Privacy notice

What Wishpool handles

Wishpool is operated by an independent individual developer in the United States, not a company. Contact: support@wishpool.me.

Wishpool helps families share wishes and coordinate gifts. Wishpool is offered only in the United States. You must be 18 or older and located in the United States to sign in with Google. Google sign-in supplies your verified email address, display name and Google account identifier (sub), used to identify your account and match invitations. Wishpool requests only openid, email and profile permissions. A Google access token is used during sign-in; Google access and refresh tokens are not stored in the application database. Google also processes sign-in information under its own policies.

Stored information includes account and profile identifiers and names, login status and timestamps, managed-profile relationships, list titles, descriptions, occasions and recipients; wishes, notes, optional links, quantities and priorities; invitation addresses, permissions, expiry and revocation details; reservations, purchase status, quantities and shopping notes. Some wishes can include a saved price. Avoid putting sensitive personal information or secrets in names, notes or links.

Wishpool also stores hashed session tokens and their account and expiry information, and hashed profile-claim tokens with their managed-profile identifiers and expiry information. Expiry stops use without guaranteeing immediate record deletion.

Who can see it

People authorized for a list can see its wishes and member names. People who manage invitations can see invitation email addresses. Other members normally see other invitees’ names and their own invitation address; waiting invitees are shown without their email to ordinary members.

Supported recipient views and responses omit reservation and purchase information. Authorized nonrecipient viewers and shoppers can see that information, including shopping notes. A managing adult may shop for a managed profile; viewing as that profile hides its gifts. After the profile gains its own login, managers lose gift-status access on lists created from that point onward; older lists remain available to them. Check whose account and profile is open on shared devices.

Authorized operators and recovery custodians can access stored information to operate, troubleshoot and recover the service. These are application access controls, not end-to-end encryption that prevents operator access. Privileged database access can exceed the supported application views. People can copy or show information they are allowed to see; information already displayed cannot be recalled from a person or screenshot.

Cookies and browser state

Wishpool uses cookies for sign-in, Google sign-in state, a selected managed profile, invitation return paths and short messages. A sign-in cookie lasts up to 14 days; sign-in state and return paths up to 10 minutes; a profile-claim cookie up to seven days; and short message and identity-change cookies up to one minute. The selected-profile cookie is a browser-session cookie.

Some short messages contain a list title or a profile-claim link. Small per-tab and browser-history values help restore navigation and check account changes. Signing out clears the current sign-in cookie, selected profile and short messages, and attempts to end the current session. A pending profile-claim cookie can remain for up to seven days and affect the next Google sign-in on that browser. Signing out does not delete your account or end all sessions on other devices.

Service information and outside services

Wishpool has no ads and does not sell personal data. The current application has no advertising pixels or third-party analytics integration. Servers process request and connection information and operational errors; some error paths may record identifiers or submitted information. Our policy is to keep Wishpool’s own server logs for no longer than 90 days from creation, and to keep support emails that Wishpool holds for no longer than 90 days from receipt. Copies held independently by email providers, senders, recipients or other outside services follow their own policies. These limits do not extend the separate 30-day deadline for a verified account/data deletion request, which runs from receipt of the request, not from verification. The log-content audit and proof of the retention/deletion procedure remain pending; these are adopted policy limits, not a claim that automatic expiry has already been demonstrated.

Amazon Web Services hosts the service and encrypted off-host backups. The application server is recorded in AWS’s US East region; this does not establish that all processing or recovery copies stay in the United States. Operator and recovery geography and applicable provider disclosures are pending confirmation. Google handles authentication.

A free email-forwarding provider and Gmail may process support messages if activated. Forwarding setup and delivery test are pending; this draft does not claim that route is active. Provider details and applicable disclosures remain pending confirmation.

Wishpool does not send invitation emails. You send a sign-in link yourself or use your device’s share sheet; including the invited email in its message is optional. An ordinary invitation sign-in link alone does not grant list access. A managed-profile claim link is different: keep it private, because it helps grant that profile a login. Claim links and the resulting Google login are for adults aged 18+ only; do not send one to a child.

For automatic link previews, Wishpool’s server may retrieve the linked page and its preview image. Some sites, including Amazon, are not retrieved automatically. Our manual account-deletion procedure is to clear the associated preview photos and pending preview records from the live cache; this step has not yet been demonstrated. Daily whole-server snapshots can contain copies of them.

When you choose Upload or paste an image, Wishpool stores a resized copy and removes embedded camera and location metadata. When you paste an image URL or choose Use the store’s photo, Wishpool retrieves the image, and for store photos the linked page, on its server. The store-photo option may retrieve Amazon pages during the family pilot. The chosen image is served from Wishpool; other candidate images are not saved. Store-photo credits link to the store. Chosen pictures are part of account and list data and can be included in backups and whole-server snapshots. Image search is not enabled; Wishpool does not send wish titles to an image-search provider.

Opening a product or search link sends your visit and the linked address or search query to an outside service. Some search links use the wish title. Messages, copied links and screenshots are controlled by their recipients and chosen services.

Retention and deletion

Account and list data currently remain stored until deliberately removed through an appropriate procedure; there is no automatic inactivity-deletion schedule. Removing a wish hides it from normal list views but retains its stored row and related gift records. Expiring or revoking an invitation stops its access without necessarily deleting its record.

No self-service account-deletion feature is currently provided. The policy is to delete an account and its personal data within 30 days of receipt of the request, after identity verification. Request deletion at the contact below; contact forwarding setup and delivery test are pending. The detailed verification and deletion procedure still needs operational proof. Shared lists, managed profiles and gift notes require review; deleting an account does not automatically erase every related note or shared contribution.

Daily local backups retain seven completed daily generations as successful new backups replace older ones; rotation only on success does not establish a 30-day maximum age for those copies. Encrypted off-host backups have a reported 30-day expiry. The backup policy is expiry within 30 days of the creation of each backup; this is a policy commitment, not proof of physical erasure. Actual lifecycle behavior and other retained copies still need confirmation. Daily whole-server snapshots of the application server, held by the hosting provider in the same AWS account, can contain any stored information. The latest seven daily snapshots are kept, normally about seven days; a stopped rotation is treated as a retention incident. Deleted information may remain in older backups; immediate erasure from all copies is not promised.

A procedure to record completed deletions securely off the application host and reapply them before reopening restored data is still pending demonstration. Backup recovery does not establish that this deletion-replay procedure works.

Children, rights and changes

Wishpool is offered only in the United States. You must be 18 or older and located in the United States to sign in with Google. Children may only have parent-managed profiles: no child login, no child email and no information collected directly from children. A parent enters and manages any child’s profile and wishes; use only the information needed for that purpose. Do not enter a child’s email or use a claim link to give a child a login.

This is the intended-use policy, not age verification. The application does not verify age, country or parental authority. Further legal review of child-data handling remains pending.

Applicable rights and request handling depend on the operator and relevant law; those details remain for review. Material changes to a final notice should be dated and communicated through an approved service or contact process.

Contact

For support, feedback, abuse reports, privacy questions, corrections, access or deletion requests, email support@wishpool.me. Forwarding setup and delivery test pending: delivery and monitoring are not yet confirmed. Opening this mailto link does not submit or deliver a request.

Launch support is light. We aim to reply in about 48 hours. This is a response target, not a staffed 24-hour service or a guaranteed response time.

A parent or guardian must make access or deletion requests for a child’s managed profile. These requests require manual checks of the requesting adult’s identity and authority; software does not verify guardian status. Children should not contact us directly. The detailed request-handling procedure remains pending operational proof.

Describe the affected action and approximate time. Avoid sending gift details, invitation or profile-claim links, tokens, or screenshots of other people’s information.