1. Introduction
Wishmark ("we", "us") is a gift planning app. This policy covers what personal information we collect, how we use it, and how you can control it.
2. Information we collect
Directly from you:
- Account: name, email, and password (hashed, never stored in plain text)
- People: names, relationships, birthdays, and other details you add
- Dates: the day, what it is, and descriptions
- Gift ideas: names, descriptions, prices, URLs, and purchase status
- Wishlist items: items and notes from you or the people you add
Signing in with Google gets us your name, email, and profile picture — nothing else from your Google account.
As you use the app, our own analytics records:
- Pages viewed: the page address with anything personal removed, how long the page stays open and how far you scroll. We drop search words, and the private part of share and ask links.
- Actions: that something happened, such as signing up, adding a person, sending or answering an ask, sharing a list, or tapping a shop link. We also note when you use a form (which form, never what you typed) and when you tap the same spot over and over, which tells us something is not working. For a shop link we keep only the store's website name, never the full link.
- Device basics: browser, system and screen size, and how quickly pages load. Your IP address is not kept.
When you are signed in, these are tied to your account number only, never your name or email. We never record what you save or what anyone answers.
3. How we use it
To run the service, authenticate you, send reminders you have opted into, and improve the service using aggregate usage data.
We do not sell your information, use it for advertising, or share the people or gifts you save with other users unless you explicitly share it — for example, via a wishlist link.
4. Storage, security and service providers
Your data is stored in the United States and encrypted in transit. Passwords are stored only as irreversible hashes.
We use a few service providers to run Wishmark. They handle your data only to do their job for us:
- Amazon Web Services (AWS): hosts our servers, database, and backups.
- Amazon SES: sends our email, such as confirmation emails, reminders, and messages asking someone what they want. It handles the name and email address of whoever gets the email, and the message.
- Sentry: error monitoring (technical and browser data only, never the people or gifts you save).
- Google OAuth: optional sign-in.
Our analytics runs on our own server, so the numbers above go to no outside company. It sets no cookies and stores nothing in your browser, and the tracking in your browser stays off if it sends Do Not Track.
We do not use advertising or ad tracking services, and we never sell or share this data.
5. People who are not users
Some of the information we hold is about people who have not signed up. This happens in three ways:
- People a user adds: the user may enter a name, email address, birthday, and other details about someone they buy gifts for.
- Answers to their link: we email the person a link asking what they would like. If they answer, we store what they enter. That can include their name, email, phone, address, sizes, foods they can’t have, allergies, and gift wishes.
- Buying from a shared wishlist: if someone taps “I’ll get this” on an item, we store the name and email address they give.
We use this information only to run the gift planning the user asked for. We do not use it for marketing, and we do not create an account for the person.
If you are in this group and want your information removed, email us at support@getwishmark.com. Tell us the email address or name involved and we will delete it. Backup copies are erased on the schedule in the Data Retention section. Answering their link is always optional.
6. Cookies
A few essential cookies keep you signed in and protect your sign-in. They are needed for the service and cannot be turned off while you are using the app. Our analytics sets no cookies. See our Cookie policy for details.
7. Your rights
Export your data as JSON, update your information, or delete your account — all from Settings > Privacy and security. We recommend exporting your data before you delete, since it cannot be recovered afterward.
8. Data retention
We keep your data while your account is active. Requesting account deletion starts a 30-day grace period: your data is kept, and your account stays usable, until the 30 days elapse. You can cancel the deletion at any time during this window from Settings > Privacy and security, and nothing is lost. We email you when the deletion is scheduled, with the date it will take effect. Once the grace period ends, your account and everything tied to it — people, dates, gift ideas, wishlists, and notifications — is permanently deleted and cannot be recovered. We take routine encrypted backups for disaster recovery, so a copy may persist there for up to 90 days after permanent deletion before it is automatically erased.
9. Children's privacy
Wishmark is not intended for children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided it, and we will delete it.
10. If our business changes
If Wishmark is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that deal. We will tell you through the app or by email before it becomes subject to a different privacy policy.
11. Changes to this policy
We will notify you through the app or by email of material changes. Continued use after that means you accept the update.
12. Contact us
Questions about this privacy policy or your data? Email support@getwishmark.com.