Privacy

Who is responsible

Wishpin runs this service and is responsible for your data.

Contact: abuse@wishp.in

Account data

When you sign in, we store your email address and your name. Sign-in uses Firebase Authentication from Google.

You can use Google sign-in. You can use an email link.

Lists, wishes and bookings

We store your lists, wishes and bookings in Google Cloud Firestore. The data is in the EU (europe-west1).

AI checks and suggestions

Google Gemini processes the text of public lists, the public profiles (name, handle, bio and links), the text of reports and your AI requests. Google processes this text, and the processing can happen outside the EU.

Messages about public lists

When you write to the owner of a public list, we store your messages, the name that you type for the conversation, and the wish that you name. The owner sees this name and the messages. The owner does not see your email address, and you do not see the owner's. We delete a conversation when the owner deletes the list.

Google Gemini checks each message for harassment, threats, scams and spam before the other person sees it. When you report a conversation, the operator of Wishpin reads the messages of the other person.

Reports

An anonymous report stores a one-way code made from the IP address. It does not store the IP address.

Cookies

The service sets only the cookies that it needs to work. None of them is for statistics.

• wp_session: keeps you signed in. It lasts 14 days.
• wp_lang: remembers your language. It lasts about 13 months.
• wp_country: remembers your shopping country. It lasts about 13 months.
• wp_guest: tells your bookings apart when you do not sign in. It lasts about 13 months.
• wp_gname: remembers the name that you gave for a booking. It lasts about 13 months.

Local storage is not a cookie, but it is also on your device. Sign-in keeps its state in the local storage of the browser. The email-link sign-in also keeps your email address and your name there. The sign-in page removes these two items after a successful sign-in.

Statistics

We count visits to learn how the service is used and to give owners counts for their own lists. For statistics, we set no cookie and we use no local storage.

The server makes a code for each visitor each day from the IP address and the browser. It uses a secret key for this. The server deletes the key after 2 days. After that, nobody can link the code to you or to your codes of other days.

What we store for each event: the name of the event, the time, the page pattern, the list id when the event has one, the daily code, whether you are signed in (yes or no), the language, the device class, the browser family, the domain of the referring site, the country (from Cloudflare, when Cloudflare is in front of the service), and small fixed details, for example the sign-in method or the source of a wish.

What we do not store: the IP address, the full browser string, your email address, your user id, the full address of the page, and the content of forms.

We delete the single events after 90 days. We keep the daily totals. They hold no visitor code.

The legal basis is our legitimate interest (Article 6(1)(f) GDPR): to run and improve the service, and to give owners counts for their own lists.

If your browser sends Sec-GPC or DNT, we do not count you.

Owners see only counts for their own lists.

Your rights

You can ask for access to your data, for a correction, or for deletion. You can object to the processing. You can complain to a supervisory authority. To use your rights, write to abuse@wishp.in. You can delete your account yourself on the account page. The deletion removes your lists, wishes, bookings, conversations and public profile at once. Reports that you sent, and a conversation with an open report, stay until the operator decides on them, without a link to your account.