Privacy & cookies

Effective from 23/10/2026

Who processes your data

The controller of your personal data is the operator of the Wishetta service ("we"). For anything about data protection, write to us at hello@wishetta.com - we reply within one month at the latest.

What data we process and why

Registered users

• Account - email, name, handle, an optional bio and a hash of your password. We never know the password itself. Purpose: running your account and signing you in. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Without an email address we can't create an account for you; everything else is optional.
• Content - lists, items, notes, product links, comments and who you follow. Purpose: providing the service. Legal basis: performance of a contract.
• Sign-in with Google or Apple (if you use it) - email, name and the account identifier from that provider. With Apple you can hide your real address: we then get a private relay address from Apple that forwards to you. Legal basis: performance of a contract.
• Emails - address confirmation and password reset (performance of a contract) and the notifications you turn on in settings (reminders, price drops and back-in-stock alerts, new followers). You can switch notifications off at any time in your account settings.
• Language - the language you choose, so the website and our emails are in it.

What others can see

You decide who sees each list: only you, anyone with the share link, people you invite by email, your friends, or everyone (a public list can appear in the feed and on your profile). Your profile page shows your name, handle, bio and the lists you have made visible. Comments are visible to people who can see the list. You can hide your profile in your account settings: then only you and your friends see it.

Gift-givers without an account

When you reserve a gift on a shared list, we store the name and optional message you enter, so other gift-givers know the gift is taken care of. The list owner doesn't see reservations. Your browser remembers the reservation (see below) so you can cancel it. Legal basis: our legitimate interest in the service working for gift-givers (Art. 6(1)(f) GDPR). When you put money towards a fund or a charity wish, other gift-givers see only the total and the number of people, never who gave how much.

Reminders for gift-givers

If you ask to be reminded before an event on a shared list, we store your email address and language for that list. Without an account we first send a confirmation link, and nothing else is sent until you confirm. Then you get at most one email per event date, each with an unsubscribe link; when you unsubscribe, we erase the address. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Friends and invitations

When you invite someone to a list or ask them to be your friend by email, we store their email address and send them one email with a link (you can send it again or withdraw it). When they accept, the invitation or friendship is linked to their account. We keep the address with the invitation so you can see whom you invited, and erase it when you withdraw the invitation, end the friendship, or delete the list or your account. Friends see each other's lists marked "My friends"; invited people see only the list they were invited to. Legal basis: our legitimate interest in letting you share lists with people you choose (Art. 6(1)(f) GDPR).

Thank-you notes

When the list owner thanks gift-givers for a received gift, registered gift-givers get the note by email and gift-givers without an account see it on the list. The owner still doesn't learn who reserved the gift. If you reserved a gift with an account, we can also tell you when it is back in stock (if price alerts are on in your settings).

Gift ideas

Products from public lists can appear on our gift-idea pages, anonymously: only the product, its price and how many people wish for it, never your name, profile or list.

Technical data

With every request we process your IP address and technical browser data - for security (abuse protection, limiting login attempts) and troubleshooting. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We delete operational logs within 90 days at the latest.

Links to shops

When you click a product link, we record an anonymous click statistic (which item, from where). Shops only receive our domain name, not the address of your list. Product images are loaded through our server, so shops can't see who is viewing a list. When you add a product by its link, our server loads the shop page itself; the shop doesn't learn who added it.

We don't do any automated decision-making or profiling with legal or similarly significant effects on you.

Cookies and browser storage

We use these strictly necessary cookies, which the service can't work without and which need no consent:

• wl.auth - keeps you signed in (14 days),
• wl.af - protects forms against forgery (session),
• wl.lang - your chosen language (1 year),
• wl.ext - only while signing in with Google or Apple (10 minutes),
• localStorage wl.res - anonymous keys to your gift reservations, so you can cancel them.

Cookies for visit statistics (Matomo) are used only if you allow them in the banner - see Visit statistics below; your choice is kept in localStorage wl.consent. We don't use advertising cookies or third-party cookies. We host our fonts ourselves, so your browser doesn't connect anywhere else for them.

Visit statistics

To see which pages help and where people get stuck, we measure visits and how the site is used with Matomo, an analytics tool that runs on our own server in Germany (EU). The data is not sold and is not shared with advertisers or other companies. If your browser sends Global Privacy Control or Do Not Track, Matomo is not loaded at all.

Without your consent statistics run without cookies: nothing is stored on your device, and visits are grouped by a code our server calculates from your IP address and browser details, which changes every day. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR); you can opt out below.

If you allow cookies in the banner, Matomo also stores cookies that recognise your browser on later visits: _pk_id (13 months), _pk_ses (30 minutes), _pk_ref (6 months) and mtm_cookie_consent, which remembers your consent. When you are signed in, we then also send a pseudonymous code derived from your account (never your name or email), so visits from your phone and your computer count as one person. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the button below.

For each visit Matomo records:

• the pages you view (without the private part of share-link addresses and without one-time codes from emails), how long you stay and how far you scroll;
• what you do on the site, such as creating a list, adding a wish, reserving a gift, sharing a list or sending invitations - never what the list or the wish says;
• clicks on links to shops and other websites;
• the website or search engine that sent you here;
• your IP address and what can be looked up from it: approximate location (country, region and city) and internet provider;
• your browser, operating system, device type, screen size and language, and whether you are signed in;
• page load times and technical errors in the page.

Matomo does not receive your name, email address or what your lists contain. Location is looked up on our own server from a downloaded database; your IP address is not sent to anyone else.

Opt out

The choice is remembered in this browser only (localStorage wl.optout). If you clear site data or use another browser or device, choose it again.

Who we share data with

We don't sell data. To run the service we use processors: hosting and databases in data centres in the EU (Hetzner Online GmbH, Germany/Finland), email delivery (Amazon Web Services EMEA SARL, Frankfurt region) and, if you sign in with Google or Apple, Google Ireland Ltd. or Apple Distribution International Ltd. (Ireland). Error and operational logs are processed on our own servers in the EU. We store your data in the EU. Where a processor's parent company might access it from outside the EU (Amazon, Google, Apple in the USA), the transfer is covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We disclose data to public authorities only when the law requires it.

How long we keep data

For as long as your account exists. Gift-giver reminders are kept until you unsubscribe or the list is deleted. When you delete your account, we remove your personal data (email, name, handle, bio, password, sign-in links, comments and followers) immediately and delete your lists; what remains is no longer linked to you. Gift-givers' reservations belong to the list and disappear with it. Deleted data disappears from database backups when they are overwritten in the regular backup cycle.

Security

All communication is encrypted (HTTPS), passwords are stored only as a salted hash, and access to servers and the database is limited to the people who run the service.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. You can do most of it yourself in your account settings: Download data (an export of everything we hold about you) and Delete account. Otherwise write to us at hello@wishetta.com. You also have the right to lodge a complaint with a data protection supervisory authority - in the Czech Republic the Office for Personal Data Protection (uoou.gov.cz), or the authority in your EU country.

Changes

If we change how we handle data, we'll update this page and the effective date above; we'll tell registered users about material changes in advance by email.