Privacy policy

Who we are

Magic Wishlist (the Wishlist app for iPhone and Android, the web app at app.magicwishlist.app, and this site, magicwishlist.app) is run by ShinySoft Technologies. Questions about this policy or your information go through our support page.

What we keep

• Your account: name, email address and password. The password is stored only as a salted hash, never as you typed it.
• Your profile, if you fill it in: birthday, phone number, shoe and clothing sizes, and a photo.
• What you add: wishes with their links, prices and photos; suggestions and comments; what you've claimed; families, announcements and nicknames; and the email addresses of people you invite.
• Your Buy List: what you paid and receipt photos. Only you ever see these.
• Family members without an account, such as young children: the name and details a family admin enters for them.
• Sign-in records: when someone tried to sign in to your account, whether it worked, and the IP address and browser or device it came from. We use these to spot and stop break-ins.
• Notifications: a push token from Apple or Google so we can send the notifications you've turned on.
• Crash reports from the phone app: the error, app version, device model and operating system, sent to Sentry so we can fix problems. They don't include your lists.
• Feedback and contact messages: your name, email and what you wrote.

The camera and photo library are used only when you choose to take or pick a photo or scan a barcode. The phone app also keeps a copy of your lists on the device so they work offline; signing out or deleting your account removes it.

Who sees it

• Your families see your name, birthday (the year only if you choose), sizes, photo and the wishes you share with them. A wish kept just for you stays with you.
• You never see who claimed or suggested something on your own list. That information is removed on our server before your list is sent to you.
• We (the people who run the service) can see account information to give support and keep the service safe and working. We don't look through your lists otherwise.
• Nobody else. We don't sell, rent or share your information for advertising.

Services that help us run it

These handle information only to do their part for us:

• Microsoft Azure OpenAI fills in a wish from a shop link you paste (we send the link and text from that page), and suggests gift ideas (we send what's on the person's list, their sizes, their age if they show their birth year, and your price range, never names). We keep a record of these requests to check the results and their cost.
• Product lookups (UPCitemdb, Open Food Facts and Open Library) receive only the barcode number you enter or scan.
• Apple Push Notification service and Google Firebase Cloud Messaging deliver notifications.
• An email provider sends invitations and the notification emails you've turned on.
• Sentry receives the phone app's crash reports.
• Siri and Gemini pass what you ask to the app on your phone when you use them; Apple and Google handle your voice under their own privacy policies.

Deleting your account

In the app or at app.magicwishlist.app, go to Profile and choose Delete my account and lists. That deletes your wishes, gives back anything you'd claimed so someone else can buy it, deletes what you paid and your receipts, removes you from your families and clears the app's copy on your phone.

Gifts already marked as given stay in the other person's history. To have everything else erased as well, including sign-in records and your account record, ask us and we'll do it within 30 days.

Your choices

• See and change your profile any time under Profile.
• Turn notifications off in your phone's settings, or stop watching someone.
• Ask us for a copy of your information, to correct it, or to delete it, through our support page.

Children

Accounts are for adults and teenagers. Children under 13 shouldn't sign up themselves; a parent or family admin can keep a list for them as a member without an account, and can remove it at any time.

Keeping it safe

Everything travels over encrypted connections, passwords are hashed, and photos are only served through signed links. If we change this policy, we'll update the date at the top of this page.