Privacy policy

Last updated October 24, 2026.

This is a plain-language policy written to match how Wish & Wrap actually works today. It has not yet been reviewed by a lawyer, and it will be updated after that review.

This policy covers the Wish & Wrap iPhone app, the web app at wishandwrap.com/app, shared shopping links, and this website. Wish & Wrap is operated by Josh Tipton. Questions go to [email protected].

The short version

• Your lists are private to your family, and you decide who in your family sees each list.
• We don't sell your data, we don't show ads, and we don't use advertising trackers.
• The person on a list never sees who reserved or bought a gift from it.
• Kids under 13 don't get their own login. A parent adds them and looks after their list.
• We never ask for a birth year, just the month and day if you want a birthday on the family calendar.
• Family names are never sent to the outside services we use to identify products.
• You can delete your account from inside the app at any time.

What we collect

When you create an account

• Your email address, used to send you one-time sign-in codes. There are no passwords.
• Whether you're 13 or older. We ask once, to decide whether you can have an account. We don't store your birth date.
• Your display name and avatar emoji, which your family sees.

Your family

• Names of the people you add, how they're related to you, an optional emoji, and an optional birthday month and day.
• Which family members are children you look after, and which have their own accounts.
• Occasions you celebrate and their dates.

Wish lists and shopping

• Wishes: names, brands, sizes, colors, notes, priority, quantities, price hints and product links.
• Who can see each list, and which wishes are hidden from which people.
• Shopping activity: reservations, purchase steps (bought, arrived, wrapped, given), gifts you're planning, and group-gift pledges. These are stored separately from lists and shown only to other shoppers, never to the person the gift is for.
• Shared links you create, including the name you give each link and when it was last used.

Photos, screenshots and links

• Photos and screenshots you take or pick to identify an item. On iPhone, photos are re-drawn and shrunk on your phone before upload, which drops location and camera details. Product photos you keep are stored in private storage that only your family can open.
• Product links you paste. Our server visits that page to read the product's name, details and picture.
• Voice: when you say a wish, Apple's speech recognition turns it into text. It runs on your iPhone when your phone supports that; otherwise Apple processes it under Apple's privacy policy. We receive only the text, and use it for the search.

Website

• Launch email list: if you leave your email on this website, we use it only to tell you when the app is available. You can ask us to remove it at any time.
• The public pages of this website don't use cookies or analytics. The web app keeps your sign-in session in your browser's local storage so you stay signed in.

Usage and technical information

• Basic, content-free usage counts, such as "a wish was added by barcode" or "an item search succeeded." These events can't include names, gift titles, photos or links, and nothing is recorded from children's sessions. We don't use third-party analytics or advertising SDKs.
• Technical logs kept by our hosting providers to run the service, keep it secure and fix problems, such as request times, error messages and IP addresses.

How we use it

• To run Wish & Wrap: sign you in, show lists to the right people, keep shopping secret, and count down to your family's occasions.
• To identify products you search for, scan or photograph, and to suggest stores that carry them.
• To keep the service secure and prevent abuse, such as limiting repeated sign-in attempts.
• To understand, in aggregate, which features work and which don't.
• To reply when you contact us.

We don't sell personal information, share it for targeted advertising, or use your lists to profile you.

AI and other services we use

We send each service only what it needs for that one job.

• Supabase hosts our database, sign-in and private photo storage, and runs our server code.
• Resend delivers sign-in code emails.
• Google Gemini (AI) helps identify an item from the words you search or a photo you choose, and suggests stores that are likely to carry an item. Only the search words or photo go to Google. Family names are removed from searches before they're sent.
• UPCitemdb and Open Food Facts look up barcodes. Only the barcode number is sent.
• SearchAPI (being tested, not yet on for everyone) looks up current prices for an item. Only the product's name or barcode is sent.
• Retailer websites: when you paste a link, or when we fetch a product picture, our server requests that page or picture from the store. This request comes from our server, not your device, and doesn't include any of your information.
• Cloudflare hosts this website.
• Apple distributes the app and provides speech recognition.

We may also share information if the law requires it, to protect people's safety, or as part of a sale or merger of Wish & Wrap, in which case this policy would continue to apply to your information.

Affiliate links and tracking

Today, the store links in Wish & Wrap are ordinary links. In the future some may be affiliate links (see our affiliate disclosure). An affiliate link adds a tag that identifies Wish & Wrap as the referrer. It doesn't include your name, your family's names or anything on your lists. Once you're on a retailer's site, that retailer and its affiliate network may use cookies or similar technology to record that you came from Wish & Wrap, under the retailer's own privacy policy. Store links open in your browser or the store's own app.

Children's privacy

Wish & Wrap is not directed to children under 13, and children under 13 cannot create accounts or sign in. A parent or guardian can add a child as a profile that the parent manages. For a child profile, the parent may add the child's name, relationship, an optional birthday month and day, and the child's wishes, and may share that list with family members they choose. We don't collect information directly from children under 13. We don't record usage events from children's sessions.

A parent can review, change or delete a child's profile and wishes in the app at any time, or ask us to do it by emailing [email protected]. Teens 13 to 17 can have their own account and keep their own list.

If you believe a child under 13 has signed up for their own account, please contact us and we'll delete it.

How long we keep information

• Your account, family and lists are kept while your account is active.
• When you delete your account in the app, we delete your account and your lists. Some data may stay in our providers' backups for a limited time before it's overwritten.
• Shared links stop working when they expire or when you turn them off.
• Launch list emails are kept until you ask us to remove them or we no longer need them to announce the launch.

How we protect it

• All connections use encryption in transit (HTTPS).
• Database rules check, on every request, that you're a member of a family before showing you its lists, and keep shopping activity hidden from the person a gift is for.
• Photos are kept in private storage and are only shown to members of the family they belong to, or through a shared link the family created.
• Keys for outside services are kept on our servers, never in the app.

No system is perfectly secure. If we learn of a breach that affects your information, we'll tell you as the law requires.

Your choices and rights

• Edit or remove wishes, people and occasions at any time.
• Choose who can see each list, and hide individual wishes from individual people.
• Turn off any shared link from the app.
• Delete your account in the app under Settings.
• Email us to ask for a copy of your information, or to correct or delete it. We'll respond within a reasonable time and may need to confirm it's really you.

Depending on where you live, you may have additional rights under local law. We'll honor requests made under those laws.

Changes to this policy

If we make a significant change, we'll tell you in the app or by email before it takes effect. The date at the top shows when this policy last changed.

Contact

Email [email protected] or visit our contact page.