Privacy policy

Wishsmbdy is a small app for making digital cards and sending them to people you know. We collect what the app needs to work — your Google sign-in details, the cards you make, and a simple count of when a card you sent is opened — plus usage measurements (which pages get visited, what gets clicked, what breaks) so we can improve the app. We don't sell your data, we don't show ads, and nothing here is used for advertising.

Your account. You sign in with Google. From Google we receive your name, email address, and profile picture, and we use them only to create and identify your Wishsmbdy account. You then choose a username, and can set a display name, an avatar, and preferences (like dark mode) — all stored with your profile.

Your cards. Everything you put on a card is stored so the card works: text, photos you upload, audio you record or import, images, GIFs, stickers and music you add through the built-in searches, and the usernames of the people you address a card to.

Card opens. When someone opens a card link, we record that an open happened, the rough browser family it came from (for example “mobile Safari” — nothing that identifies a person), and, if the viewer is a signed-in addressee, which account opened it. This exists so the sender can see their card was received.

Reports and feedback. If you report a card or send feedback, we keep the message you write and, only if you choose to give it, a contact address so we can follow up. When a card is reported, we look at that card to decide whether it breaks our terms — reported cards are the only cards we review.

Usage analytics. We measure how the app is used: pages visited, buttons and features clicked, how long visits last, errors the app hits in your browser, and session replays — a reconstruction of how a visit moved through the app, which we use to find and fix problems. Replays are masked: the words, photos, and media on cards are blanked out before anything is recorded, so they show how the app behaved, not what you made. For signed-in users this is tied to your account; for someone just opening a card link it is not tied to a name. This is processed for us by PostHog (see “Services we rely on”) and used only to improve Wishsmbdy — never for advertising, and never sold.

To say that plainly: this measurement is about how the app is used, not about who you are. We use it to make Wishsmbdy better, and for nothing else — we don't build profiles of you, don't read through your cards, and don't sell, rent, or share anything about you with anyone for their purposes.

Cookies. We use cookies only to keep you signed in. There are no advertising or analytics cookies — usage analytics keeps its small memory in your browser's local storage instead.

Signing in with Google is the only thing we use Google for. We request only your basic profile (name, email address, profile picture) and never ask for access to your Gmail, Drive, contacts, or anything else in your Google account.

Wishsmbdy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To run your account and keep you signed in.
• To store, publish, and deliver the cards you make.
• To show senders that their card was opened.
• To email you when you receive a card — you can turn this off in Settings → Notifications.
• To act on abuse reports and answer feedback.
• To understand how the app is used and fix what breaks.

That's the whole list. We never sell personal data, and we don't use it for advertising.

A card you publish gets a private link. Anyone who has that link can open the card, so share it with the people you mean to. Cards you address to a Wishsmbdy username also appear on that person's “Received” page. Unpublishing a card takes its link out of service right away.

Wishsmbdy runs on a small set of providers that process data on our behalf: Supabase (database, sign-in, and file storage), Vercel (hosting), PostHog (usage analytics, as described above — hosted in the United States and covered by PostHog's privacy policy), Resend (sends our notification emails, like “you received a card”), and Google (sign-in only, as described above).

The built-in media searches (Unsplash photos, GIPHY GIFs and stickers, Jamendo music, Spotify song search) send your search words to those services to fetch results. Media you pick is copied into Wishsmbdy's own storage, so people opening your card don't contact those services — with one exception: a card with a Spotify song embeds Spotify's own player, which is loaded from Spotify and covered by Spotify's privacy policy.

We keep your data for as long as you have an account. You can delete your account yourself in Settings → Security — that removes your account, profile, and cards, and the links to cards you sent stop working. If you'd rather we do it, get in touch and we'll delete it for you.

Wishsmbdy isn't directed at children under 13 (or the minimum age in your country), and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll remove it.

If this policy changes in a way that matters, we'll update this page and its date. Questions, or a privacy request? Email hadalisha06@gmail.com or use the feedback page when signed in.