Privacy Policy

Wishly is a wishlist app. You keep a list of things you would like, the people you choose can see it, and they can buy something from it for you.

This page explains what we store, why, who else gets to see it, and what you can do about each of those.

What you type in: your name, username and email address, an optional phone number, your birthday if you give one, a picture if you upload one, and the wishes on your list — their title, description, link, price, image, and whether each one is still available, reserved or bought. Feedback you send us is stored with it.

The phone number is contact information only. We do not send SMS, and we do not sign anyone in with a phone number.

Your preferences: language, light or dark theme, whether you have finished the first-run tour, whether you want birthday reminders, and whether you have turned product news off. These live on your account so they follow you to any device you sign in on.

Signing in: we email you a one-time code. If you choose to sign in with Google instead, Google tells us the email address of the account you picked; what Google does with your visit is covered by Google's own policy, not this one.

Who you follow, who follows you, and follow requests that are still pending.

When you sign in, we ask once whether we may send a snapshot of the device you are using. If you say no, nothing is sent, then or later. You can change your mind either way in Settings, under Share data to improve wishly.

If you allow it, this is what is sent from your browser:

• screen size, time zone, and the platform you are on
• how many processor cores and how much memory the device reports
• whether you prefer dark mode

And this is what our server records alongside it, because it is part of any request a browser makes: your IP address and the approximate location it implies, your browser and its language setting, the page that sent you, and the security version of the connection.

We use it for three things: keeping accounts secure, working out what went wrong when something breaks, and making the product better for you over time — including letting AI offer you services shaped around how you actually use wishly. Our operators can read it for your account.

When you open someone's profile, we record that you visited it — one entry per person, with a running count and the time you last looked.

• Every profile owner can see how many different people have visited.
• Owners with Premium can see who, for up to the 100 most recent visitors.
• Premium users can browse anonymously, which keeps them out of that list.

When you buy something — for yourself or as a gift — we store the order, what was bought, the price, who it is for, and whether payment succeeded.

Your card details never reach us. Payment happens on the payment provider's own page; we receive the outcome and a reference number, nothing else.

If the gift is for another Wishly user, we store who the recipient is so the order can say where it went. If you typed a phone number or an email address instead, we store what you typed, and we use it to deliver that gift.

• No advertising. We run no ad network and we sell nothing about you.
• No analytics or tracking. There is no analytics product, no session recorder, no error-reporting service and no tracking pixel in the app.
• No background collection. Apart from the device snapshot above, nothing leaves your browser unless you did something that asks it to — opened a page, submitted a form, uploaded a file, placed an order.

If that ever changes, this section changes with it, and we will say so before it does.

Essential email — sign-in codes, purchase receipts, and notices about a gift. These are part of using the service and cannot be turned off while you have an account.

Product news — occasional emails about new features. Every one has a one-click unsubscribe link in its footer, and you can also turn it off in Settings, under Notifications.

• The payment provider, when you pay — so that you can pay.
• The partner fulfilling your order, with what they need to deliver it.
• Google, only if you choose to sign in with Google.
• Our hosting and email providers, who handle data on our instructions in order to run the service.

Two more are worth naming, because they are easy to miss: the trust badge in our footer is an image loaded from Enamad's own servers, and the Persian typeface is loaded from a public font service. Opening any page that uses them tells those two your IP address and browser — even if you are not signed in.

We do not sell your information, and we do not share it for anyone else's advertising. We may disclose it if the law requires it, and we will tell you when we are allowed to.

• A cookie that keeps you signed in. Without it the app cannot know it is you. It is removed when you sign out.
• Your device-info choice, stored on the device rather than on your account, so the question is asked once per browser.
• Small conveniences: whether you dismissed the install prompt, and where to send you back after signing in.

No advertising or analytics cookies. Nothing we store follows you to other sites.

Your account and its content stay while your account does. Deactivating hides the account and signing in again restores it. Deleting removes it, and that is not reversible from your side.

Orders and payment records outlive the account, because they have to. Exact periods arrive with the final version of this page.

Correct your name, username, email, phone or birthday

Settings → Edit profile

Choose who can see your list

your profile's visibility setting

Browse without appearing in visitor lists

Settings → Premium (Premium only)

Stop sending device info

Settings → Share data to improve wishly

Stop product-news email

the link in any such email, or Settings → Notifications

Take a break

Settings → Account → Deactivate

Leave for good

Settings → Account → Delete account