Privacy Policy for WishTogether

Last Updated: Oct 28, 2026

Introduction

WishTogether ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we access, use, store, and share Google user data when you use our application, and describes the diagnostic data covered in a separate section below.

Google User Data We Access

When you sign in to WishTogether using Google Sign-In, we access the following information from your Google account:

  • Email Address: Your Google account email address.
  • Display Name: Your Google account display name (if available).
  • User ID: A unique identifier associated with your Google account (provided by Firebase Authentication).
  • Authentication Tokens: Temporary access tokens and ID tokens used solely for authentication purposes.

How We Use Google User Data

We use the Google user data we access for the following purposes:

  1. Authentication: To verify your identity and allow you to sign in to WishTogether.
  2. Account Creation: To create and maintain your user account in our system.
  3. User Identification: To identify you within the application and associate your data (wishlists, groups, items) with your account.
  4. Communication: To display your name and, where applicable, email address to other users in groups you belong to.
  5. Service Functionality: To enable core features of the application, including:
    • Creating and managing wishlists.
    • Creating and joining groups.
    • Sharing wishlists with groups.
    • Managing gift claims and preferences.

How We Store Google User Data

  • Storage Location: Your email address, display name, and related profile data are stored in Google Cloud Firestore, a cloud database service provided by Google.
  • Data Format: User data is stored in a structured format in our Firestore database under the "users" collection and other related collections for groups and wishlists.
  • Retention: We retain your Google user data for as long as your account is active. You can delete your account and its associated data at any time from within the app, or by contacting us using the details below.
  • Security: Data is stored using industry-standard security measures provided by Google Cloud Platform, including encryption at rest and in transit.

How We Share Data with Third-Party Services

  1. With Third-Party Services: We use the following third-party services that may process your data:
    • Firebase Authentication: For user authentication and account management.
    • Cloud Firestore: For storing user profiles, groups, wishlists, and items.
    • Google Sign-In: For the authentication flow and retrieving basic profile information as described above.
    • Sentry: For crash and failure diagnostics, as described under Diagnostics and Crash Reports. From the app's own reports, Sentry receives no name, email address, phone number or sign-in token.
  2. We Do NOT:
    • Sell your Google user data to third parties.
    • Share your Google user data with advertisers.
    • Use your Google user data for purposes other than those described in this policy.

Your Rights and Choices

  • Access: You can view your stored data (such as your profile information, wishlists, and groups) through the application's user interface.
  • Modification: You can update your display name and other editable profile information through the application, where such features are provided.
  • Deletion: You can delete your account and all associated data directly in the app, from your profile page. See Account and Data Deletion below for exactly what is removed. You can also contact us using the details below.
  • Revocation: You can revoke WishTogether’s access to your Google account at any time via your Google Account settings.

Account and Data Deletion

You can delete your account from inside the app: open your profile and choose Delete account. For your security we ask you to confirm your identity again before the deletion runs.

Deleting your account:

  • deletes your profile (name, email address and phone number);
  • deletes the wishlists you own, together with their items;
  • removes you from every group you belong to, and hands a group you own to another member — a group is deleted only if you were its last member;
  • leaves items you claimed in other people's wishlists marked as claimed, so that the same gift is not bought twice.

If you signed in with Apple, we also show you how to remove WishTogether from your Apple ID (Settings → your name → Sign in with Apple), so Apple stops sharing your Apple ID with us.

Deletion is immediate and cannot be undone. Encrypted backups of our database may retain a copy of your data for a limited period before they expire; those backups are used only to restore the service after a failure.

Diagnostics and Crash Reports

To find and fix crashes and failures, WishTogether uses a third-party crash-reporting service, Functional Software, Inc. ("Sentry"), which processes this data on our behalf in the United States. From the app's own reports, Sentry does not receive your name, email address, phone number or sign-in tokens.

When the app reports a problem, it sends:

  • the type of error and a technical trace of where in the app it happened;
  • the last 30 steps the app took beforehand: which screen (by pattern, never its contents) and whether an action succeeded or failed, with a short error code;
  • the app version, the platform (web or iOS, plus the operating-system version), and a random code generated for that launch;
  • while you are signed in, a short one-way code derived from your account identifier, so reports from one account can be grouped. It cannot be turned back into your account, and it is removed when you sign out.

The six-character code shown in the app — on your Profile page, or on the login page while you are signed out — identifies that launch, so a report the app sends can be matched to what you describe to us.

On iOS, the app also sends a short record when it starts and when it returns after a long pause in the background: an identifier for that run, a random identifier for this installation of the app (the same on every launch unless you reinstall the app or the system clears its cache), whether the run ended normally, when it started and how long it lasted, how many errors it recorded, the app version, and whether this is the production or a development build. It contains no screen or content data, and it does not include the one-way code derived from your account identifier.

What the app never sends:

  • your name, email address or phone number;
  • the contents of your wishlists, groups or items — their titles, descriptions or links;
  • who claimed which item;
  • screenshots or recordings of your screen.

Sentry is configured not to attach your IP address to reports.

Why: only to diagnose and fix problems. We do not use it for advertising or tracking, do not sell it, and do not share it for any other purpose.

How long: 30 days, after which it is deleted.

Deleting it: deleting your account removes the account code from later reports, so they are no longer linked to your account; the app keeps sending reports that contain no account link. Reports are deleted after 30 days. To have them removed sooner, see Contact Us below.

A limit on our filtering: some crash reports — for example a crash inside iOS itself, or a JavaScript error in the browser — are produced by the platform's own tooling rather than by the app, so the app's own filtering does not apply to them. Those reports can include the platform's own context: for example the app moving between foreground and background, a network request's address, the error's own message text, or the page address, which can contain a wishlist or group id. We do not add any of the items listed above ourselves, but we cannot filter what the platform produces.

Data Security

We implement appropriate technical and organizational measures to protect your Google user data, including:

  • Encryption of data in transit using HTTPS/TLS.
  • Encryption of data at rest in Google Cloud Firestore.
  • Access controls limiting who within our organization can view and modify your data.
  • Use of security features offered by Firebase and Google Cloud Platform to help protect your data.

Children's Privacy

WishTogether is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately so we can take appropriate action.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this document. Your continued use of WishTogether after any changes are made constitutes acceptance of the revised policy.

Contact Us

If you have questions about this Privacy Policy or how we handle your Google user data or diagnostic reports, please contact us at:

Email: christopherkelly92@gmail.com

To have diagnostic reports we have already received deleted before the 30 days are up, email us. If the app is still open, include the six-character support code shown in the app and tell us roughly when the problem happened — the code changes each time the app starts. If you have already deleted your account and restarted the app, we may not be able to locate the earlier reports; they are deleted within 30 days in any case.

Google API Services User Data Policy Compliance

This Privacy Policy is designed to comply with the Google API Services User Data Policy. In particular, we:

  • Only request access to Google user data that is necessary for the application's functionality.
  • Use Google user data solely for the purposes described in this policy.
  • Do not transfer Google user data to third parties except as described in this policy.
  • Provide clear disclosure of our data practices.
  • Allow users to revoke access to their Google account at any time via Google Account settings.