Privacy

• Lists and wishes. The child’s name, the list’s link, its emoji or photo, theme and date, your message to guests, and each wish’s name, shop link, price, picture link, category and note. We keep them so the people you share the list with can see it.
• Photos. If you add a photo, your phone crops it and makes a fresh copy before sending it, so its location and camera details never leave your phone. We remove anything left over. The photo appears on the list page itself, nowhere else.
• Names guests type. When someone marks a gift, the name they type is shown to the list’s grown‑ups, never to other guests, so nobody buys the same gift twice and you know whom to thank. Their own phone remembers the name for next time; we don’t keep it anywhere else.
• Accounts. If you sign in: your email address (when you use an email code, or when Apple or Google share it with us), a name if you give one, and the ID Apple or Google uses for you. There are no passwords. We store sign-ins only in scrambled (hashed) form. With Apple we also keep a token Apple gives us, so we can end the connection when you delete your account. Lists you save and gifts you mark while signed in belong to your account, so you see them on every device.
• Cookies. Only the ones My Little Wishes needs to work: one that lets you edit the lists you made, one that remembers the gifts you marked on this phone, one that keeps you signed in, and short-lived ones while you sign in. No tracking or advertising cookies, which is why there’s no cookie banner.
• Lists made with ChatGPT or Claude. If you ask ChatGPT or Claude to make a list, it sends us your child’s first name and the gift ideas (we never see the chat). They wait as a draft for up to 7 days until you open the link and tap Make this list mine, and then become a normal list; we also keep a scrambled form of who asked (ChatGPT’s anonymous ID for you, or your network) with the draft, to limit how many are made a day.
• Popular gifts. Once a day we count which shop links families added in the last 90 days. A link shows on Popular gifts only once 5 or more families have it, as “On 5+ lists” with the shop’s own name and picture. We keep only that count, never names, notes, list names or who gives what, and a deleted list stops counting at the next day’s count.
• Technical data. Your IP address is used for a minute at a time to stop scripts flooding the site. When you ask for an email code we keep a scrambled form of it for a day. Cloudflare keeps short request logs for a few days, which we read only to fix errors.

No analytics, no ads, no trackers or third-party scripts, and we never sell or share your data for marketing. The only email we send is your sign-in code.

• Kept out of search. Every list asks search engines not to show it. Only the front page and this page may appear in search.
• Seen by people with the link. Anyone with a list’s link can open it. Links are short and friendly, so they can be guessed: a first name or nickname is enough, and put only what you’d show family and friends.
• Guests see little. Guests see which gifts are taken. They never see who saved the list, who else looks after it, or anyone’s email.
• No photo in previews. Your child’s photo never goes into the preview a chat app shows for the link. Previews show a product picture or the My Little Wishes card.

• Cloudflare hosts the site and its database (Cloudflare, Inc., USA, under a data processing agreement with the EU’s standard contractual clauses).
• Resend sends sign-in codes from its servers in Ireland (Resend, Inc., USA, under a data processing agreement with the EU’s standard contractual clauses). It sees your email address and the code.
• Apple and Google are involved only if you choose to sign in with them. They tell us it’s you and, if you allow it, your email and name. Their own privacy policies apply there.
• Shops. When you paste a product link, our server reads that page for its name, picture and price. Pictures are shown through our server, so shops don’t see who looks at your list.

• Lists, wishes and photos stay until a grown‑up who looks after the list deletes them.
• Accounts stay until you delete yours. Staying signed in on a device ends after 180 days without a visit, and after a year at most.
• Sign-in codes last a day, and Cloudflare’s request logs a few days.
• Backups. Cloudflare keeps restore points of the database for up to 30 days, so anything deleted is gone from those too after that.
• Drafts from ChatGPT or Claude go as soon as you make the list. One you never use stops working after 7 days and is deleted within a day after that.

• A list. Open it and tap ··· (List settings), then Delete list. The list, its wishes, its photo and the names guests typed are gone at once.
• Your name on a gift. Open the gift on the phone you marked it with, or while signed in, and take it back. Your name goes with it.
• Your account. Tap your initial on the home page, then Delete account. Your account and every sign-in go at once, with your saved lists. Lists only you look after are deleted too (we ask first). Gifts you’re giving stay marked as taken, without your name, so nobody buys them twice.

Can’t find it? Write to hello@mylittlewishes.com and we’ll delete it for you within a month.

Under the GDPR you can ask to see the data we hold about you, correct it, delete it, get a copy, or object to how we use it. Write to hello@mylittlewishes.com. If you think we got something wrong, you can complain to IMY, the Swedish Authority for Privacy Protection (imy.se).

We use your data to give you the service you asked for (GDPR article 6(1)(b)) and to keep it safe from abuse (our legitimate interest, article 6(1)(f)). My Little Wishes is for grown‑ups: we don’t offer accounts to children.

My Little Wishes (“we”, “us”) is responsible for your data. Questions, or anything you’d like us to change or delete: hello@mylittlewishes.com.