Legal information
Personal data
What the site and the app keep about you, why, for how long, and how to exercise your rights. No advertising, and no commercial tracking added to gift links.
Your account
Your email, your display name, a fingerprint of your password (never the password itself) and the creation date. They are used to sign you in and to show your name to the members of your lists, who never see your email.
Your lists and ideas
Lists, their categories, the “who” labels and the ideas (name, link, image, price, priority) that you and the other members add. Every member of a list sees them.
Reservations
When someone reserves a gift: the name given, the optional note, the date, and the account if they are signed in. The members of the list see these reservations.
How long
Your data stays until you delete your account. A sign-in lasts 30 days, a password-reset link 1 hour. Encrypted server backups are kept for 14 days: deleted data is gone from them at most 14 days later.
Cookies
The site sets cookies: wishlist_session (login, 30 days, httpOnly), NEXT_LOCALE (chosen language, 1 year), a wl_ru_… cookie that remembers a list password for 14 days, and a wl_rc_… cookie that finds reservations made without an account for 90 days. These cookies are not used for advertising.
In the mobile app
The app keeps your sign-in in the phone’s secure storage, and a copy of your lists and of changes not yet sent in its local database. Everything is erased when you sign out or delete your account. The app does not measure audience and asks for no permission.
Providers
The site and the app go through Cloudflare, Inc. (United States), which protects and serves the site: IP addresses, requested pages and exchanges pass through its servers, including outside the European Union.
When email sending is configured, messages (invites, password resets, an address that already has an account) go through Resend. The recipient address and the message content are then sent to that provider.
When a Gemini or OpenAI key is configured, the page behind a gift link can be sent to that service to prefill an idea. Nothing is sent if no key is configured.
When audience measurement is configured, visits to public pages are counted with Umami, on the instance operator’s server. List, login, account, invitation, and password-reset addresses are not sent. This count does not set a cookie. The choice is made in the footer and stays in this browser.
Your rights
You can download your data and delete your account yourself, at the bottom of “My account”, on the site and in the app. For any other request (access, correction, objection): [email protected]. You can also lodge a complaint with the CNIL, the French data protection authority.