Privacy policy
This privacy statement describes how privacy-sensitive data, that is to say personal data, is processed through the website www.wishlistery.com. Handling personal data with care matters a great deal to Wishlistery. Personal data is therefore secured and processed in accordance with privacy legislation. Wishlistery acts as the controller and:
- states clearly which personal data is processed and for which purposes;
- limits the collection of personal data to only the personal data that is necessary for the purpose for which it is processed;
- takes appropriate security measures to protect the personal data;
- respects your rights under privacy legislation to see, correct or delete personal data;
- and, wherever consent is required, asks you for your explicit consent first before personal data is processed.
Registration form
To be able to make wishlists and to see other people's, you need an account. Through the registration form we use the following personal data:
- email address
- name
We use this personal data on the basis of your consent.
If you secure your account with a passkey or with two-factor authentication, we also keep the public key of that passkey, or the secret your authenticator app uses, along with your recovery codes. That is what lets us verify a sign-in attempt; your fingerprint, face or PIN never reaches us and stays on your own device.
Your lists, wishes and groups
What you put into Wishlistery is data too: the wishes you add, the lists they sit on, the groups you belong to and the gift lotteries you take part in.
A list you create while signed in is open to your groups by default: we share it at that moment with every group you belong to, and you can adjust that per group afterwards. From outside your groups it cannot be reached unless you turn on a share link yourself. A list made through that share link is visible to anyone holding the link from the start.
If you reserve or fulfil somebody else's wish, we record that it was you. We need that in order to hide it from the recipient, who sees neither that anything has been reserved or bought nor by whom. Other people looking at the list do see it. Your name is shown to them only if you share a group with them.
Shared lists without an account
A list can be shared through a link that needs no account. To make one we ask for a name for the list, and if you like a description and a date. We do not ask for an email address, or for your own name. We give you a password along with it, one we generate ourselves and show you once; that is how we recognise you later as the person who manages the list. Of that password we keep only a hash.
Anyone holding the link can look at the list and fulfil a wish on it. Adding, changing or removing wishes takes that password.
About visitors who only look, we keep nothing. If you fulfil a wish without an account we do ask for a name, and we keep it with the fulfilment. Without it nobody else can tell that the gift is taken care of, and somebody buys it a second time. That name is visible to other people looking at the list, and deliberately not to the person the gift is for.
So treat the link as the key to the list: anyone you send it to can pass it on, and at the moment there is no way to restrict who may look. The password does not do that; it separates managing the list from viewing it.
Links to products
When you paste a link to a product, our server fetches that page to read the title, the price and the description, so that you do not have to type them in. The request goes out from us and not from your browser: the shop therefore does not see who is adding the wish, and cannot set a cookie on you. We keep the result in a cache for at most a day, under a hashed form of the address and without any record of who asked for it.
Cookies
Wishlistery sets no tracking or advertising cookies and runs no analytics. The marketing page you arrive on first sets nothing at all.
The app itself uses five functional cookies. Two are needed to keep you signed in and to protect forms against misuse from outside; the other three remember choices you made yourself: your language, your light or dark appearance, and whether the sidebar is open. None of them follows you, and none is shared with anyone.
Sharing with third parties
Wishlistery will not pass your personal data on to other companies unless this is necessary for Wishlistery or we are legally obliged to do so. We use the following processors:
- a hosting party, for the servers and for storing the data. Those servers are in Europe;
- Mailgun, for sending and receiving email. We use their European environment, so your email address stays in Europe too;
- Sentry, for error reports. We have turned off the settings that would attach the contents of a request or of the database to such a report, so an error tells us what broke and not what you had written.
Security of personal data
Wishlistery takes appropriate security measures to limit misuse of personal data and unauthorised access to it. Only the necessary people have access to your personal data, and we review our security measures regularly.
How long we keep your data
For as long as you have an account, we keep your data. If you delete your account, your account details go immediately: your name, your email address, your password, your passkeys, your two-factor authentication and your membership of groups.
Some of it does not go automatically, and we would rather say so plainly than let you find out for yourself. Your wishes and lists remain, as does the record of what you reserved or fulfilled, because other people's lists depend on those. And because we keep track of who did what, your name appears in that log beside the things you did.
If you want that removed as well, let us know at the address at the bottom of this page. We will then delete it within 30 days, or make it untraceable to you where something has to remain in order not to break somebody else's list.
Rights of data subjects
If you have questions about this privacy statement or about the processing of your personal data, you can always contact us. You have the following rights:
- to see the personal data we process about you;
- to have mistakes corrected;
- to object to certain processing of your personal data by us;
- to have your personal data deleted;
- to withdraw your consent to the processing of personal data;
- It is important that you can always make clear who you are, so that we do not change or delete the data of the wrong person.
Changes to the privacy statement
We reserve the right to change this privacy statement. We would advise you to consult this privacy statement regularly so that you are aware of any changes.
Making a complaint
If you are not satisfied with the way we handle the processing of your personal data, you have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Contact details
This privacy statement was last changed on