Privacy Policy

Last updated:

This policy explains what personal data Wishlist Watch collects when you use wishlist.watch, the Wishlist Watch iPhone app, the browser extension and the Wishlist Watch: Price Alerts app for AI assistants, why we collect it, and the choices you have.

Who we are

The controller of your personal data is Questly Kft. (Hungary), which operates Wishlist Watch. Contact: [email protected].

What we collect

  • Account data: your name, email address and profile picture, from Google or Apple when you sign in with them, or the email address you sign up with.
  • Your content: wishlists, items, product links, notes, prices and price history, and the email addresses of the people you share lists with or invite.
  • Friends' lists: the names of people who shared a list with you and the contents of those lists.
  • Gift reservations: which items you reserve on other people's lists. List owners are never shown who reserved an item.
  • Usage data: pages viewed and features used, device and browser type, collected with PostHog (EU hosting) to improve the product.
  • Payment data: if you buy a subscription, payment is handled by Stripe on the web, or by Apple or Google in the apps. We never see your full card details. Your name, address and tax number, if given, are used for the receipt or invoice.

How we use it

  • To run the service: store your lists, share them, and show givers what is already taken.
  • To fill in product details and watch prices for the links you add.
  • To send emails you expect, such as invitations, reservation updates and price drop alerts.
  • To keep the service secure, prevent abuse, and understand which features are used.

The legal bases are performing our contract with you, our legitimate interest in running and improving the service, and your consent where it is required.

AI assistant connectors

You can connect Wishlist Watch to ChatGPT, Claude or Gemini. The assistant gets access only after you sign in to Wishlist Watch and approve it (OAuth). It can then, on your behalf, read and change your wishlists and items, read lists friends shared with you and their names, reserve gifts, and send invitations to email addresses you give it. Deleting or sharing a list always asks for your confirmation first. What you tell the assistant and what it receives from us are also processed by that assistant's provider under its own privacy policy. You can revoke access at any time by disconnecting Wishlist Watch in the assistant, or by asking us at [email protected]. Access tokens also expire on their own when unused.

Who we share it with

We do not sell your personal data. We use these processors:

  • Supabase, self-hosted on our own server, for accounts and lists.
  • Google and Apple for sign-in.
  • Resend for transactional email.
  • PostHog (EU) for product analytics.
  • Stripe for web payments.
  • Apple and Google for in-app purchases, through RevenueCat.
  • Billingo for receipts and invoices.
  • Bright Data to fetch the shop pages of links you add (only the page address, not your account data).
  • OpenRouter, which routes to an AI model, to read product names and prices from those pages (only the page content, not your account data).
  • Affiliate networks (Amazon Associates, AliExpress Portals, Awin, Sovrn) when someone opens an affiliate shop link; see below.
  • AI assistants you connect yourself (ChatGPT, Claude, Gemini), as described above.

Affiliate links

Some shop links are converted into affiliate links of the networks above. If someone buys through them we may earn a commission at no extra cost to them. The shop and the network see the click as they would any other visit, with our affiliate ID; we do not send them your account data.

Who can see your wishlists

Wishlists are never public. There is no public directory of wishlists. A list is visible only to you and the people you invite. Shared wishlist pages are excluded from search engines.

How long we keep data

We keep your data while your account is active. When you delete a list it is removed from the service; when you delete your account or ask us to, we delete your personal data within 30 days, except what we must keep by law (such as invoices). Connector access tokens are deleted when they expire or are revoked.

Your rights

You can ask to access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time by emailing [email protected]. You can also delete your account in the app. If you are in the EU or UK you may also complain to your local data protection authority (in Hungary, the NAIH).

Cookies

We use cookies that are needed to keep you signed in, and analytics cookies to understand how the product is used.

Children

Wishlist Watch is not meant for children under 16 without a parent or guardian setting up and managing the account.

Changes

If we change this policy we will update the date above, and tell you in the app or by email when the change is significant.

Contact

Questly Kft., [email protected]