Privacy information

Early-access draft. This is a summary of the product's current privacy approach, not a final reviewed privacy policy. We will publish complete operator and contact details before public launch.

What you share

Creating or using a Wish Room may involve a room title, occasion, recipient name, organiser account email, contributor name, written wishes, photos, videos, voice messages and payment-related references.

Who sees contributions?

Invitation links allow guests to submit wishes. In surprise mode, organisers see contributor names and counts, but the content of messages and attachments remains hidden in organiser management and preview views. In review mode, organisers can view submitted contributions. After a room is revealed, anyone holding its recipient gift link can see the visible contributions. Please share private links carefully.

How information is handled

Room data and private media are hosted using Supabase infrastructure. Website hosting uses Vercel. Payment checkout is provided by Stripe; card details are entered with Stripe, not directly into the Wish Room website. We currently use Stripe test mode only.

Reporting and moderation

Recipients may report contributions. Reported contributions are hidden pending organiser review. Organisers can hide or restore submissions. These controls do not guarantee that a previously viewed or copied contribution can be erased from someone's device.

Security and access

We use private room links, organiser access controls and time-limited links to media. Do not post confidential or sensitive details unless you are comfortable sharing them with the intended recipient and people who have access to the relevant room link.

Viewing periods and retention

New rooms have 30 days of online viewing after the gift is revealed, with optional extensions in development. Expiry currently restricts viewing but does not delete stored messages or media. The recipient can choose to purchase a keepsake download in test mode; the resulting ZIP is assembled in their browser and contains messages and visible media. Keep downloaded copies secure, as we cannot control them after download. A final deletion and recovery policy will be established before public launch.

Data requests

A process for access, correction and deletion requests, plus formal retention periods and the responsible operator's contact details, must be finalised before public launch. Please avoid uploading sensitive personal information during this early testing period.