we keep it

• Your account information, lists and contacts are kept until you delete them or close your account.
• When you delete a list, its items, invites and activity are deleted with it, and its links stop working.
• After a list expires, it stays visible to you, read-only, until you delete it.
• Items you send in that you haven’t added to a list are deleted after 90 days.
• To limit how many sign-in links and codes can be requested, we record your IP address and the email or phone the request is for, stored only as one-way hashes and deleted within an hour.
• Message delivery records are kept for 30 days. Opt-out records are kept for as long as needed to honor them.

Your choices and rights

• You can view, edit and delete your lists, items and contacts in the app at any time.
• You can stop texts by replying STOP.
• You can opt out of analytics and advertising cookies by turning on Global Privacy Control in your browser, which we treat as an opt-out, or by emailing us. You can also block or delete cookies in your browser settings.
• You can ask us for a copy of your information, to correct it, or to delete your account and its data, by emailing privacy@wishlistproject.com. Invitees and people who used “Ask if available” can ask us to delete their contact details the same way.

Depending on where you live, you may have more rights under local law, such as the right to object to or restrict how we use your information. We’ll respond to requests as the law requires, and we won’t treat you differently for making one.

California residents: using advertising cookies to show you ads based on your activity can count as “sharing” personal information for cross-context behavioral advertising under California law. You have the right to opt out of that sharing, as described above. We don’t sell personal information for money.

Security

We protect your information with encryption in transit, access controls that let each owner reach only their own data, and providers who maintain their own security programs. No service can promise perfect security, so please tell us right away if you think your account or a link has been misused.

Children

You must be 18 or older to create a Wish List account. We don’t knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, contact us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change materially affects how we use your information, we’ll tell account holders by email or text before it takes effect.

Contact us

Questions about this policy or your information? Email privacy@wishlistproject.com.