Privacy Policy

What we collect

Account information. Your name, your email address, and a password (stored only as a secure hash - we never see or store the password itself). Optionally, your birth month and day. We deliberately do not ask for your birth year.

Signing in with Google. If you choose Continue with Google, Google shares your name, email address, and profile picture with us, and no Wishpile password is created. We use them only to sign you in and set up your account. We never get access to your Gmail, contacts, calendar, or anything else in your Google account.

The content you create. Your gift lists, people, gifts, prices, budgets, notes, wishlists, family groups, Secret Santa draws, and any photos or receipts you attach. That's the product - it's stored so it works.

Product links you paste. When you paste a store link to auto-fill a gift, that URL is fetched on your behalf to pull the item's name, price, and photo.

If you connect an AI assistant. We keep a record that you allowed it (the assistant's name), so it can stay signed in, and we receive the requests it makes for you, such as “add this item” or “show my gift list”. We note which kind of request it was and whether it worked, never its contents, to see how Wishpile is used. We never receive your conversation with it. See AI assistants below.

What we don't collect: we run no advertising, we don't sell your data, and we build no advertising or cross-site tracking profiles about you. We don't collect your contacts, location, your browsing history on other sites, or your chats with AI assistants. We do use privacy-respecting, aggregate analytics to see how Wishpile is used - see Analytics below.

How your data is used

Solely to provide Wishpile: syncing your lists across devices, sharing the wishlists you choose to share, running your Secret Santa draws, answering the AI assistants you connect, and sending the account emails you request (sign-up confirmation, password resets).

We do not sell your data. We do not share it with advertisers. Ever.

Affiliate links

Wishpile is free, but running it isn't - hosting, the service that pulls product details from links you paste, and email delivery all cost money. To help cover those costs, product links to supported retailers (starting with Amazon) are converted into affiliate links. If someone buys through one, we earn a small referral fee.

This never costs you anything extra - the price is the same either way - and it never changes which gifts you see or how they're shown. Any money earned goes back into keeping Wishpile running.

Who can see what

Your gift lists, budgets, and plans are private to your account, enforced by per-user security rules in our database.

Sharing is always your choice. If you share a wishlist link, anyone with that link can view that wishlist (and only that wishlist). In family groups, members see the wishlists shared to the group - never your private lists, budgets, or surprises. When someone claims a gift on your wishlist, the claim is hidden from you by design.

AI assistants

You can connect Wishpile to an AI assistant such as ChatGPT (made by OpenAI) or Claude (made by Anthropic) and ask about your lists in a chat. Connecting is always your choice, and you approve it on a Wishpile page that names the assistant.

What the assistant can see and change. The same things you can in the app, and only when a request needs them: your wishlists and gift lists, the people you're buying for, gifts, prices, budgets, notes, product links and pictures, statuses, and the dates things were added. In your wishlist groups, it sees members' names as the group shows them, their wishlists, and who's getting what on other people's lists, as the group already shows you. It gets a share link or group invite link only when you ask for one or start a group.

What it never gets: your email address or anyone else's, your password, anything about claims on your own wishlists, or who drew whom in a Secret Santa. It can't send anything to anyone; links come back to you to share yourself.

Where it goes. What Wishpile returns to the assistant becomes part of your chat, which the assistant's maker handles under its own privacy policy and your settings there. The assistant works as you, under the same security rules as the app; Wishpile gives it no wider access.

Disconnecting. Remove Wishpile in the assistant's settings at any time, and it can no longer reach your account. Nothing in Wishpile changes when you do.

Where it lives

We use a small number of infrastructure providers to run the service:

• Supabase - database, authentication, and file storage (your account and content), including the account emails for sign-up confirmation and password reset
• Vercel - hosts the website
• Resend - delivers the other emails Wishpile sends: invites you send to other people, and group activity emails and reminders
• Firecrawl - fetches product pages when you paste a store link (it receives only the URL you pasted)
• Google Analytics - measures aggregate usage, never your name or email (see Analytics below)

These providers process data only to run Wishpile - they don't get to use it for their own purposes. AI assistants you connect aren't on this list: they're services you choose to use (see AI assistants above).

Cookies & local storage

We use your browser's local storage for two things: keeping you signed in, and remembering preferences like dark mode. Google Analytics also sets its own cookies to measure repeat visits (see Analytics below) - you can block those with your browser or an ad-blocker and Wishpile keeps working fully. We do no fingerprinting and set no advertising cookies.

Analytics

We use Google Analytics to understand how Wishpile is used in aggregate - which pages people visit and which features get used (for example, that a wishlist was created or a gift was claimed) - so we can see what's working and improve it.

What analytics never sees: your name, your email, the contents of your wishlists, gifts, prices, or notes, who claimed what, or the private links that open a shared or guest wishlist. Those links are keys, so we strip them out before anything is measured. Analytics records only categories and counts - “a wishlist was created” - never the details of it.

When you're signed in, we also give Google Analytics a scrambled account number. It's made with a one-way code from your account, so it can't be turned back into your account, name, or email. It only lets us count you as one person when you use Wishpile on more than one device or browser - for example, signing up on your phone and confirming your email in another app.

If you connect Wishpile to an AI assistant such as ChatGPT or Claude, that use doesn't happen in your browser, so Wishpile's own server tells Google Analytics about it instead: the kind of action (for example, that an item was added), which assistant it came through, and the same scrambled account number. It never includes what you asked the assistant or anything on your lists.

We've configured Google Analytics not to share your data with Google for advertising. In your browser it never runs from anywhere but wishpile.com. If you'd rather not be counted there, any browser's tracking protection or an ad-blocker will opt you out, and the app works exactly the same. Assistant use is counted by our server, so a browser setting doesn't cover it; disconnecting Wishpile from the assistant does.

Your control

You can edit or delete your lists, people, gifts, and wishlists at any time from within the app. To delete your entire account and all associated data, email support@wishpile.com and we'll take care of it.

Children

Wishpile is not directed at children under 13, and we don't knowingly collect personal information from them.

Changes to this policy

If this policy changes, we'll update this page and the effective date above. Material changes will be called out clearly.

Questions

Email support@wishpile.com - a human reads it.