wishlist helps families and friends share wish lists and call dibs on gifts in secret. Helium LLC, a California company, runs wishlist and is responsible for your data. This page says what we keep about you, why, who can see it, and how to delete it. We do not sell your data, and we do not show ads based on what you do here.
What we keep
- Your account: your email address, your name, your sticker colour, and your birthday as a month and day.
- What you make: lists, wishes, notes, links, photo links, prices, groups, and occasions.
- Dibs and purchases: which wishes you called dibs on, and, if you mark a gift bought, the store, the order number, and your note.
- Sign-in: a record of each device you are signed in on, with its browser or app name. If you connect Apple or Google, we keep the account ID they give us and the email address they share. If you add a passkey, we keep its public key and the name of the device that made it; the private key never leaves your device or password manager.
- Email choices: which reminders and summaries you want, and your add-by-email address if you turn it on.
Why we keep it
To run wishlist: to sign you in, show your lists to the people you share them with, keep dibs secret, and send the emails you ask for. We send sign-in codes always. Reminders, change emails, and the weekly digest go only to people who turn them on in Settings.
Who sees what
- People in your groups see your name, your colour, your birthday unless you remove it, and the lists you share with that group.
- If you turn on a list’s link, anyone with the link can see that list.
- The owner of a list never sees who called dibs. After the list’s date, the owner sees what was bought and who bought it, with the order details, unless the buyer turns this off when they mark it bought.
- Your other groups, your email address, and your dibs on other lists stay private.
Links you paste or email
When you paste a product link, or email one to your add-by-email address, our server opens that page to read its name, price, and photo. We only open public web pages. We read an emailed message only to find its link and subject, and we do not keep the message.
The browser extension
The extension reads a page only when you click its button on that page. It reads the page’s name, price, photo, and address there, in your browser, and sends them to us only when you add the wish. It does not see other tabs or your browsing history. It keeps your sign-in in your browser’s storage on that device, until you log out. If the extension cannot read a page, it asks our server to open that page instead, as for a pasted link.
Store links
Some links to stores may be affiliate links. If you buy something after you follow one, the store may pay us a small fee, at no cost to you. The store can see that you came from wishlist and may set its own cookies. Sponsored products are always labelled, and they never appear inside anyone’s list.
Cookies
We use one cookie, which keeps you signed in. It cannot be read by scripts on the page, and it lasts until you sign out or stop using wishlist for 90 days. If a sign-up is turned away because the person is under 13, a second cookie holds only that fact, so the device shows “Ask a grown-up” for 30 days. We do not use advertising or tracking cookies.
Who helps us
Cloudflare hosts wishlist, stores its data, and sends its email. Like any web host, it handles your IP address and basic request details to deliver the service.
How long we keep it
- Your account and what you make stay until you delete them.
- Sign-in codes expire after 10 minutes. A device stays signed in for 90 days after you last use it.
- When you delete your account, we delete your profile, lists, wishes, and sign-ins, and you leave your groups. Dibs you called stay, without your name, so nobody buys the same gift twice.
Your choices
You can change your profile and emails, and delete your account, in Settings. To get a copy of your data, or to ask anything about it, email hello@wishlist.dev.
Children
Children under 13 can’t make their own account. When you make an account, we ask your date of birth once to check this. We keep only the month and day, as your birthday, and never the year. If the answer is under 13, we keep nothing about you, and this device shows “Ask a grown-up” for 30 days.
A parent or guardian can add a kid profile to their own account: a first name and a colour, with no email. The kid uses wishlist on the grown-up’s device, in kid mode, where they can only add and change wishes on their own lists. They can’t see dibs, groups, or other people’s lists, and they see no sponsored products. The grown-up decides who the kid’s lists are shared with, and can delete the profile and its lists at any time in Settings. If you think a child under 13 has their own account, email us and we will delete it.
Changes
When this policy changes, we update it here and change the date at the top. If a change is big, we also email you.