Privacy policy

Wishsmbdy is a small app for making digital cards and sending them to people you know. We collect only what the app needs to work: your Google sign-in details, the cards you make, and a simple count of when a card you sent is opened. We don't sell your data, we don't show ads, and we don't run third-party analytics or tracking cookies.

Your account. You sign in with Google. From Google we receive your name, email address, and profile picture, and we use them only to create and identify your Wishsmbdy account. You then choose a username, and can set a display name, an avatar, and preferences (like dark mode) — all stored with your profile.

Your cards. Everything you put on a card is stored so the card works: text, photos you upload, audio you record or import, images, GIFs, stickers and music you add through the built-in searches, and the usernames of the people you address a card to.

Card opens. When someone opens a card link, we record that an open happened, the rough browser family it came from (for example “mobile Safari” — nothing that identifies a person), and, if the viewer is a signed-in addressee, which account opened it. This exists so the sender can see their card was received.

Reports and feedback. If you report a card or send feedback, we keep the message you write and, only if you choose to give it, a contact address so we can follow up.

Cookies. We use cookies only to keep you signed in. There are no advertising or analytics cookies.

Signing in with Google is the only thing we use Google for. We request only your basic profile (name, email address, profile picture) and never ask for access to your Gmail, Drive, contacts, or anything else in your Google account.

Wishsmbdy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To run your account and keep you signed in.
• To store, publish, and deliver the cards you make.
• To show senders that their card was opened.
• To act on abuse reports and answer feedback.

That's the whole list. We never sell personal data, and we don't use it for advertising.

A card you publish gets a private link. Anyone who has that link can open the card, so share it with the people you mean to. Cards you address to a Wishsmbdy username also appear on that person's “Received” page. Unpublishing a card takes its link out of service right away.

Wishsmbdy runs on a small set of providers that process data on our behalf: Supabase (database, sign-in, and file storage), Vercel (hosting), and Google (sign-in only, as described above).

The built-in media searches (Unsplash photos, GIPHY GIFs and stickers, Jamendo music, Spotify song search) send your search words to those services to fetch results. Media you pick is copied into Wishsmbdy's own storage, so people opening your card don't contact those services — with one exception: a card with a Spotify song embeds Spotify's own player, which is loaded from Spotify and covered by Spotify's privacy policy.

We keep your data for as long as you have an account. You can delete your account yourself in Settings → Security — that removes your account, profile, and cards, and the links to cards you sent stop working. If you'd rather we do it, get in touch and we'll delete it for you.

Wishsmbdy isn't directed at children under 13 (or the minimum age in your country), and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll remove it.

If this policy changes in a way that matters, we'll update this page and its date. Questions, or a privacy request? Email hadalisha06@gmail.com or use the feedback page when signed in.