Last updated: September 22, 2026
This policy explains what personal information we collect when you use our wishlist service, why we collect it, how long we keep it and what control you have over it. It applies to both of our websites, which are two language versions of the same service operated by the same publisher.
Our service lets you create gift wishlists and share them with your friends and family. It is published under two brands, for two audiences:
Both websites are operated by the same publisher, share the same database and are covered by this single policy. The publisher is the data controller for the personal information described here and can be reached at contact@wishlisto.com.
We collect the following categories of information.
- Account information — your email address, first and last name, and, if you choose to provide them, your postal address, city, postal code and country. We also store your language, your time zone and, when you sign in with a password, a cryptographic hash of that password (we never store the password itself).
- Profile picture — the photo you upload, or the picture we import once from your sign-in provider when you create your account.
- Content you create — your wishlists, the gift recipients you add, the gifts on your lists (names, descriptions, prices, photos, links to online stores) and the events you associate with a list.
- Relationships — the friend requests you send and accept, and the email addresses of people you invite to the service.
- Gift reservations — when someone reserves a gift on a wishlist, we record the name, the email address and the optional message they provide, so the list owner can be notified. Reserving a gift does not require an account.
- Notification preferences — whether you have opted in or out of each category of email, and, if you enable push notifications, the technical subscription your browser gives us so we can deliver them.
- Technical information — your IP address, your browser type and the pages you visit. We use your IP address once at sign-up to pre-select your country, and otherwise only for security, abuse prevention and diagnosing errors.
Signing in with Google is optional: you can always create an account with an email address and a password instead. This section describes, specifically and exhaustively, how our app accesses, uses, stores and shares Google user data.
Limited Use disclosure. Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
When you choose 'Sign in with Google', we send you to Google's own sign-in page and request three standard scopes: openid, email, profile. Google then returns a signed identity token to us. Your Google password is never seen by us.
From that token we read only the following fields:
- Your Google account identifier — the unique, non-reusable number Google assigns to your account (the 'sub' claim).
- Your email address — the address associated with your Google account.
- Your first and last name — as they appear on your Google profile.
- The address of your Google profile picture — a link to the photo on your Google profile.
We request no other Google scope and access no other Google data. We never access your Gmail messages, your Google Contacts, your Google Drive files, your Calendar, your YouTube activity or your location history.
- The Google account identifier links your Google account to your account on our service, so that we can recognise you the next time you sign in.
- Your email address identifies your account, lets you recover access to it and is the address we send service notifications to. If an account with that address already exists, we ask for its password before linking the two.
- Your first and last name pre-fill the registration form and become your display name, so your friends can find your wishlists. You can change them at any time.
- Your profile picture becomes your avatar on the service, so your friends can recognise you.
We use Google user data for no other purpose than creating and operating your account. In particular, we do not use it for advertising or ad targeting, we do not sell it, we do not use it to build profiles for third parties, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models. No human reads your Google user data, except with your explicit consent, to investigate a security incident or abuse, or where the law requires it.
- The Google account identifier is stored in our database next to your account, for as long as your account exists and the Google sign-in stays linked to it.
- Your email address and your first and last name are stored as part of your account profile, like they would be for any other account.
- Your profile picture is downloaded once, at the moment you create your account, and stored on our own servers. We do not keep a live link to Google, and later changes to your Google photo are not reflected on our service.
- We do not store Google access tokens or refresh tokens. We do not request offline access. The identity token Google returns is verified once and then discarded; we cannot call Google on your behalf afterwards.
We do not transfer Google user data to anyone, other than to the service providers that host and operate our infrastructure on our behalf and under contract (see the section on sharing below), when the law or a valid legal request requires it, or with your explicit consent. We never sell Google user data.
You can disconnect our app from your Google account at any time from your Google account permissions page. Doing so stops any future sign-in with Google, but does not by itself delete the information we already hold: to delete it, delete your account from your account settings, which erases your Google account identifier, your email address, your name and your profile picture from our database.
We offer the same kind of sign-in with Amazon, and the same rules apply: we receive only an account identifier and, where the provider supplies them, an email address, a name and a profile picture. We use them solely to create and identify your account, we store no access or refresh token, and we request no permission to read anything else from your account with that provider.
We use the information described above for the following purposes, on the following legal bases.
- Providing the service — creating your account, authenticating you, storing your wishlists and showing them to the people you share them with. This is necessary to perform the contract between us.
- Service notifications — telling you when a gift on your list has been reserved, when someone sends you a friend request, or when your account is about to be deleted for inactivity. This is necessary to perform the contract between us.
- Optional emails — occasional reminders and news about the service, which we only send on the basis of your consent and which you can turn off at any time from your email preferences or from the link at the bottom of every such email.
- Keeping the service working and safe — measuring audience, diagnosing errors, preventing spam and abuse. This is in our legitimate interest in running a reliable service.
- Affiliate revenue — our service is free; we earn a commission when someone buys a gift after following a link from a wishlist to a partner store. This is in our legitimate interest in funding the service, and it does not involve sending your personal information to those stores.
We never sell your personal information. We share it only in the following situations, and only to the extent needed.
- With the people you choose — a wishlist you publish is visible to whoever you share its link with, and, depending on the visibility you choose for it, may appear in our search results with the name and picture of the person it is for. You control that setting on each list.
- Hosting — our servers and database are operated on our behalf by our hosting provider, within the European Union.
- Email delivery — we use Mailgun to deliver our emails, which means the recipient address and the content of the message pass through their systems.
- Error monitoring — we use Sentry to be told when something breaks. Error reports can contain your account identifier, your IP address and the page you were on.
- Audience measurement — we use Google Analytics to understand how the service is used, as described in the section on cookies.
- Push notifications — if you enable them, notifications are delivered through the push service your browser vendor operates, such as Google, Mozilla or Apple.
- Legal reasons — where we are required to by law, or where it is necessary to protect our rights, our users or the public.
When you add a gift by pasting a link, our servers visit that page to read the product's name, price and photo. We do not send any of your personal information to the store when we do so.
- Essential cookies — we set a session cookie to keep you signed in and a token to protect forms against cross-site request forgery. The service cannot work without them.
- Audience measurement — Google Analytics sets cookies to produce aggregated statistics about how many people visit the service and which pages they use. We do not use them for advertising.
- Local storage — we remember your preferred language in your browser's local storage, so we stop asking you about it.
Partner stores you reach by following a link from a wishlist set their own cookies, under their own privacy policies, which we do not control.
You can block or delete cookies in your browser settings; if you block the essential ones, you will not be able to sign in.
- We keep your account and its content for as long as your account is open.
- If you do not use your account for three years, we delete it, together with your wishlists, your gifts and your profile picture. We email you a warning before we do.
- If you delete your account yourself, we delete that information immediately.
- Gifts that no longer belong to any wishlist are deleted after three months.
- Error reports and audience statistics are kept for a limited period by the providers named above, and contain no wishlist content.
All traffic between your browser and our servers is encrypted with HTTPS. Passwords are never stored in readable form: we keep only an Argon2 hash of them. Access to our production database is restricted to the publisher. No system is perfectly secure, but if a breach ever affects your personal information, we will notify you and the competent authority as the law requires.
Under the General Data Protection Regulation and equivalent laws, you have the right to access your personal information, to have it corrected, to have it erased, to receive a copy of it in a portable format, to restrict or object to how we use it, and to withdraw a consent you have given us at any time.
- Most of these you can exercise yourself: your account settings let you read and correct everything we hold about you, and delete your account outright.
- Your email preferences let you turn off any category of message.
- For anything else, write to us at contact@wishlisto.com and we will answer within one month.
If you believe we have mishandled your personal information, you also have the right to complain to your national data protection authority — in France, the CNIL.
The service is not intended for children under 15, and we do not knowingly collect their personal information. A parent can create a wishlist for a child, in which case only the child's first name and, optionally, a photo chosen by the parent are stored, under the parent's own account. If you believe a child has created an account, write to us and we will delete it.
Our servers and our database are located in the European Union. Some of the providers listed above are established in the United States; where personal information reaches them, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision.
We update this policy whenever the way we handle your personal information changes, and the date at the top always tells you when it was last revised. If a change affects how we use the data we receive from Google Sign-In, or is otherwise significant, we will tell you by email or through a notice in the service before it takes effect.
For any question about this policy or about your personal information, write to us at contact@wishlisto.com.
Contact us
