Privacy policy

1. Who we are

Wishly is operated by Stephen Ofori Yeboah, a sole trader based in Ghana, at North Legon, Accra, Ghana. We are the data controller for the information described here. Reach us at ask.wishly@gmail.com.

2. What we collect

Your account. Your email address. If you sign in with a password, it is hashed and stored by our authentication provider — we never see it. If you sign in with Google, we receive your email address, name and profile picture from Google; we store your email address. We get no other access to your Google account.

What you build. Everything you enter in the editor: names, titles, messages, the birthday note, photos you upload, your cake and music choices, and the optional PIN that gates your page.

Wishes from friends. If you share a contribution link, we store the name a contributor types, their written message or their video or voice recording (up to a minute, depending on the kind of page), any photos they add to a Group Tribute, and a still frame taken from a video for use as a thumbnail. A contributor can also choose to leave an email address, to be told when the page is live or to be reminded before their own birthday. If they do, we store that address and, for a reminder, the day and month of their birthday, and use them only for what they ticked.

Payments. We never see your card number or mobile money PIN — those go directly to Paystack. We store the Paystack transaction reference, the amount, the currency, the channel you paid by, the status, and the response Paystack sends back.

Usage. We measure how Wishly is used, so we can fix what breaks and see which parts people reach. Two tools do this. PostHog records the pages you open, the buttons and steps you use (starting a page or opening the publish screen, for example), errors the app runs into, the site you came from, any campaign tag in the link you followed, and general details about your device and location worked out from your IP address (country and city, browser, screen size). It also keeps replays of how screens were used: the clicks, scrolling and what was shown, with anything typed into a form field masked. If you are signed in, this is linked to your account and email address. Vercel counts page views and loading speed in aggregate, without cookies. We also keep a view counter on each published page. We run no Google Analytics and no advertising pixels, and we do not sell this data or share it for advertising.

Emails. We email you about your account and your payments. We also send a small number of reminders about a page you have started or published, such as when a friend adds a wish, the date is close, or a payment did not finish. Every reminder has an unsubscribe link.

How we use it. We use what you enter and upload to build, host and display your page, and to run and support the service. That includes occasional access to your content by us when it is needed to operate Wishly properly: for example to check that a feature such as the photo cut-out worked on your uploads, to fix a problem you report, or to respond to a moderation or legal request. We do not browse pages out of curiosity, and we never use your content for marketing or to train AI models.

3. Cookies and local storage

We use no advertising cookies. PostHog, the analytics tool described in section 2, keeps an identifier in your browser (a cookie and local storage) so that visits from the same browser are counted as one visitor. Your signed-in session is held in your browser's local storage by our authentication provider, which is what keeps you logged in between visits. Clearing your site data removes both and signs you out.

4. How the photo cut-out works

The background cut-out that turns your photo into the figurine look is produced by a specialised AI service (fal.ai) over an encrypted connection: it receives the photo you uploaded, returns the cut-out, and is used for nothing else. If that service is ever unavailable, the cut-out instead runs entirely inside your browser using a model your browser downloads and caches. Either way, only images you choose to keep stay on your page.

5. Published pages are public

When you publish, your page is reachable by anyone who has its link. Photos, videos and audio on it are served from public file addresses with long, unguessable names — unguessable is not the same as private. Anyone holding a link can open it, and deleting a page does not un-share a link somebody already copied. The optional PIN gates the page, not the individual file addresses. Please don't upload anything you would be upset to see shared.

6. Who else touches your data

We use a small number of service providers to run Wishly. They process your data on our instructions only:

• Supabase — database, sign-in and some file storage. Servers in Ireland (EU).
• Cloudflare — storing and delivering the photos, videos and audio on pages. Stored in Western Europe.
• Vercel — website hosting, content delivery, and aggregate page-view and speed measurement.
• PostHog — usage analytics, screen replays and error reports, as described in section 2. Servers in the United States.
• Paystack — payment processing. They handle card and mobile money details; we don't.
• Resend and Brevo — sending account, receipt and reminder emails.
• fal.ai — the photo cut-out described in section 4.
• Google — only if you choose to sign in with Google.

We do not sell your data. We do not share it for advertising. We will disclose information if the law genuinely requires it, and we will tell you unless we are forbidden from doing so.

7. Where your data is stored

Your account and pages live on servers in Ireland, in the European Union. The photos, videos and audio on pages are stored with Cloudflare in Western Europe and delivered through its worldwide network. Usage analytics are processed by PostHog in the United States. If you are in Ghana or elsewhere, that means your information is transferred to and stored in those places. Our static website is delivered from servers worldwide, but it carries no personal data.

8. How long we keep things

• Published pages and their uploads — twelve months from the date you publish, after which they are deleted.
• Drafts you never publish — until you delete them or close your account.
• Your account and email address — until you ask us to delete your account.
• Payment records — six years, because tax and accounting law requires it. These are kept even after a page is deleted.

9. Your rights

Under Ghana's Data Protection Act, 2012 (Act 843), and under the EU GDPR where it applies to you, you can ask us to give you a copy of your data, correct it, delete it, export it, or stop a particular use of it. You can also withdraw consent at any time.

Email ask.wishly@gmail.com and we will respond within thirty days. If you think we have handled your data badly, you can complain to Ghana's Data Protection Commission, or to your national supervisory authority if you are in the EU or UK.

10. Children

Wishly is not for children under 13, and we don't knowingly collect their information. If you believe a child under 13 has given us data, email us and we will delete it.

11. Security

Traffic is encrypted in transit. Database access is governed by row-level security, so one customer cannot read another's pages or drafts. Passwords are hashed by our authentication provider and are never visible to us. No service can promise perfect security, and the public nature of published pages described in section 5 is a deliberate design choice, not a flaw.

12. Changes

If we change this policy we will update the date at the top of this page, and for anything significant we will email you. Continuing to use Wishly after a change means you accept the updated policy.

See also our Terms of Service.