Privacy policy

Who we are

Wiish is run by Agentic s.r.o., Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic, company ID (IČO) 29541921 ("we"). We decide why and how your data is processed. Write to us about anything in this policy at privacy@wiish.app.

What we keep

• Account owners: your e-mail, the name and account name you choose, an optional photo, your color and language, your wishlists and wishes, and the dates you want to be reminded of. If you sign in with Google or Apple, also the ID they give us for you – not your picture and no access to your Google or Apple account.
• Guests who reserve a gift: the name you enter, your PIN (only as a one-way hash), and an e-mail address if you give one, plus what you reserved.
• Everyone: for sign-in security and to stop abuse, the IP address and browser of a sign-in session, and short-lived counters of requests.

Why

We use the data only to run the service you asked for: to show your lists, let friends reserve gifts without spoiling the surprise, send sign-in codes and the reminders you set, and keep the service safe. The legal basis is the contract with you (GDPR art. 6(1)(b)) and, for security, our legitimate interest (art. 6(1)(f)). We don't sell data or show ads, and we measure visits only with your consent.

Who sees it

• Anyone with the link to a list sees the list, its wishes and your public name. A list owner never sees who reserved a gift.
• Our processors: Cloudflare (hosting, database, pictures), Resend (e-mails) and Sentry (error reports, without your personal data). They process data only on our behalf.

How long

We keep account data until you delete the account. A guest's data stays while they have an active reservation; Once they have none and no browser remembers them any more, it is deleted automatically 2 years after their last reservation or cancellation (or after they first came, if they never reserved). You can delete it yourself sooner on any wishlist you reserved on ("Delete my data"). Encrypted backups are kept for 30 days, so deleted data disappears from them within 30 days too.

Your rights

You can see, correct, download and delete your data. Account owners do this themselves in their profile ("Download my data", "Delete account"), guests on the wishlist they reserved on ("Delete my data"). For anything else, write to privacy@wiish.app. You can also complain to the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz) or to the data protection authority in your country.

Measuring visits (Google Analytics)

Only if you accept cookies, we count visits with Google Analytics 4 by Google Ireland Ltd. to see which pages are used and what to improve. Google gets the kind of page (for example “a shared wishlist”), your browser and device, the country and the website you came from – never your lists, wishes, names, e-mail or the links to your lists. Google doesn't store your full IP address, and the data is deleted after 2 months. Google may process it in the USA under the EU–US Data Privacy Framework. The legal basis is your consent (GDPR art. 6(1)(a)); you can withdraw it any time under “Cookie settings” at the bottom of every page, and we then remove Google's cookies.

Cookies

Wiish uses the cookies it needs to work. Only if you accept, it also uses Google Analytics cookies to count visits; until then Google's script isn't loaded at all. You can change your answer any time under “Cookie settings” at the bottom of every page.