Privacy Policy

1. Introduction

Welcome to Wish2Share. This privacy policy explains how we collect, use, share, protect and store your personal data when you visit our website or use our services.

This policy applies to all users of our website (wish2share.com) and mobile application. By using our services, you agree to the practices described in this policy.

2. Data We Collect

2.1 Personal Data You Provide

• Account details: Account information: Name, email address, profile picture (if provided)
• Wishlist content: Wishlist content: Products, wishes and descriptions you add
• Usage data: Usage data: How you use our services

2.2 Data Collected Automatically

• Device data: Device information: IP address, browser type, operating system
• Usage statistics: Technical server logs from our hosting (Vercel) and anonymous click counts per shop and per day, without cookies or user profiles
• Cookies and similar technologies: Only necessary cookies and local storage for sign-in, language and security; no analytics or tracking cookies

2.3 Google User Data

When you sign in with your Google account, we collect the following data through Google's OAuth API:

• Email address: Email address: Your primary Google email address
• Profile information: Profile information: Name, profile picture (if available)
• Google ID: Google ID: Unique identifier for your Google account
• OpenID Connect information: OpenID Connect information: For authentication purposes

We only use the standard OAuth scopes required for authentication. We do not request access to your Google Drive, Gmail, Calendar or other Google services.

3. How We Use Your Data

3.1 Service Provision

• Creating and managing accounts
• Storing and sharing wishlists
• Organizing Secret Santa events
• Facilitating communication between users

3.2 Google User Data

The Google user data we collect is used exclusively for:

• Authentication: Authentication: Verifying your identity when signing in
• Account management: Account management: Linking your Wish2Share account to your Google account
• Communication: Communication: Sending service-related emails (password resets, account notifications)
• Profile building: Profile creation: Automatically filling in your name and profile picture during registration

3.3 Analytical Purposes

• Improving website and app performance
• Optimizing user experience
• Resolving technical issues

4. Sharing of Data

4.1 When We Share Data

We do not sell, rent or share your personal data with third parties for commercial purposes. We only share data in the following cases:

With Your Consent

• When you share a wishlist with specific friends or family members
• When you participate in a Secret Santa event

With Service Providers

• Vercel: For hosting the website
• Firebase: For database, file storage and authentication (Google)
• Email services: Email services: For sending notifications
• Affiliate partners: We do not pass personal data to shops or affiliate networks; see 8.3

Legal Obligations

• When required by law or court order
• To protect our rights or ensure safety

4.2 Google User Data

Google user data is not shared with third parties except as described in this policy. This data is only used within our Firebase infrastructure for authentication and account management.

4.3 Contact Forms (Thumbsupp)

Messages you send through our contact or support form are also passed to Thumbsupp, our internal operations tool, operated by Leliflow VVRZL (BE1012173224), the company behind Wish2Share. We use it for internal handling of your message and for bug triage: the message is sorted automatically using simple rules (for example question, bug report, feature request or spam).

Thumbsupp keeps only minimal metadata: the category, the length of the message, which form was used, a coarse email type (for example free provider or business address, never the address itself), whether a phone number was entered, any spam signals and a timestamp. Your name, email address, phone number and the text of your message are not stored there. The only exception: if your message is recognised as a bug report or feature request, a copy with email addresses, phone numbers and links removed (up to 1,000 characters) is kept as an internal task so we can fix the problem. To prevent abuse, we use a pseudonymised key derived from your IP address; it is kept for at most one hour, and your IP address itself is never passed on.

None of this is made public, and Thumbsupp does not send automated replies. Thumbsupp runs on Cloudflare and Google Cloud (Firebase) infrastructure. Legal basis: our legitimate interest in handling your request and preventing abuse.

5. Data Storage and Protection

5.1 Security Measures

• Encryption: Encryption: All data is stored and transmitted securely
• Access control: Access control: Limited access to personal data for authorized personnel
• Firebase security: Firebase Security: Use of Google's enterprise-grade security
• Regular audits: Regular audits: Security checks and updates
• Incident response: Incident response: Plan for handling data breaches

5.2 International Data Transfers

Your data may be stored on Google Firebase servers located in different countries. Google complies with EU data protection agreements and relevant privacy regulations.

6. Data Retention

6.1 Account Data

• Active accounts: Active accounts: Stored as long as the account remains active
• Inactive accounts: Inactive accounts: 2 years after last activity
• Deleted accounts: Deleted accounts: Completely removed within 30 days

6.2 Wishlist Data

• Public wishlists: Public wishlists: Stored as long as they remain useful for the community
• Private wishlists: Private wishlists: Removed when the account is deleted

6.3 Google User Data

Google authentication tokens are stored while the account remains active. When an account is deleted, all Google-related data is immediately removed.

7. Your Rights

7.1 Access and Correction

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Complete incomplete information

7.2 Data Deletion

You can request deletion of your account and all associated data at any time. This includes:

• Account data
• Wishlists and wishes
• Google authentication data

7.3 How to Submit a Request

For all privacy-related requests, contact us via:

• Email: privacy@wish2share.com
• Subject: "Privacy Request"
• Response time: Within 30 days

8. Cookies and Tracking

8.1 Types of Cookies

• Functional cookies: Functional cookies: For basic website functionality
• Authentication cookies: Authentication cookies: For maintaining your login status
• No analytics or tracking cookies: Wish2Share does not use analytics, advertising or tracking cookies and does not load any analytics service

8.2 Cookie Management

You can manage cookies through your browser settings; disabling necessary cookies may limit website functionality. Because we only use necessary cookies, we do not ask for consent for analytics cookies.

8.3 Affiliate links and partner websites

Some shop links on Wish2Share are affiliate links (for example bol.com, Amazon and networks such as TradeTracker, Awin, Daisycon and Adtraction). When you click through to a shop, that partner and the shop may set cookies on their own website or domain to attribute a possible purchase to Wish2Share. Their own privacy policy applies to that.

Wish2Share does not share personal data with these partners.

9. Changes to This Policy

We may update this privacy policy from time to time. For important changes, we will notify you by email or through a prominent notice on our website. The date of the latest update is shown at the top of this document.

10. Contact

For questions about this privacy policy or your data, contact us:

11. Google API Services Compliance

This privacy policy complies with the Google API Services User Data Policy and Google APIs Terms of Service. Specifically:

• We use Google OAuth exclusively for authentication
• Google user data is not used for other purposes
• Data is securely stored according to Google's security standards
• Users can request deletion of their data at any time