Privacy Policy for Wishy

Last updated: February 20, 2026

This Privacy Policy explains how Wishy ("Wishy," "we," "us," or "our") collects, uses, shares, and stores personal information when you use the Wishy mobile app, website, and related services (collectively, the "Service").

If you do not agree with this Privacy Policy, do not use the Service.

1. Who We Are

Data controller:

• Legal entity: Artur Zavolovych
• Address: Ukraine, Lviv, Roksolyany, 33
• Contact email: boredarthur@gmail.com

2. Information We Collect

We collect information you provide directly, information collected automatically, and information from third-party providers.

A. Information you provide

• Account information: email address, account ID, and sign-in provider details when you sign in with Apple or Google.
• Profile information: username, display name, profile photo, birthday, and preferred currency.
• Wishlist content: wishes, descriptions, prices, links, tags, images, privacy settings, and related metadata.
• Social and collaboration data: followers/following, collaborative lists, invitations, reservations, gift status, reactions, and reports.
• Support data: if you submit feedback or a problem report, we may collect your message and any name/email you choose to provide.

B. Information collected automatically

• Usage analytics: in-app events, screens viewed, feature interactions, and app lifecycle events.
• Diagnostics: crash logs, performance data, and technical logs.
• Device and app data: device token for push notifications, app version, platform, and environment.

C. Subscription and purchase information

• Subscription status and entitlement data (e.g., whether Premium is active) are processed through Apple and our subscription provider.
• We process plan-usage data (for example link import usage counts) to enforce free-tier and premium-tier feature limits.
• We do not receive your full payment card number.

D. Information from connected providers

• Apple Sign In and Google Sign-In may provide account identity information.
• We may process metadata from links you submit to enrich wish details (for example product title, image, or price data).

3. How We Use Information

We use personal information to:

• Provide and operate Wishy features.
• Create and manage accounts, authentication, and security.
• Enable social and collaborative experiences.
• Process and manage subscriptions and restore purchases.
• Enforce plan-tier limits (including link import limits) and restore eligible feature access when a subscription becomes active again.
• Send push notifications and reminders based on your preferences.
• Monitor app quality, troubleshoot issues, and prevent abuse.
• Improve features, relevance, and product experience.
• Comply with legal obligations and enforce our terms.

4. Legal Bases (EEA/UK users)

If you are in the EEA, UK, or similar jurisdictions, we process personal data under one or more of these legal bases:

• Performance of a contract (to provide the Service).
• Legitimate interests (to secure, improve, and operate the Service).
• Consent (where required, such as certain notifications or tracking permissions).
• Legal obligation (where required by law).

5. How We Share Information

We may share information:

• With service providers that support our operations (such as infrastructure/database, subscription management, analytics, and error monitoring).
• With other users according to your settings and actions (for example public profile/wishlist visibility, follows, or collaborative activity).
• With legal authorities when required by law or to protect rights, users, and the Service.
• In connection with a merger, acquisition, financing, or asset sale.

We do not sell personal information for money.

6. Tracking and Advertising

• We do not use third-party advertising SDKs for cross-app targeted advertising.
• If we ask for tracking permission on iOS, we do so through Apple's ATT framework and honor your choice.
• You can manage tracking permission in iOS Settings.

7. Data Retention

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes, including:

• While your account is active.
• For reasonable periods after deletion for backup, fraud prevention, legal compliance, and dispute resolution.
• If a paid subscription expires, subscription-related feature access may change, but account data, previously created content, and persisted usage counters are not deleted solely due to subscription expiration.

When no longer needed, we delete or de-identify information.

8. Your Choices and Rights

Depending on your location, you may have rights to:

• Access your personal information.
• Correct inaccurate information.
• Delete your account and associated data.
• Receive a copy of your data (data portability).
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.

You can request account deletion from inside the app (Settings). For other privacy requests, contact us at boredarthur@gmail.com.

U.S. state privacy rights

If you are in California or another U.S. state with applicable privacy law, you may have rights to know, access, delete, and correct personal data, and to opt out of certain sharing/targeted advertising where applicable. We do not discriminate for exercising privacy rights.

9. Children's Privacy

Wishy is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided personal information, contact us and we will take appropriate action.

10. International Transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for international data transfers.

11. Security

We use reasonable technical and organizational measures to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Third-Party Services

Wishy relies on third-party services for core functionality, including:

• Apple (Sign in with Apple, App Store subscriptions)
• Google (Google Sign-In)
• Supabase (authentication, database, storage, and backend functions)
• RevenueCat (subscription management)
• PostHog (product analytics)
• Sentry (error and performance monitoring)

Their processing of personal information is governed by their own privacy policies and terms.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, where required, provide additional notice.

14. Contact Us

For privacy questions or requests, contact:

• Email: boredarthur@gmail.com
• Postal address: Ukraine, Lviv, Roksolyany, 33