Privacy Policy

Wishignite(the "Service") is operated by Lilico LLC, a Delaware limited liability company with its principal place of business in California ("we", "us"). This policy explains what information we collect, why we collect it, and the choices you have.

1. Information we collect

1.1 Account information

When you sign in, we collect your email address and use it to send a one-time sign-in code. We never store a password. Guests who join an exchange through an invite link can participate with just a display name; a guest account has no email until you choose to add one. Your email address is never shown to other participants.

1.2 Exchange and wishlist data

The content you create to use the Service: exchange names, budgets, and dates; participant display names; draw exclusions; wishlist items including product links, prices, images, and notes; gift assignments from the draw; and reservation marks on wishlist items.

1.3 Technical data

When you use the Service, our hosting infrastructure logs technical information such as IP address, browser type, and approximate region. We use it for security, abuse prevention, and keeping the Service running.

1.4 Analytics (optional, off by default)

With your permission, we use PostHog to record aggregated usage events such as pages visited and buttons clicked. Events are tied to a random visitor identifier, not your name or email, and the pages we record are scrubbed of invite codes and exchange identifiers before they leave your browser. Analytics stays off unless you accept it in the cookie banner, and we honor the Global Privacy Control signal.

1.5 Error data

We use Sentry to capture errors so we can fix problems. Error reports are stripped of identifying details before they are sent: no cookies, no request bodies, and no email addresses.

2. How we use your information

• run the exchanges and wishlists you create
• keep the draw secret and gift reservations hidden from list owners
• send one-time sign-in codes
• understand aggregate usage to improve the Service (only with your consent)
• detect and prevent abuse
• comply with legal obligations

3. Surprises are protected by design

Some privacy rules here are product features. Draw assignments are stored so each participant can only ever read their own match. When someone reserves or purchases an item from your wishlist, that status is hidden from you at the database level. Other participants never see your email address.

4. Affiliate links and advertising

Wishlist links to retailers may include an affiliate tag (for example, through the Amazon Services LLC Associates Program). If you buy through such a link, the retailer may pay us a commission at no extra cost to you. Affiliate tags never change what appears on a wishlist.

With your permission (the optional affiliate-links choice in Cookie preferences), our partner Skimlinks may turn some outbound store links into affiliate links and record which link you click, so we can earn a commission at no extra cost to you. It never changes what appears on a wishlist, and it is off until you turn it on. We do not display third-party advertising on the Service. We do not sell your personal information. Unless you opt into affiliate links (off by default), we also do not share it for cross-context behavioral advertising as defined by the California Consumer Privacy Act (CCPA/CPRA).

5. Who we share information with

We share information only with the processors that run the Service, each bound by its own privacy commitments:

• Supabase, Inc. (United States): database, authentication, and file storage.
• Vercel Inc. (United States): hosting and content delivery.
• PostHog Inc. (United States): optional product analytics, only after you opt in.
• Skimbit Ltd. dba Skimlinks (Connexity/Taboola, United Kingdom/United States): optional affiliate-link monetization, only after you opt in.
• Functional Software, Inc. dba Sentry (United States): error monitoring.

We may also disclose information if required by law, or as part of a merger, acquisition, or asset sale, in which case this policy continues to apply to it.

6. Cookies

We use one strictly necessary cookie set (your sign-in session and your consent record) and optional analytics and affiliate-link cookies that are both off by default. See the Cookie Policy for the full list and your choices.

7. International data transfers

We operate from the United States, and your information is processed and stored there. If you use the Service from outside the United States, you understand your information is transferred to and processed in the United States.

8. How long we keep information

We keep your account and the content you create for as long as your account exists. You can delete wishlist items and leave exchanges at any time inside the Service. To delete your account and its data entirely, email us at eric@lilicollc.com and we will complete the deletion within 30 days, except where the law requires us to keep something.

9. Your rights and choices

9.1 California residents

The CCPA/CPRA gives you the right to know what personal information we collect, to access a copy, to correct it, and to delete it. We do not sell personal information. Unless you opt into affiliate links in Cookie preferences, we do not share it for cross-context behavioral advertising either; opting in shares only which outbound store link you clicked, with Skimlinks, so we can earn a commission, and you can opt back out at any time in Cookie preferences. We will never discriminate against you for exercising these rights. To exercise any of them, email eric@lilicollc.com.

9.2 European Economic Area, United Kingdom, and Switzerland

You have the rights of access, correction, deletion, restriction, objection, and data portability. Our legal bases are performance of a contract (running the Service you asked for), legitimate interests (security and error monitoring), and consent (analytics, and affiliate-link tracking if you opt in). You may withdraw consent at any time via Cookie preferences in the footer, and you may lodge a complaint with your local data protection authority.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

11. Security

We protect your information with industry-standard measures, including encryption in transit, database-level access rules, and least-privilege access for the systems that run the Service. No online service can guarantee perfect security, but privacy is engineered into this one from the first line of code.

12. Changes to this policy

We may update this policy as the Service evolves. If a change is material, we will make that clear on the site. The date at the top always tells you when it last changed.

13. Contact

Questions about privacy? Email eric@lilicollc.com.

Lilico LLC