Privacy policy

1. Who we are

Wish-ly is operated by Stephen Ofori Yeboah, a sole trader based in Ghana, at North Legon, Accra, Ghana. We are the data controller for the information described here. Reach us at ask.wishly@gmail.com.

2. What we collect

Your account. Your email address. If you sign in with a password, it is hashed and stored by our authentication provider — we never see it. If you sign in with Google, we receive your email address, name and profile picture from Google; we store your email address. We get no other access to your Google account.

What you build. Everything you enter in the editor: names, titles, messages, the birthday note, photos you upload, your cake and music choices, and the optional PIN that gates your page.

Wishes from friends. If you share a contribution link, we store the name a contributor types, their written message or their recording (up to ten seconds), and a still frame taken from that recording for use as a thumbnail.

Payments. We never see your card number or mobile money PIN — those go directly to Paystack. We store the Paystack transaction reference, the amount, the currency, the channel you paid by, the status, and the response Paystack sends back.

Usage. A view counter on each published page. That is the entirety of our analytics. We run no Google Analytics, no advertising pixels, and no third-party trackers.

How we use it. We use what you enter and upload to build, host and display your page, and to run and support the service. That includes occasional access to your content by us when it is needed to operate Wish-ly properly: for example to check that a feature such as the photo cut-out worked on your uploads, to fix a problem you report, or to respond to a moderation or legal request. We do not browse pages out of curiosity, and we never use your content for marketing or to train AI models.

3. Cookies and local storage

We use no advertising or analytics cookies, so there is no cookie banner to dismiss. Your signed-in session is held in your browser's local storage by our authentication provider, which is what keeps you logged in between visits. Clearing your site data signs you out.

4. How the photo cut-out works

The background cut-out that turns your photo into the figurine look is produced by a specialised AI service (fal.ai) over an encrypted connection: it receives the photo you uploaded, returns the cut-out, and is used for nothing else. If that service is ever unavailable, the cut-out instead runs entirely inside your browser using a model your browser downloads and caches. Either way, only images you choose to keep stay on your page.

5. Published pages are public

When you publish, your page is reachable by anyone who has its link. Photos, videos and audio on it are served from public file addresses with long, unguessable names — unguessable is not the same as private. Anyone holding a link can open it, and deleting a page does not un-share a link somebody already copied. The optional PIN gates the page, not the individual file addresses. Please don't upload anything you would be upset to see shared.

6. Who else touches your data

We use a small number of service providers to run Wish-ly. They process your data on our instructions only:

• Supabase — database, file storage and sign-in. Servers in Ireland (EU).
• Vercel — website hosting and content delivery.
• Paystack — payment processing. They handle card and mobile money details; we don't.
• Resend and Brevo — sending account and receipt emails.
• Google — only if you choose to sign in with Google.

We do not sell your data. We do not share it for advertising. We will disclose information if the law genuinely requires it, and we will tell you unless we are forbidden from doing so.

7. Where your data is stored

Your account, pages and uploads live on servers in Ireland, in the European Union. If you are in Ghana or elsewhere outside the EU, that means your information is transferred to and stored in the EU. Our static website is delivered from servers worldwide, but it carries no personal data.

8. How long we keep things

• Published pages and their uploads — twelve months from the date you publish, after which they are deleted.
• Drafts you never publish — until you delete them or close your account.
• Your account and email address — until you ask us to delete your account.
• Payment records — six years, because tax and accounting law requires it. These are kept even after a page is deleted.

9. Your rights

Under Ghana's Data Protection Act, 2012 (Act 843), and under the EU GDPR where it applies to you, you can ask us to give you a copy of your data, correct it, delete it, export it, or stop a particular use of it. You can also withdraw consent at any time.

Email ask.wishly@gmail.com and we will respond within thirty days. If you think we have handled your data badly, you can complain to Ghana's Data Protection Commission, or to your national supervisory authority if you are in the EU or UK.

10. Children

Wish-ly is not for children under 13, and we don't knowingly collect their information. If you believe a child under 13 has given us data, email us and we will delete it.

11. Security

Traffic is encrypted in transit. Database access is governed by row-level security, so one customer cannot read another's pages or drafts. Passwords are hashed by our authentication provider and are never visible to us. No service can promise perfect security, and the public nature of published pages described in section 5 is a deliberate design choice, not a flaw.

12. Changes

If we change this policy we will update the date at the top of this page, and for anything significant we will email you. Continuing to use Wish-ly after a change means you accept the updated policy.

See also our Terms of Service.