1. Our promise
Wishly exists so you can turn your most personal moments into a website for the people you love. We treat what you create as private to you and to the people you choose to share it with.
We do not sell your personal information, we do not run advertising on your websites, and we do not use your photos, videos or letters to build advertising profiles.
2. Information we collect
Account details such as your name, email address and sign-in information (including sign-in through Google, if you choose it).
Content you create or upload: photos, audio, video, letters, messages, template settings and the websites you build.
Limited technical information needed to run and protect the service, such as device and browser type, basic logs, page views and security events.
Visitor replies: if someone answers one of your websites, we receive the name, message and emoji they type, and pass it to you as a private notification and an email to your account address.
If you use our donate page, the details you type into the thank-you form (name, email, amount, method and reference). We never ask for your card, wallet or bank password.
3. How we use information
To create, save, publish and deliver the websites you ask for, and to send the emails you request or that are needed for your account (verification, password reset, notifications).
To protect accounts, prevent abuse and spam, and keep the service reliable and secure.
To understand overall usage, such as which templates are popular, so we can improve Wishly. This uses aggregate numbers, not the content of your websites.
We do not read, review or browse your private content for fun or for marketing. Our team accesses content only when needed to fix a problem you report, to enforce our rules against illegal or harmful use, or when the law requires it.
4. Who can see what you create
Your drafts, dashboard, account details and uploaded files are available only through your signed-in account.
A website you publish can be opened only by people who have its link. Share the link with the person it is meant for, and only with them.
Your websites are not promoted in a public directory of members’ personal content. Please do not post a private link in public places.
Anyone who has your website link, or a direct media link copied from it, can open what that link points to. This is how sharing works on the web, so share links carefully and unpublish a website if you no longer want it to be reachable.
5. How we protect your data
Encryption in transit: all traffic between your device and Wishly is sent over HTTPS, and we instruct browsers to always use a secure connection.
Encryption at rest: your account data and uploaded photos, audio and video are stored with established cloud providers that encrypt stored data on their systems.
Locked-down database: our database is not open to the public internet or to other members. It is reached only by our own servers, and row-level security is enabled as a second lock.
Access control: every action on a website, upload or account is checked against the signed-in owner, so one member cannot view, edit or delete another member’s content.
Protected uploads: files are uploaded through signed, time-limited requests and restricted to allowed photo, audio and video formats.
Account protection: passwords are never stored in readable form, sign-in attempts and sensitive requests are rate-limited, and the admin area is restricted to authorised administrators.
Abuse controls: forms are protected with rate limits and bot filters so they cannot be used to spam you or others.
6. Honest limits
No online service can promise perfect security, and we will not pretend otherwise. We work to prevent unauthorised access and keep improving our protections, and if we ever learn of a breach that affects you, we will tell you promptly and explain what to do.
Our encryption protects data in transit and in storage. It is not end-to-end encryption, which means the service can technically process your content in order to display your website to the people you share it with.
You are responsible for keeping your password private, for choosing who receives your links, and for not uploading content you do not have the right to share.
7. Third-party services
To run Wishly we rely on trusted providers for hosting, database and sign-in, file and media storage, email delivery and privacy-friendly usage analytics. They process data only to provide those services to us and are not allowed to use your content for their own advertising.
Links and media you add from other websites are controlled by those websites and follow their own privacy policies.
8. Cookies and similar technologies
Wishly uses only strictly necessary cookies. They are needed to keep you signed in, to protect sign-in and password steps, and to complete Google sign-in. We do not use advertising, marketing or tracking cookies, so there is no cookie banner to accept.
bb_session and bb_session_refresh keep you signed in. They last up to 30 days or until you sign out. bb_google_state, bb_google_verifier, bb_google_invite and bb_next protect Google sign-in and remember where to send you afterwards; they last 10 minutes. The one-time email-code steps for sign-up, password reset and account deletion each use a short-lived cookie that expires within minutes.
All of these cookies are HttpOnly, so page scripts cannot read them, are sent only over a secure HTTPS connection, and are not used to follow you across other websites.
To count how many different devices opened a website, your browser keeps one random device ID in its local storage (named bb_vid). It is not a cookie, contains no personal information, is not used for advertising, and is not shared with anyone; our server stores only a one-way hash of it, never the ID itself. Limiting repeated reactions uses a one-way hash of your network address and browser type, with nothing stored on your device. You can delete the device ID any time by clearing site data in your browser; your next visit would then count as a new device.
Your browser may also keep a few settings you choose yourself, for example a hint you dismissed in the editor, or the name you typed in a reply while that tab stays open. Wishly also uses Vercel Web Analytics to measure page visits, which does not use cookies. You can clear cookies and site data in your browser settings at any time, but you will then be signed out.
9. Retention and deletion
We keep your data while your account is active. When you delete a website, it is permanently deleted together with all its photos, videos, audio and other uploaded files, and it cannot be recovered or brought back.
Every visitor reply is also sent by email to the address of your Wishly account (for example, your Gmail), so you receive a copy in your own inbox as well as in your notifications.
Notifications, including visitor replies and the notifications you receive about them, are deleted automatically after 7 days, and you will not get a separate reminder when this happens. If a reply or notification matters to you, save it somewhere safe within those 7 days.
When you delete your account, it is scheduled for deletion and you have 3 days during which you can cancel the deletion if you change your mind. We email you a reminder 2 days before the deletion. After those 3 days, your account, all your websites and all your photos, videos, audio and other uploaded files are permanently deleted, and they cannot be recovered or brought back.
10. Your privacy, in your hands
Your privacy is yours to decide. You choose what goes into a website, who receives its link, and when it stops being visible. Nobody else can change those choices for you.
Replies from people who open your website are private. They reach you as a notification and an email, and are never shown publicly on your website or anywhere else on Wishly.
Only you, through your signed-in account, and authorised administrators who need to deal with abuse or a problem you report can see those replies.
You can unpublish a website, delete it, or delete your whole account whenever you want, and you do not need to give us a reason.
11. Your rights and choices
You can access, correct, download or delete the content you have created from your dashboard and account settings.
You can unpublish a website at any time to make its link stop working.
You can ask us to delete your account or answer a privacy question using the contact details below. We will respond as soon as reasonably possible.
12. Children
Wishly is not directed at young children. If you believe a child has given us personal information without proper permission, contact us and we will review and remove it.
13. Changes to this policy
We may update this policy when the service or the law changes. The latest version is always on this page with its updated date, and we will notify members of important changes.
14. Contact
For privacy questions, deletion requests or to report a security concern, use the contact page on the website. Please do not include passwords in your message.