What WISHAWAY stores
Account: email address, account ID and authentication information managed through Supabase Auth.
Profile: display name, username, birthday day/month, optional profile photo/colour, location, job, interests and About details if you add them.
Private account details: full birthday, optional phone number, phone-verification state and find-by settings.
Wishes: wish names, prices, shop, size, colour, description, product links, images, wishlist and timestamps.
Social & gifting: friendships, groups, group designs, claims/purchase state, notifications and a per-wish count of unique friends who have viewed a wish.
Messages: conversation membership, message text, sender and timestamps, last-read state, mute choices and inbox visibility. Messages are stored on our backend and are not end-to-end encrypted. Hiding a conversation removes it from your inbox; it does not delete everyone’s messages.
Calendar and Secret Santa: event titles, dates, optional times and notes, exchange settings, participants, exclusions, assignments, reveal/progress state and optional cover designs.
iPhone push notifications, if enabled: Apple device tokens, a random installation identifier, your account/session link, notification preferences and delivery status. These enable delivery to your signed-in device. Push payloads contain a notification identifier and generic alert text, not private message bodies or claimed-wish identities. You can turn push off or change categories in Settings → Notifications, and manage system permission in iPhone Settings.
Support: support messages plus app version, browser/device user agent, platform, language, screen size and timezone when you submit a support request.
Retention & your choices
Account data is kept while your account is active unless it needs to be kept longer for security, legal or dispute purposes. Deleted wishes and their associated view records are removed from the active database. Support requests are kept while needed to provide support and maintain a reasonable support history.
You can ask for access, correction, deletion, restriction or a portable copy of your personal data where the relevant UK data-protection right applies.