Wishiary Privacy Policy

Wishiary helps families create and share wishlists, coordinate gifts, and discover things children may love. Because Wishiary is built around children and families, privacy is an important part of how we design the service.

This Privacy Policy explains what information Wishiary collects, how we use and share it, how long we keep it, and the choices Parents, Gift Givers, and other users have about their information.

Wishiary is currently in beta. Some privacy requests and controls may be handled with assistance from Wishiary while we continue building self-service tools.

A few important commitments: We don't sell or license personal information—or the aggregate or identity-separated information we learn from Wishiary activity. We don't use children's profiles or activity for targeted advertising. Parents control whether their children can use Wishiary directly and whether their Wishiaries are shared with Gift Givers.

1. Who uses Wishiary

Wishiary includes several different experiences:

• Parents and guardians create and manage Wishiary accounts and Child profiles.
• Children may use Wishiary directly when a Parent enables Child Access.
• Gift Givers can view a Wishiary shared with them and coordinate gifts, with or without creating a Wishiary account.
• Wishiary Companion can help a Parent import items from an Amazon wishlist into Wishiary.

When this policy refers to a Parent, we mean a parent or guardian with parental authority for a Child in Wishiary. Other adults may be given permission to help manage a Child's Wishiary without becoming a Parent or guardian.

2. Information Parents and other adults provide

When you create and use a Wishiary account, we collect information needed to provide and secure your account, such as your email address and authentication information.

Parents may create profiles for children they manage. Depending on the features a Parent chooses to use, a Child profile may include:

• a first name, nickname, or other display name chosen by the Parent;
• birthdate;
• a Wishiary illustrated avatar;
• sizes;
• interests and preferences;
• information intended to help Gift Givers choose appropriate gifts; and
• other information a Parent chooses to provide.

Wishiary does not require a Child's legal name or last name. A first name or nickname works well. The current profile-editing experience uses Wishiary illustrated avatars and does not offer custom photo upload. Older account records may still contain photo information that can appear through a compatibility display path.

We use a Child's full birthdate internally for features such as age-aware recommendations, age appropriateness, and birthday-related experiences. When a Wishiary is shared with Gift Givers, we may show the Child's birthday month and day, but not their birth year or full birthdate.

If you contact Wishiary, we receive your email address and whatever information you choose to include in your message so we can respond, provide support, and address your request.

3. Wishes and other information created in Wishiary

Parents and, when Child Access is enabled, Children may create and manage information such as:

• Wishes and Favorites;
• notes about Wishes;
• information about things the Child already owns;
• requests to Wish for something again;
• wishlist and collection information; and
• Custom Wishes and links provided by the user.

Some of this information is intended to be shared with Gift Givers when a Parent shares the Child's Wishiary. Other information is used only within Wishiary.

4. Activity and personalized recommendations

Wishiary is designed to become more useful as a Child uses it.

We may use activity inside Wishiary—such as things a Child Wishes for, Favorites, searches for, views, clicks, explores, owns, or indicates they are not interested in right now—to understand their interests and personalize their experience.

Different actions can tell us different things. Adding something to a wishlist, for example, may be a stronger indication of interest than simply viewing it.

Recommendations may reflect things Wishiary has learned about a Child while also introducing new or adjacent ideas rather than limiting the Child to interests they have already shown.

We use this information to provide and improve the Child's Wishiary experience and recommendations.

We do not use a Child's profile or activity for targeted advertising.

5. Learning about broader gift interests

Wishiary may also learn from activity across Wishiary to understand broader patterns in what children around different ages are interested in.

We designed this separately from the information used to personalize an individual Child's experience. Wishiary can create an observation that is not connected to the Child's Wishiary profile. For example, an observation might indicate that a child of a particular age Wished for a particular product at a particular time.

These separate observations may include information such as:

• age at the time of the activity, including age in months;
• the product or controlled characteristics of the product;
• the type of action taken;
• search terms or normalized search queries;
• the search outcome or context; and
• when the activity occurred.

These observations are maintained separately from individual Child profiles and do not intentionally include Child or family account identifiers. A search term entered by a user may itself contain identifying information. Removing account identifiers does not guarantee that every observation is anonymous.

We use these observations for Wishiary's internal population learning and recommendation development. We do not sell or license them.

Because these observations are maintained separately from an individual Child's profile, they may remain after that profile is deleted.

6. We don't sell or license your data

Wishiary does not sell or license personal information about children, Parents, families, or Gift Givers.

We also do not sell or license aggregate information or the identity-separated observations we develop from activity in Wishiary.

We may use this information within Wishiary to operate, improve, and develop the service, including our recommendation and gift-insight features. Wishiary may also make money from its own products and services, including through affiliate relationships, without selling or licensing the underlying user data.

Using service providers to operate Wishiary, or sharing information with a Gift Giver at a Parent's direction, is not a sale or license of that information.

7. Children's privacy and Child Access

Parents create and control Child profiles in Wishiary.

A Parent may choose to enable Child Access, which allows a Child to use parts of Wishiary directly with Parent-created credentials. Children do not need their own email address or phone number to use Child Access.

When Child Access is enabled, the Child may be able to browse, search, explore, manage Wishes and Favorites, write notes, and use other Child features. Wishiary may use those interactions as described above to provide the service and personalize recommendations.

We try to limit the information Children need to provide to what is reasonably necessary for the Wishiary features they use. For example, Children do not need to provide an email address or phone number to use Child Access.

Before Child Access is enabled, Wishiary requires affirmative authorization from a Parent or guardian.

Parents and guardians control whether a Child can use Wishiary directly. Enabling Child Access requires affirmative authorization from an authorized Parent or guardian. Wishiary is still finalizing the additional parental-verification process that may be required for certain Child Access uses. Until that process is finalized, Wishiary does not represent Parent authorization as completed verifiable parental consent.

Parents control Child Access and can turn it off. Turning Child Access off prevents the Child from signing in and ends active Child sessions, but it does not delete the Parent-managed Child profile or its history.

A Parent may also withdraw authorization for direct Child Access. Deleting the Child's information is a separate action.

8. Your choices and controls

Depending on your relationship to Wishiary, you may be able to:

• update Child profile information;
• manage Wishes and information intended for Gift Givers;
• turn Child Access off;
• withdraw authorization for direct Child Access;
• revoke Wishiary sharing;
• Archive and restore a Child;
• request deletion of a Child;
• request deletion of your adult account; or
• request deletion of your Gift Giver information.

Parents may also ask to review the personal information Wishiary has collected from their Child. Before providing access to that information, we may take reasonable steps to verify that the person making the request is the Child's Parent or guardian.

Parents may ask Wishiary to stop further collection or use of personal information from their Child. Depending on the request, this may mean turning off Child Access, deleting information, or limiting features that require that information. Parents may withdraw Child Access authorization, manage sharing, and Archive or Restore a Child.

Requests to review information or stop further collection or use are handled with assistance from Wishiary; they are not currently general self-service export or opt-out features.

For help with a privacy request, contact hello@wishiary.com.

9. Sharing a Wishiary with Gift Givers

A Parent can choose to share a Child's Wishiary using a share link.

Someone with a valid share link can see information Wishiary makes available for gift shopping, such as:

• the Child's Wishiary/display name;
• their selected Wishiary illustrated avatar;
• birthday month and day;
• visible Wishes;
• notes intended for Gift Givers;
• sizes;
• favorite colors, themes, or preferences;
• Things to Know or things to avoid; and
• age-appropriateness guidance about a gift.

We do not intentionally share a Child's birth year or full birthdate, search or browsing history within Wishiary, recommendation profile, Child credentials, security information, or parental-authorization records with Gift Givers.

Age-appropriateness guidance may be calculated using the Child's age without disclosing the Child's full birthdate or precise internal age.

Shared Wishiaries are intended for people who receive the link rather than for public discovery. We instruct search engines not to index shared Wishiary pages.

Anyone who receives a valid share link may be able to access the shared Wishiary, so Parents should share links only with people they intend to give access to. A recipient can also forward the link to someone else. Third-party messaging or preview services may temporarily cache information included in a link preview.

Parents can revoke sharing. Archiving or deleting a Child also makes the live shared Wishiary unavailable.

10. Gift Givers and reservations

Gift Givers do not need a Wishiary account to reserve a gift.

When a Gift Giver reserves or manages a gift, Wishiary may collect:

• email address;
• a nickname or name the Gift Giver chooses to use for that reservation;
• the gift reserved;
• reservation, purchase, release, or received status and dates;
• private notes the Gift Giver chooses to save; and
• information needed to recognize the Gift Giver's browser and securely manage reservations.

A Gift Giver may use a different nickname for different reservations.

We use the Gift Giver's email to provide reservation confirmations, maintain gift continuity, and support reservation management. A Gift Giver may later choose to create an account and explicitly associate eligible gifts with that account.

Who can see Gift Giver information

Gift Givers do not see another Gift Giver's nickname, name, or email address.

Parents and other adults who manage the Child's Wishiary may see the Gift Giver's reservation nickname and email address so they can manage gift coordination.

Children do not see Gift Giver email addresses. After a gift has been marked Received, the Child may see the nickname the Gift Giver used for that gift.

Parents can manage reservations for their Child, including releasing a reservation or marking a gift received.

11. Transactional email

Wishiary sends transactional email for purposes such as account authentication and Gift Giver reservation confirmations. We use Resend to deliver these messages.

For troubleshooting and delivery support, Wishiary may keep stored information about Gift Giver reservation emails for up to 30 days after delivery activity has ended. After that, we remove stored information such as the recipient address and message content while retaining limited delivery information where useful.

Other transactional-email records and our email provider's operational records may be retained according to the systems and providers used to deliver them.

12. Wishiary Companion and Amazon wishlist imports

Wishiary Companion is an optional browser extension that can help a Parent import items from an Amazon wishlist.

The Companion works when the user deliberately invokes it for an Amazon wishlist. It reads limited wishlist and product information needed for the import and sends that information to Wishiary for review.

The Companion does not collect:

• your Amazon password;
• Amazon authentication cookies;
• payment information;
• Amazon order history; or
• your general browsing history.

The Companion does not keep a persistent copy of the wishlist contents in the browser extension after the import workflow.

Wishiary may temporarily retain imported source information while a Parent reviews or completes an import. Empty import attempts are generally removed after 7 days, and received but wholly unexecuted imports are generally removed after 30 days.

After an import is completed, Wishiary may remove the detailed source payload while retaining a limited record needed to maintain import history and remember which source items have already been imported. Child-linked import history is removed when the Child is deleted.

Amazon is a third-party service with its own privacy practices. Wishiary does not send the Child's recommendation profile or general Wishiary activity to Amazon as part of the Companion import process.

Wishiary Companion and Chrome Web Store Limited Use

Wishiary Companion accesses information from an Amazon wishlist only when a user initiates an import. Information obtained through the extension is used to complete the requested import and provide the associated Wishiary wishlist features described in this Privacy Policy. It is not sold, used for advertising, or shared for unrelated purposes.

Wishiary's use and transfer of information received through Wishiary Companion complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

13. How we use information

We use information collected through Wishiary to:

• provide and secure accounts and Child Access;
• generate Wisp speech when a user requests it;
• create and manage Child profiles and Wishiaries;
• provide Wishes, Favorites, collection, and related features;
• coordinate gifts and prevent duplicate gift reservations;
• personalize recommendations and discovery;
• provide age-aware and birthday-related features;
• import wishlist items at a user's request;
• send transactional communications;
• provide support and respond to questions;
• detect abuse and protect Wishiary's security;
• understand and improve Wishiary; and
• develop Wishiary's recommendation and gift-insight features.

We do not use Child profiles or activity for targeted advertising.

14. Service providers

We use a limited number of service providers to operate Wishiary. These currently include:

• Supabase for database and authentication infrastructure;
• Vercel for web application hosting and infrastructure;
• Resend for transactional email delivery, including account authentication and Gift Giver email; and
• Fastmail for Wishiary's business email and correspondence; and
• ElevenLabs to generate speech for Wisp.

When Wisp speech is generated, text selected for speech may be sent to ElevenLabs. That text may include Wish titles or descriptions and Custom Wish information entered by users, which may contain personal information. Wishiary does not intentionally send a Child's full profile, birthdate, or recommendation history as part of speech generation.

These providers process information on Wishiary's behalf as needed to provide their services and may maintain limited operational, security, or backup records according to their own practices.

We provide these services only with information reasonably necessary for them to perform their functions on Wishiary's behalf.

We use these providers to operate Wishiary, not to build advertising profiles about Wishiary families or to sell or license their information.

We may also disclose information when reasonably necessary to comply with law, protect the security or rights of Wishiary or others, or respond to valid legal process.

15. Affiliate links

Wishiary may participate in affiliate programs, including Amazon Associates. As an Amazon Associate, Wishiary may earn from qualifying purchases.

An affiliate relationship means Wishiary may receive compensation when someone follows an eligible link and makes a purchase. It does not mean Wishiary sells or licenses Child, Parent, Gift Giver, aggregate, or identity-separated Wishiary data to the retailer.

Third-party retailers have their own privacy practices when you visit or shop on their sites.

16. How long we keep information

We keep information based on why we need it rather than keeping everything indefinitely.

For example:

• Child Wishes, preferences, lifecycle history, and individualized recommendation information are generally kept while the Child profile exists.
• Expired or revoked Child sessions are removed within 30 days after they expire or are revoked.
• Expired or revoked Gift Giver reservation-management sessions and related temporary access are removed within 30 days.
• Routine Child security records are generally kept for up to 90 days, unless a specific security, fraud, or legal matter requires a longer hold.
• Full stored reservation-email information is minimized within 30 days after its delivery activity has ended.
• Empty Amazon import attempts are generally removed after 7 days.
• Received but wholly unexecuted Amazon imports are generally removed after 30 days.
• Temporary Companion authorization records are removed within 30 days after their useful life ends.
• Information that identifies participation in Wishiary's beta testing is generally removed after 90 days.
• Wishiary generally retains its own production database backups for approximately 30 days, with a short operational safety margin before older backups are removed. Rotation follows an operator-controlled process.
• Reusable pre-written Wisp dialogue may remain cached to avoid unnecessary repeated speech generation. Audio generated from user-provided content may also be cached. Our current practice does not establish that personalized audio files are physically deleted after a fixed period.

Some information has a longer legitimate lifecycle. For example, a Gift Giver may want a history of gifts they reserved or gave, and Wishiary may retain limited import history while a Child profile exists.

Specific security or legal circumstances may require us to retain limited information longer than the ordinary period.

Our service providers may also retain limited operational or backup records under their own retention practices.

17. Archiving a Child

A Parent may Archive a Child instead of deleting them.

Archive is intended for situations where a Parent wants to stop seeing a Child throughout everyday Wishiary use but wants to preserve the Child's profile and history.

When a Child is archived:

• their profile and history are preserved;
• they are removed from ordinary active-family views;
• direct Child Access is turned off;
• active Child sessions end;
• live Wishiary sharing is suspended; and
• ordinary active recommendations and reminders stop.

The Parent can later restore the Child. Restoring the Child does not automatically turn Child Access or sharing back on.

Wishiary does not require a Parent to tell us why they are archiving a Child.

18. Deleting a Child

A Parent can request permanent deletion of a Child's Wishiary information.

When a Child is deleted, Wishiary removes identifiable Child information such as:

• the Child profile and birthdate;
• credentials and sessions;
• Wishes, Favorites, notes, and collection history;
• individualized recommendation and activity history;
• active sharing;
• Child-linked import information; and
• other Child-specific profile and lifecycle information.

Deleting a Child removes the information Wishiary uses to personalize that individual Child's experience.

It does not remove the separate population observations described in Section 5 because those observations are maintained separately from the Child's Wishiary profile and are not connected to that profile.

Some other limited information may remain for specific purposes. For example:

• a Gift Giver may retain the display name that appeared on the Wishiary as part of their own gift history so they can tell whom the gift was for, along with the relevant gift history. This does not retain the deleted Child's live profile, birthday, preferences, notes, or recommendation information;
• limited authorization or security records may remain where needed for their specific purpose; and
• deleted information may temporarily remain in protected backups as described below.

19. Deleting Gift Giver information

A Gift Giver can request deletion of their identifying Wishiary information.

When this occurs, Wishiary removes or minimizes information such as the Gift Giver's:

• email address;
• identifying nickname or account identity;
• private notes;
• browser continuity and management credentials; and
• related identifying access records.

Deleting Gift Giver information does not automatically change what happened with the gift. A family may retain a non-identifying historical fact such as that a gift was reserved, purchased, released, or received and when that happened.

For example, a family might continue to see “Reserved September 6” rather than “Reserved by Grandma.”

20. Deleting an adult account

An adult may request deletion of their Wishiary account.

If that adult is the only Parent or guardian responsible for a Child in Wishiary, deleting the account also deletes that Child according to the process described above.

If another Parent or guardian remains, the Child and their history can remain under that Parent's management. An adult who only has delegated management access does not become the Child's Parent or guardian merely because another adult deletes their account.

An adult's Gift Giver information is also removed or minimized as appropriate when their account is deleted.

21. Backups and deleted information

Wishiary maintains protected database backups for disaster recovery. Wishiary generally retains its own production database backups for approximately 30 days, with a short operational safety margin before older backups are removed. Rotation follows an operator-controlled process. Service-provider-managed backups are subject to the providers' own practices.

Because a backup is a historical copy, information that has been deleted from the live service may remain temporarily in an older backup until that backup expires.

Before an older backup can be returned to service, Wishiary's recovery process reapplies completed privacy deletions and current retention rules.

Our recovery process is designed so an older backup is not returned to service as a way to undo a completed privacy deletion.

Wishiary also maintains a protected record of completed privacy deletions separately from its database backups so those deletions can be reapplied if an older backup ever needs to be restored.

22. Security

We use administrative, technical, and organizational measures intended to protect information in Wishiary.

These include measures such as:

• access controls;
• encrypted connections;
• protected backups;
• limited and short-lived access credentials where appropriate;
• controls that restrict sensitive administrative operations; and
• recovery processes designed to prevent deleted information from being unintentionally restored from an older backup.

No online service can guarantee absolute security, and we do not claim that Wishiary can eliminate every possible risk.

23. Changes to this policy

Wishiary is still developing, and our features and privacy practices may evolve.

If we make material changes to this Privacy Policy or to how we use children's information, we will update this policy. When required or appropriate, we will also provide additional notice or seek new parental authorization.

The Last updated date at the top of this policy shows when it was most recently revised.

24. Contact us

If you have questions about this Privacy Policy, Wishiary's privacy practices, or a privacy request, contact us at:

• Unladen LLC — Operator of Wishiary
• 522 W Riverside Ave, #4994, Spokane, WA 99201, USA
• (425) 470-4713
• hello@wishiary.com