Privacy Policy

1. Who processes your data

The controller of your personal data is the operator of the Service named under “Operator details and contact” below (“we”). For anything about your data, write to us through the feedback form in the app or to the email address listed in the operator details.

2. What data we process

Account data: name, email address, profile photo (if you add one), sign-in method (passwords are stored only as a hash; when you sign in with Google we receive the name, email and photo Google provides).

Data you add yourself:

• wishlists, gifts, product links, prices, descriptions, photos;
• your birthday and who may see it;
• calendar events, reminders and notification settings;
• friends, friend requests, follows of friends and lists;
• gift reservations, group gifts (participants, pledges, polls), Secret Santa (participants, exclusions, draw results);
• messages sent through the feedback form.

Guest data: when someone without an account reserves a gift through a link, we keep the name and (optionally) the email they enter, so they can manage the reservation.

Technical data: IP addresses are used only to protect against abuse and are stored as an irreversible hash (SHA-256); service error logs; device and browser data sent automatically.

We do not collect bank card details. If paid services are introduced, payments will be handled by a payment provider and we will only receive the payment confirmation.

3. Why we process data and on what basis

• providing the Service — creating and showing lists, sharing, reservations, friends, calendar, group gifts, Secret Santa (basis: performance of the contract — the Public Offer);
• in-app notifications and emails about friend requests, reservations, events and reminders (basis: performance of the contract; optional emails can be switched off in your profile);
• security and protection against spam, automated attacks and fraud (basis: legitimate interest);
• answering your messages sent through the feedback form (basis: your consent and legitimate interest);
• meeting legal obligations, including accounting for paid services (basis: legal obligation).

We do not sell personal data, do not show ads based on your data and do not make decisions about you solely by automated means.

4. Who sees your data in the Service

You choose who sees each list: only you, friends, anyone with the link, or everyone (a public list). Your birthday is shown according to your privacy setting.

A list owner never sees who reserved their gift — only its status. A group gift stays hidden from the person it is for until the organizer reveals it. In Secret Santa each participant sees only their own giftee.

5. Who we share data with

We share data only with those who help us run the Service, and only as much as they need:

• Base44 — the hosting, database, authentication and email platform the Service runs on;
• Google — if you sign in with a Google account;
• a payment provider — if paid services are launched, only to process payments.

These providers may process data on servers outside Ukraine, including in the EU and the USA. We use providers that ensure an adequate level of data protection. We may also disclose data when lawfully required by public authorities.

6. How long we keep data

• account data and your content — while the account exists; after the account is deleted — no longer than 30 days, except backups, which are overwritten in their normal cycle;
• guest reservation data — while the related list or gift exists;
• abuse-protection counters — up to one day;
• feedback messages — up to 2 years;
• records of paid services — for the period required by tax and accounting law.

7. Cookies and local storage

The Service uses only what it needs to work: a session token to keep you signed in, and the browser’s local storage for your language, theme, list layout and guest reservations. We do not use advertising or third-party analytics cookies.

8. Your rights

Under Article 8 of the Law of Ukraine “On Personal Data Protection” (and, for EU users, the GDPR) you have the right to:

• know what data of yours we process and get a copy of it;
• correct inaccurate data (most of it yourself, in your profile);
• ask us to delete your data or account;
• object to or restrict processing;
• withdraw consent where processing is based on consent;
• receive your data in a structured format to move it elsewhere;
• complain to the Ukrainian Parliament Commissioner for Human Rights or to the data protection authority of your country.

To use these rights, write to us through the feedback form or to the email in the operator details. We will answer within 30 days.

9. How we protect data

Access is checked on the server for every request; connections are encrypted (HTTPS); passwords are never stored in plain text; requests are rate-limited. No method of transmission or storage is perfectly secure, so if a breach threatens your rights we will promptly tell you and the relevant authority.

10. Children

The Service is not intended for anyone under 14. If you learn that a child has given us data without parental consent, tell us and we will delete it.

11. Changes to this Policy

We may update this Policy. The current version is always published on this page with its date. We will tell you about material changes in the app or by email.

Operator details and contact

Website

https://wowsli.com

Feedback form

in the app, under “Feedback”