Privacy Policy

1. Who we are

CatchWish is a wishlist web application. We help anyone create and share wishlists for any occasion so that friends and family can coordinate gifting. References to “we”, “us”, or “our” in this policy refer to CatchWish.

2. Data we collect

We collect the minimum data necessary to provide the service:

• Account information — when you sign in with Google we receive your name, email address, and profile picture from Google's OAuth service.
• Wishlist content — list names, wish item names, descriptions, product links, and photos you upload.
• Guest claim names — when a guest claims a wish on a shared list they enter a display name. This name is stored to show other guests that the item has been claimed.
• Usage data — basic server logs (IP address, browser type, pages visited) retained for security and debugging purposes.

3. How we use your data

• To create and maintain your account.
• To store and display your wishlists and wish items.
• To allow guests to view shared wishlists and coordinate gifting via claim names.
• To improve and maintain the reliability of the service.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Third-party services

• Google OAuth — used for authentication. Your use of Google sign-in is subject to Google's Privacy Policy.
• Supabase — our database, authentication, and file storage provider. Data is stored on Supabase infrastructure and protected by row-level security policies.

5. Cookies & local storage

We use cookies solely to maintain your authenticated session via Supabase. No advertising or tracking cookies are set. Session cookies are removed when you sign out.

6. Data retention

Your account data and wishlist content are retained for as long as your account is active. You may delete individual wishlists and wish items at any time from the dashboard. To request full account deletion and removal of all associated data please contact us at the address below.

7. Security

All data is transmitted over HTTPS. Database access is enforced by row-level security policies so users can only read and modify their own data. Shared wishlists are accessible only via unguessable random tokens.

8. Children's privacy

CatchWish is intended for use by adults (18+). We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us so we can remove it.

9. Your rights

Depending on your location you may have rights to access, correct, or delete your personal data. To exercise any of these rights please contact us. We will respond within 30 days.

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of CatchWish after changes are posted constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this Privacy Policy please contact us at privacy@catchwish.app.