Privacy Policy

This policy explains what personal information we process when you use My Wishlist Online: the app for iPhone and Android, the web version of the app, the pages of lists you share, and this website (mywishlistonline.com). It also explains your rights and how to reach us.

The short version

• We are a company based in Germany. The data you store with us is kept on servers in Germany, and the EU General Data Protection Regulation (GDPR) applies.
• We use your data to run the wishlist service: your account, your lists, sharing, friends and notifications.
• Anyone who has the link to one of your shared lists can see that list.
• The pages of this website set no cookies and contain no advertising trackers.
• You can delete your account in the app at any time.
• Questions? Write to support@mywishlistonline.com.

Who is responsible

The controller responsible for your data under the GDPR is:

Represented by its general partner, Reger Verwaltungs GmbH, which is represented by its managing director, Simon Reger. Registered at the Local Court (Amtsgericht) of Passau, HRA 14111. More details are in our Legal Notice.

Email: support@mywishlistonline.com

Data protection officer: masterstudios@me.com

What we collect and why

Your account

When you open the app for the first time, it creates an account for you on our server, even if you choose “Use the app without signing up”. Without an email address, your lists are tied to this installation of the app. For this account we store:

• an account number and a login token,
• the type of device (iPhone, Android or web browser) and the app version,
• the IP address and the browser or app identification string (user agent) at the time the account is created,
• when the account was created, when you last used it and how often the app was opened,
• whether the account belongs to the US or the German version of the service. The app decides this once, when the account is created: on iPhone from the country of your App Store account, on Android from your SIM card, mobile network or region settings.

If you add your email address, we also store it and send you a one-time login code by email. A code is valid for 10 minutes. You can also set a password. We never store passwords or login codes in plain text. You can choose a display name and upload a profile picture. You do not have to use your real name.

Your lists and wishes

We store what you put into the service: list names and descriptions, list settings, and your wishes with title, link, price, picture, notes and priority. Pictures come from the store page or from your camera or photo library, if you allow access. We also store your friends, friend requests, groups, the people who can edit a list with you, comments, and which wishes were marked as bought.

Notifications

If you allow notifications on your device, we store a push token for your device. We use it to tell you, for example, that a friend added a wish, commented on a wish or sent you a friend request. The notification shows your friend's display name. You can turn notifications off in your device settings, and choose which ones you get under “Profile settings” in the app.

Emails

We send emails that belong to the service: login codes, a welcome email, a confirmation with the link when you create a list, friend requests, comments on your wishes and password resets.

We do not send marketing newsletters.

Product links and the in-app browser

When you add a link to a product, our server loads the product page to read the title, picture and price. For some stores we use a service that loads web pages for us. We may also use automated tools, including an AI model, to sort products into categories. In both cases we send only product information, such as the link, title, store and price, and nothing about you.

The app includes a browser for shopping (“Shop”). Store pages open directly from the store, and the store can set its own cookies there. When you tap to add a product to your wishlist, the app reads the product details from the page you are looking at. To find and fix errors in this product detection, we log technical events, such as which store page was read and whether a title and price were found, together with your installation ID and account number.

Usage, security and error data

• App starts and sign-in screen. We record when the app is started or brought back to the foreground, and which button was tapped on the sign-in screen (for example “Sign up” or “Send code”). We also record when you open a push notification and, in the web version, whether the hint to get the app was shown or tapped, whether an email address was entered for it and whether a list template was copied. We store the time, type of event, platform, app version and a random ID of your app installation, plus your account number once you are signed in. We do not store what you type or your IP address. This shows us where people get stuck when they start using the app. When you create an account, use the app without signing up or sign in, we store the installation ID with your login session. From then on, the events recorded on this installation before you signed in are linked to your account. The ID belongs to the installation, not to a person: if several people use the same installation, events one person causes before signing in can be linked to another person's account.
• “Get inspired”. We record how you use the “Get inspired” section, together with your account number and installation ID.
• Sign-in security. We log every sign-in attempt and every new sign-up: time, method, success, platform, the account concerned and the IP address. For IPv6 addresses we keep only the first part (/64). We do not log the email, password or code you entered. We use this log to block repeated failed attempts and too many sign-ups from one connection, and to detect attacks. When you request a code by email, we store your email address, the code only as a hash, the number of attempts and a hash of your IP address, so we can limit how often codes are requested.
• Crash and error reports. If something goes wrong, the app sends a report to our server: the error message, technical details, device model, operating system, app version, your account number and your IP address.
• Server logs. Like every web server, ours log requests with the IP address, the time, the page or file requested and the browser type, for security and to keep the service running.

Google Firebase in the app

Our iPhone and Android apps include software from Google Firebase. We use Firebase Cloud Messaging to deliver push notifications. On iPhone, Firebase hands notifications to Apple's push service. In the current app version, the Firebase components are also set up to send crash reports (Crashlytics), performance measurements and usage statistics (Google Analytics for Firebase) to Google. This data can include an ID for your app installation, device model, operating system, app version, country, and automatically recorded events such as the first start of the app and app sessions. On Android it can include your device's advertising ID. You can reset or delete that ID in your Android settings.

Shared list pages

People you share a list with do not need the app or an account. When they open your link:

• Marking a gift as bought. If a visitor marks a wish as bought, we store their IP address with the wish and set a cookie in their browser that lasts one year. Together, the IP address and the cookie let them, and only them, undo their own mark later.
• Comments. If the list allows comments, visitors can leave one. We store the name they enter, the comment and their IP address. For visitors without an account, we remember the name in a cookie for 30 days, and Cloudflare Turnstile checks that a person, not a bot, is writing. The list owner is notified of new comments.
• Cookies. Shared list pages use only these technically necessary cookies and a small note in the browser's storage that the cookie notice was confirmed.
• Product pictures. Pictures of products are often loaded directly from the store's website. The store's server then receives the visitor's IP address.

This website

The pages of mywishlistonline.com set no cookies. They contain no Google Analytics, no advertising pixels and no social media plugins, and all fonts are served from our own server. To count visits, we use Umami, an analytics tool that runs on our own server in Germany and works without cookies. Umami records which pages are viewed, the page you came from, your approximate location at country level, device type, browser, operating system and language, and clicks on buttons such as the app store links. It uses your IP address only to work out these figures and does not store it. The results are statistics that do not identify you. Our web server also keeps the server logs described above.

The web version of the app (under mywishlistonline.com/app/) is part of the app, not of these pages. It keeps you signed in with a cookie and stores your settings in your browser's local storage. When you sign up, request a login code or change settings there, Cloudflare Turnstile checks that you are a person.

Data on your device

The app stores your login token, a random ID for your app installation and your settings on your device. If you back up your device to iCloud or Google, this data can be part of that backup. The installation ID stays the same when you log out. It is deleted when you remove the app, when you delete your account in the app or, in the web version, when you clear the website data in your browser.

When you contact us

If you email us or use “Contact & help” in the app, we use your email address, your message and any details you send to answer you.

Legal bases

The GDPR requires a legal basis for each use of personal data. These are the ones we rely on:

Where we rely on legitimate interests, you can object at any time (see “Your rights”).

Who can see your lists

• People with the link. Anyone who has the link to a shared list can open it in a browser and see the list name and description, the wishes, your display name and, if you allow them, comments. They can forward the link to others. A list set to “Only visible to me” cannot be opened through its link.
• Gift reservations. When someone marks a wish as bought, other people who open the list see that it is taken. You do not see it, unless you turn on “Show me ‘bought’ marks” for that list.
• Friends and groups. Your friends and the members of your groups see your lists, except lists set to “Only visible to me”. They also see your display name, your profile picture and the date you were last online.
• Finding you. Other users can search for your display name to send you a friend request. Search results show the display name and profile picture.
• “Get inspired”. Wishes from lists that are not set to “Only visible to me” can appear in the “Get inspired” section of other users in the US, without your name: title, picture, price, store and link. Other users can copy such a wish to their own lists. To keep a list out of it, set the list to “Only visible to me”.
• Search engines. We tell search engines not to index shared list pages.

Affiliate links

My Wishlist Online is free. We earn money through affiliate links. When you or a visitor of your list opens a store link, we may turn it into an affiliate link. If someone then buys something, the store pays us a small commission. The price stays the same.

• For amazon.com, we take part in the Amazon Associates Program. As an Amazon Associate we earn from qualifying purchases.
• For some other stores, mostly in Europe, we take part in partner programs run by affiliate networks.

The affiliate link contains our partner ID and a label that shows where the click came from, such as the app or the web. It does not contain your name, your email address or your account number. The store or the affiliate network sets its own cookies on its own website to connect the purchase to our link. That happens under their privacy policies. The reports we receive show sales and commissions, not who made the purchase.

Service providers and other recipients

We use these providers to run the service. They process data on our behalf and under our instructions.

Apple and Google also process data as independent companies when you download the app from their stores, rate it or receive push notifications. Their own privacy policies apply. The same is true for stores and affiliate networks when you visit their websites. We disclose data to authorities only if the law requires it.

International data transfers

We store your data on servers in Germany. If you use My Wishlist Online from the United States, your data is transferred to Germany. Some of our providers, such as Google and Cloudflare, may process data in the United States or other countries outside the European Union. In those cases, we rely on the EU-U.S. Data Privacy Framework, where the provider is certified under it, or on the Standard Contractual Clauses of the European Commission. You can ask us for a copy of these safeguards.

How long we keep your data

If the law requires us to keep certain data longer, for example for tax purposes, we block it from any other use until the period ends.

Deleting your account

In the app, open “Profile settings” and tap “Delete account” at the bottom. After you confirm, we delete your account right away. This cannot be undone. Removing the app from your phone does not delete your account.

We delete your account, your lists and wishes, your friends and friend requests, your group memberships, your access to lists of others, your activity messages and your login sessions. We also remove your account number from the app start and “Get inspired” logs. The sign-in security log is deleted after 90 days as described above.

A few things are not yet removed automatically: pictures you uploaded, comments you wrote on other people's wishes and error reports linked to your account. If you want those deleted too, email us and we will delete them.

If you cannot open the app anymore, email us from the address linked to your account and we will delete it for you.

Your rights

Wherever you live, you have these rights under the GDPR:

• Access: get a copy of the personal data we hold about you.
• Correction: have wrong or incomplete data corrected.
• Deletion: have your data deleted.
• Restriction: have the use of your data limited.
• Portability: receive the data you gave us in a common, machine-readable format.
• Objection: object to uses based on our legitimate interests.
• Withdrawing consent: withdraw a consent at any time, for example by turning off notifications.

To use these rights, email support@mywishlistonline.com. We may ask you to write from the email address linked to your account so we can confirm it is you. We answer within one month, as the GDPR requires. In complex cases this period can be extended.

You also have the right to complain to a data protection authority, for example where you live or work. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

Your rights in US states

If you live in a US state with a consumer privacy law, such as California, you may have the right to know what personal information we collect, use and disclose, to get a copy of it, to have it corrected or deleted, and to opt out of its sale or sharing. We will not treat you differently for using these rights.

What we collect

In the last 12 months we have collected these categories of personal information:

Sources: you, your device, people you interact with in the service (for example friends and visitors of your lists), and store websites (product details).

Purposes: the purposes described in “What we collect and why”. We use account login information only to let you sign in.

Disclosure: we disclose personal information for business purposes to the service providers listed above: hosting, push notifications and app diagnostics, bot protection and email delivery.

Retention: see “How long we keep your data”.

Selling and sharing

We do not sell your personal information for money. This website uses no advertising cookies or cross-site trackers. Our app includes Google Analytics for Firebase, as described above. To opt out of any sale or sharing of your personal information, email us with the subject “Do not sell or share”.

We do not disclose personal information to third parties for their own direct marketing.

How to make a request

Email support@mywishlistonline.com. We will confirm your identity, usually by asking you to write from the email address linked to your account. You can also use an authorized agent. We may ask the agent for proof of your permission. If we decline your request, you can appeal by replying to our answer.

Global Privacy Control and Do Not Track

Browsers can send a Global Privacy Control or Do Not Track signal. The pages of this website do not track you across other websites, so these signals do not change anything here.

Children

My Wishlist Online is not directed at children under 13. We do not knowingly collect personal information from children under 13. Parents can create lists for their children from their own account. If you believe a child under 13 has given us personal information, please contact us at support@mywishlistonline.com and we will delete it.

Security

We protect your data with technical and organizational measures. All connections to our servers are encrypted with HTTPS. Passwords and login codes are never stored in plain text. No system is perfectly secure, so please use a password you do not use anywhere else.

Changes to this policy

We update this policy when our service or the law changes. The date at the top shows the latest version. If a change matters to you, we will tell you in the app or by email before it takes effect.

Contact

For any question about your data, write to support@mywishlistonline.com or to our postal address above. More help is on our Support page.