Privacy Policy

1. Introduction

Wishing Well ("we", "us", "our") is a gift planning and event tracking application. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our service.

2. Information We Collect

We collect the following information that you provide directly:

• Account information: your name, email address, and password (hashed, never stored in plain text)
• Contact information: names, relationships, birthdays, and other details of people you add to your contact list
• Events: dates, types, and descriptions of events you create (birthdays, anniversaries, holidays, etc.)
• Gift ideas: gift names, descriptions, prices, URLs, and purchase status
• Wishlist items: items you or your contacts add to wishlists, including preferences and notes

If you sign in with Google OAuth, we receive your name, email address, and profile picture from Google. We do not access your Google contacts, calendar, or any other Google data.

3. How We Use Your Information

We use your information to:

• Provide the Wishing Well service, including gift tracking, event reminders, and contact management
• Authenticate your identity and secure your account
• Send event reminders and notifications you have opted into
• Improve the service based on usage patterns (in aggregate, not individually)

We do not sell your personal information. We do not use your data for advertising. We do not share your contact or gift data with other users unless you explicitly share it (e.g., via a wishlist sharing link).

4. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Fly.io infrastructure in the United States. Data is encrypted in transit using TLS. Passwords are hashed using bcrypt before storage. We use HTTP-only, secure session cookies to maintain your login state.

5. Third-Party Services

We use the following third-party services:

• Sentry for error monitoring and performance tracking. Sentry may receive error reports that include technical information about your browser and session, but not your gift or contact data.
• Google OAuth (optional) for sign-in. If you choose to sign in with Google, Google's privacy policy applies to the authentication process.
• Fly.io for application and database hosting.

We do not use any analytics, advertising, or tracking services.

6. Cookies

We use a single HTTP-only JWT session cookie to keep you signed in. This cookie is essential for the service to function and cannot be opted out of while using the app. We do not use tracking cookies, advertising cookies, or any third-party cookies.

7. Your Rights

You have the right to:

• Export your data: download all your contacts, events, and gift ideas as a JSON file from Settings > Privacy & Security
• Delete your account: permanently delete your account and all associated data from Settings > Privacy & Security. This action is irreversible and cascade-deletes all your contacts, events, gift ideas, wishlists, and notifications.
• Update your information: edit your profile, contacts, events, and gift ideas at any time through the app

8. Data Retention

We retain your data for as long as your account is active. When you delete your account, all your data is permanently removed from our databases. We do not keep backups of deleted account data.

9. Children's Privacy

Wishing Well is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or via email. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, contact us at support@wishingwell.app.