Privacy Policy
Effective date: 2026-05-10 · Last updated: 2026-05-10
Who we are
WishScape is operated by Alexander Grigorov (the "Operator"), an individual developer based in Czech Republic. You can reach us at support@wish-scape.com.
Scope
This policy explains how WishScape (the "App") and the back-end services it talks to handle information about people who download or use the App.
What we collect
Information you give us when you create an account:
•
Email address (required for sign-in via email/password and for receiving sign-up confirmation codes; optional via Sign in with Apple if you choose private relay).
•
Password hash (never the cleartext password — we use Supabase Auth's PBKDF2 hashing).
•
Display name, bio text, birthday, avatar image, locale, timezone, and account privacy preference that you enter on the profile screen.
Content you create inside the App:
•
Wishlists (titles, privacy level, ordering).
•
Wishes (text, optional image, optional link with auto-fetched preview metadata, tags, completion / reservation state).
•
Gift ideas you save for friends.
•
Friend graph data — pending and accepted friendship requests between you and other users.
•
Activity events generated by your actions (reservations, completions, friend events) for the in-app activity feed.
•
Block list and abuse reports you submit through the moderation flow.
Information collected automatically:
•
Authentication tokens (access and refresh tokens) stored on your device only, in the platform secure store (iOS Keychain / Android Keystore). They never leave the device.
•
Crash reports through Sentry — stack traces, device model, OS version, app version. Personally identifiable strings (email, password, authentication tokens, free-form text fields named name, note, content, message, body, title, description) are stripped on the client before they are sent.
•
Product analytics through PostHog — anonymous event names and shape-only properties (e.g. "wish_added" with wish_id and wishlist_id but never with the wish title or body). Strict schemas enforced at the client reject any unknown property, including PII.
•
Authentication identifiers from third parties when you choose to sign in with them (see "Third-party sign-in" below).
What we do not collect:
•
We do not collect your contacts, calendar, photos library outside what you explicitly attach, microphone, camera (the App does not use it), precise location, or advertising identifiers (IDFA / GAID).
How we use the information
•
To provide the core features: creating an account, storing your wishlists, sharing them with friends, sending and accepting friend requests, reserving gift ideas.
•
To send you sign-up confirmation, password-reset, and friend-request emails (transactional).
•
To diagnose crashes and improve reliability.
•
To understand which features are used and where users drop off.
•
To enforce our Terms of Service and respond to abuse reports.
We do not sell your personal information. We do not use it for behavioural advertising. We do not run ads inside the App.
Legal bases (GDPR / UK GDPR)
•
Performance of a contract — for everything required to run the account and the wishlist features.
•
Legitimate interest — for crash reporting and aggregated product analytics, balanced against the opt-out controls described below.
•
Consent — for any feature you must explicitly enable (none in the current version, but reserved for future features).
•
Legal obligation — to retain abuse reports as long as required for moderation review.
Where we send the data
•
Supabase (hosted Postgres + Storage + Auth + Edge Functions). Your account data, content, friend graph, and uploaded images live here. Region: European Union (eu-west-2, London).
•
Sentry (sentry.io) — crash data only. PII is stripped on the client before transmission.
•
PostHog (eu.i.posthog.com — EU instance) — product-analytics events.
•
Apple and Google when you sign in with their respective providers — they receive only the identifiers needed to confirm your identity. Apple's Hide-My-Email private relay is supported.
•
Microlink.io (free tier) — when you paste a URL into a wish, the link is sent to microlink.io to fetch a preview (title, description, image). Only the URL leaves the App; nothing tied to your account is attached.
All third parties listed are bound by their own privacy policies. We have data-processing agreements where required. We do not transfer data outside the European Economic Area beyond what those processors operate themselves.
Third-party sign-in
If you choose Google or Apple sign-in, the provider returns a verified identity token to us. We use it to create or look up your WishScape account; we do not import your contacts, photos, or any other Google / Apple data.
How long we keep the data
•
Account data and content — until you delete your account.
•
Crash reports — Sentry default retention (90 days).
•
Analytics events — PostHog default retention (1 year for events, indefinitely for derived aggregates).
•
Abuse reports — kept as long as required for moderation review and any follow-up enforcement.
Your rights
You can:
•
Access the data we hold about you — request a copy at support@wish-scape.com.
•
Correct profile fields directly from the Edit Profile screen.
•
Delete your account and all associated data from inside the App (Profile → Danger zone → Delete account). The action wipes your wishlists, gift ideas, friendships, blocks, reports, and uploaded images, then removes your authentication record.
•
Object to analytics processing — turn off "Help improve WishScape" in Profile, which puts the analytics SDK into opt-out mode.
•
Port your data — request an export at support@wish-scape.com.
•
Lodge a complaint with your local data-protection authority.
We respond to verified requests within 30 days.
California (CCPA / CPRA)
California residents have the same access, deletion, correction, and opt-out rights described above. We do not "sell" or "share" personal information for cross-context behavioural advertising.
Children
WishScape is intended for users 13 and older (16 in the EU where local law sets the digital-consent age higher). It is not directed at children under that age. If you believe a child has created an account, contact us at the email above and we will delete it.
Changes to this policy
We will update the date at the top of this document and announce material changes through the App or by email. Continued use after the effective date of an update is treated as acceptance of the revised policy.
Contact
Operator
Alexander Grigorov
Email
support@wish-scape.com
© 2026 WishScape — all rights reserved.