Privacy Policy

• You can use Wish Hero without creating an account. A guest account is created for you automatically; it stores what you make in the app, and is deleted after 90 days of inactivity.
• What you put in the app — collections, wishes, reservations, events — is stored in Google Firebase and shown to the people you choose: friends, members of a shared collection, or anyone you send a link to.
• We use Firebase Analytics and crash reports to see what works and what breaks. We do not sell your data and we do not show ads.
• When you add a wish by link, we read the product page and may send parts of it to Google's Gemini model to tidy the title and price.
• Subscriptions are handled by the App Store or Google Play. We never see your card details.
• You can delete your account, and everything it contains, from the app at any time — as a guest too.

Yevhenii Lytvynenko, Ukraine, is the data controller for the Service. Contact: support@wishhero.app. There is no company behind Wish Hero — it is built and run by one person, which is also why replies to your requests come from that address.

Account and profile

On first launch the app signs you in anonymously through Firebase Authentication. This creates a random account identifier and nothing else — no profile document is written until you first save something. If you sign in with email and password, Google or Apple, we receive the identifiers those providers share (an email address, a name where the provider supplies one, and a provider user id) and link them to the same account so your data is kept. Your profile then holds a username, an optional display name, an optional date of birth and an optional photo — all of which you enter yourself.

What you create

• Collections (wish lists) with their title, icon and visibility — *everyone*, *friends only* or *only me* — and shared collections with their members.
• Wishes: title, product link, price and currency, photo, notes, the "must have" flag, and a product category and product identifier (GTIN) when the product page publishes one.
• Reservations of other people's wishes, and fulfilled wishes with an optional thumbs-up/down rating.
• Friendships and friend requests.
• Events — Secret Santa and Group Gift — with their participants, budgets, the wishes you choose to show, votes, and records of who owes whom in a Group Gift.
• Share links you generate, so that a short URL can be resolved back to the thing it points to.

Photos

A profile photo you take or pick is resized to 1200×1200 pixels and stored in Firebase Storage. Wish photos come from the product page; when a shop only serves its picture to its own website, we download a copy and host it ourselves so that the people you share with can see it. Photos are deleted when the wish, or your account, is deleted.

Product pages you add

When you add a wish by link, the app fetches the product page from your device and extracts the title, image, price and shop logo. If the page is hard to read, parts of its HTML together with the URL are sent to Google's Gemini model through Firebase AI to extract or clean up the title, the price and a product category. The page contents are not stored beyond what ends up in your wish. Afterwards the app re-reads the product page from time to time from your device to refresh the price; the shop's servers see your device's IP address for that request, as they would if you opened the page in a browser.

Clipboard

The app reads your clipboard only at the moment you tap "Add Wish", to check whether it holds a product link. It never reads the clipboard in the background.

Device and usage data

• Analytics — screen views and actions (for example that a wish was added by link, or which category a product was placed in) through Firebase Analytics, tied to an installation id rather than your name.
• Crash reports — Firebase Crashlytics collects stack traces and device state when the app crashes.
• Push token — a Firebase Cloud Messaging token for your device, so we can send notifications about friend requests, events and shared collections.
• App integrity — Firebase App Check attests that requests come from a genuine copy of the app: DeviceCheck on iOS, Play Integrity on Android, reCAPTCHA Enterprise on the website.
• Remote configuration — the app downloads settings (for example the minimum supported version) from Firebase Remote Config.
• Support emails — when you use "Contact Us" in Settings, the draft is prefilled with the app version, your OS version and your account id, so we can find your account. You can remove any of it before sending.

Notifications and reminders

Push notifications are sent through Firebase Cloud Messaging for friend requests, event updates and changes in shared collections. Birthday reminders are local: the app reads your friends' dates of birth and schedules a reminder on your device for 9:00 on each birthday. You can turn them off in Settings.

Subscriptions

Wish Hero Pro is sold through the App Store and Google Play. We receive a transaction identifier (Apple) or a hashed purchase token (Google) and record which Wish Hero account owns the subscription, so it follows your account across devices. Payment details never reach us. Purchases are validated through RevenueCat, which checks the receipt with Apple or Google and tells the app whether your subscription is active; it receives your Wish Hero account identifier, the product you bought and its status — never your payment details.

The website

https://wishhero.app shows shared collections and wishes to anyone who opens a link. It uses Google reCAPTCHA Enterprise to protect against abuse, stores your light/dark theme preference in your browser, and is hosted on Google Cloud, whose servers keep ordinary access logs (IP address, browser, time). The website sets no advertising or tracking cookies.

• To run the Service: store your collections and wishes, sync them across your devices, show them to the people you choose, and coordinate reservations and events.
• To send the notifications you would expect from a social app, and the reminders you turned on.
• To keep prices current and to read product pages you add.
• To bind a Pro subscription to your account and restore it on another device.
• To keep the Service secure and free of abuse (App Check, rate limits on requests such as "ask to share").
• To understand which features are used and to fix crashes.
• To answer your support requests.

We do not sell personal data, we do not use it for advertising, and we do not combine it with data from other sources.

Where the GDPR or a similar law applies to you, we rely on: performance of a contract (providing the Service you asked for), legitimate interests (security, abuse prevention, analytics and crash reporting, all of which you can object to), consent (notifications, camera and photo library access, birthday reminders — each revocable in your device or app settings), and legal obligations where we have them.

• Your username, display name and photo are visible to other users of Wish Hero — in search results (registered accounts only; guests are never listed), on your friends' screens, in events you take part in and on things you share.
• A collection marked everyone is visible to anyone who finds your profile, including on the website. Friends only is visible to accepted friends. Only me is visible to you — unless you share a link to it.
• Share links work at any visibility. Anyone who has the link can open the collection or wish it points to, in the app or on the website. A link to a single wish reveals only that wish, not its collection.
• When someone reserves a wish on a personal collection, you as the owner are deliberately not told — that is the surprise. On a shared collection, reservations are visible to all members, with the member's name.
• In a Secret Santa, who drew whom is private to each participant. In a Group Gift, the recipient learns about the event only if the organizer chooses to notify them; members see each other's names, votes and payment status.
• Your friends' devices read your date of birth (if you set one) to schedule a birthday reminder.
• Some of your details are copied into other users' records for speed — for example your name and photo next to a friendship or an event participant, or a snapshot of a wish someone reserved. These copies are updated when you change your profile.

We use the following providers, who process data on our behalf under their own terms:

• Google Firebase / Google Cloud — authentication, database (Firestore), file storage, Cloud Functions, push notifications, Analytics, Crashlytics, Remote Config, App Check, Firebase AI (Gemini) and website hosting. Google Privacy Policy.
• Google reCAPTCHA Enterprise — abuse protection on the website.
• RevenueCat — subscription validation and status. Receives your Wish Hero account identifier and what you subscribed to, and is based in the United States. RevenueCat Privacy Policy.
• Apple — Sign in with Apple, the App Store and App Store subscriptions, DeviceCheck.
• Google — Google Sign-In, Google Play and Play subscriptions, Play Integrity.
• Online shops you link wishes from — your device requests their pages directly.

Data is stored in Google Cloud data centres, which may be outside your country, including in the United States. Google provides contractual protections (such as the EU Standard Contractual Clauses) for such transfers.

• Your account and its contents are kept until you delete them.
• Guest accounts that have not been used for 90 days are deleted automatically, together with everything they contain.
• Reservations made by a guest expire after 7 days; reservations made in the App Clip after 24 hours.
• Photos in Firebase Storage are deleted when nothing references them any more.
• Analytics and crash data are retained according to Firebase's retention settings, by default for up to 14 months.
• Records that other users created about their own activity — for example a friend's gift history noting a gift they bought for you, or an event they organized — belong to their account and may remain there after you leave.

Open Settings → Account → Delete Account in the app. This works for guests as well. Deleting your account removes your profile, collections, wishes, reservations, gift history, photos and share links. Deleting your account does not cancel a store subscription — cancel it in the App Store or Google Play. Full details are on the Delete Your Account page.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict processing, and to withdraw consent. Most of this you can do yourself in the app: edit your profile, change a collection's visibility, turn notifications off, or delete your account. For anything else, email support@wishhero.app from the address linked to your account (or include your username) and we will respond within 30 days.

You can also complain to a supervisory authority — in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, your national data protection authority.

Wish Hero is not intended for children under 16. We do not knowingly collect data from anyone younger. If you believe a child has created an account, write to support@wishhero.app and we will delete it.

Data travels over TLS and is stored in Firebase behind security rules that limit each user to the documents they are allowed to read and write. App Check limits access to genuine copies of the app. Sensitive fields, such as who drew whom in a Secret Santa, are readable only by the person concerned. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

When we change this policy we update the date at the top. If a change materially affects how your data is used, we will also tell you in the app before it takes effect.

Yevhenii Lytvynenko · Ukraine · support@wishhero.app