Privacy Policy

Controller within the meaning of the General Data Protection Regulation (GDPR):
Mario Rauterkus
c/o Online-Impressum #8353
Europaring 90
53757 St Augustin
Deutschland

Email: support@wishcache.app

Open contact form

WishCache is a publicly accessible, non-commercial project for creating, managing, and sharing wishlists. People outside the operator’s personal circle of family and friends can also register. “Private project” describes the non-commercial operation, not a restriction to a closed group of users.

We process personal data for accounts, wishlists, product imports, sharing, communication, and secure operation. WishCache does not sell personal data or embed external analytics or marketing scripts, tracking pixels, social-media SDKs, or externally loaded fonts. No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

Technical providers support hosting, the database, authentication, and email delivery. Their roles and the recipients involved in product imports are described in section 11.

Depending on how the service is used, WishCache processes in particular:

• •Account data: email address, internal user ID, account creation time, last-login time, preferred language, and optional nickname and birthday.
• •Authentication data: session information and, when optional two-factor authentication is used, the status of the enrolled TOTP factor. Account credentials are processed by Supabase Auth; WishCache does not store them in plain text in the application database.
• •Wishlist data: list name, occasion and date, recurrence, color, theme, visibility, share token, expiry date, and a hash of the list password when password protection is used.
• •Item data: product name, price, currency, quantity, product and image URLs, description, priority, sort order, and timestamps.
• •Sharing and invitation data: recipient address entered by a user, inviting user, list, status, token, and any personal message.
• •Usage data without a visitor profile: view counters for shared lists and item-related click counters and timestamps indicating whether the list owner clicked.
• •Internal notification data: recipient assignment, title, message, type, read status, timestamps, and function-related metadata such as a wishlist or user reference. General administrative notices also have a base record and user-specific deliveries.
• •Security data: pseudonymous HMAC-based rate-limit keys, counters, and reset times. A request IP address may be used as input; the rate-limit table does not contain the raw IP address.
• •Contact and report data: sender address, subject, and message for contact requests, and reported URL or list ID, reason, optional contact address, and documented moderation decision for content reports.
• •Technical connection data: IP address, user agent, requested URL, referrer, and timestamps may technically be processed by hosting, authentication, and email providers.

Depending on the operation, processing relies on the following provisions of Article 6(1) GDPR:

• •point (b) – performance of a contract or pre-contractual steps: registration, login, account management, wishlists and items, sharing, requested invitations, product import, language preferences, and contract-related contact requests.
• •point (f) – legitimate interests: secure and stable operation, abuse and attack prevention, rate limiting, troubleshooting, internal list- and item-related counters, handling other inquiries, moderating reported public content, and honoring email objections. The interests of affected persons are taken into account.
• •point (c) – legal obligations: where data must be processed to meet statutory access, erasure, evidence, or moderation duties.

Optional two-factor authentication is provided as an account security feature. Its technical processing is not generally described as relying on GDPR consent.

Supabase Auth is used for registration and login. An email address and authentication data are required for an account; account-based functions cannot be provided without them. Registration is voluntary. Public information pages and appropriately shared wishlists can also be viewed without an account.

Confirmation and recovery messages are sent through the email provider. Optional profile information such as a nickname and birthday is not required for registration. The preferred language may additionally be stored in the profile.

TOTP two-factor authentication is optional. When enabled, the factor and verification status are managed through Supabase Auth. After repeated failures, the settings and verification pages each store a lockout timestamp in sessionStorage; it ends with the browser session or is removed after expiry or successful completion.

The personal year review records a labelled starting inventory at activation and subsequent changes. It stores internal account, list and item identifiers, validity intervals, price, quantity and currency. Product names, descriptions, links, images, comments and sharing information are not copied into this history. The application exposes annual aggregate figures only to the respective list owner; contributions to collaboratively edited lists count for that owner.

For Secret Santa rounds, the organizer enters nicknames and email addresses. Invitees must explicitly accept using a matching verified account. We store round conditions (including budget and deadline), invitation and acceptance status, personal wishlists, and drawn assignments. In the application, the organizer can see managed invitation addresses, acceptance and whether wishes exist, but only their own assignment. Other participants cannot see invitation addresses. The assigned giver receives read-only access to the recipient’s wishlist. This is application access control, not end-to-end encryption against technical database operators.

Invitations, explicitly requested reminders, drawing names, restarting and the first wish on a previously empty assigned list may trigger emails and internal notifications. The organizer receives a readiness notification when everyone has accepted. Delivery jobs store event type, recipient reference, generation and delivery status; failed delivery does not draw new names. A confirmed restart revokes access through old assignments, but delivered emails cannot be recalled. Invitees can decline or suppress further user-initiated messages using the link in an email.

Wishlists can be private, readable by link, or protected by link and password. “Private wishlist” is a visibility setting separate from the non-commercial operation of the project. Link sharing makes the list name and shared item data available to anyone holding the link. Links can be forwarded; only share content intended for that audience.

For password-protected lists, the list password is stored as a hash. A technically necessary access cookie is set after successful verification. Direct email shares store the recipient address so the share can be displayed, managed, and left by the recipient.

Views of shared lists and clicks on product links are counted per list or item. A click event stores the item, time, and whether the owner clicked; it is not linked to another visitor account or a raw IP address.

Each publicly shared list provides a way to report problematic content.

You may optionally subscribe to emails about new items on a shared wishlist. Signed-in users activate notifications for their verified account address; without sign-in, additional email confirmation is required. We store the address, language, wishlist reference, access basis, consent and delivery status, and associated timestamps. Confirmation is valid for 24 hours. Item emails contain the wishlist and item names, an embedded product image when available, price and currency, and a link to the list. Each subscription can be cancelled using its unsubscribe link without signing in. Subscribing does not grant additional reading rights; delivery is blocked when access is lost. Already delivered emails cannot be recalled. Completed delivery jobs and inactive subscriptions are removed after 30 days by the daily cleanup. Confirmation expiry and access checks apply independently of cleanup.

The contact form validates the email address, subject, and message on the server and sends them to the support mailbox through Hetzner. No dedicated contact database table is created. A honeypot and pseudonymous rate-limit data help prevent abuse. Retention in the support mailbox depends on handling the inquiry, necessary follow-up, and any applicable evidence or retention obligations. The support mailbox is reviewed manually once a month for continued retention needs. Resolved inquiries are deleted once they are no longer needed for follow-up, specific evidence, or legal obligations. Mailbox cleanup is separate from automated database cleanup.

A content report stores the relevant list or URL, the reason, and an optional contact address. An on-page receipt is shown immediately, and an additional email receipt may be sent when an address is provided. Authorized administrators record the status, decision, reason, and timestamps. If content is restricted or removed, the affected account holder may be informed of the reason.

The optional contact address is scheduled for removal by the daily cleanup once 90 days have passed since review completion. There is no fixed automated deletion period for the remaining report and decision record. Handling the case, possible challenges to the decision, and necessary evidence determine its retention; it must be deleted manually once those purposes end.

WishCache sends account-related messages and specific wishlist or member invitations initiated by a user. Such a message may contain the inviting user’s identity, list name, purpose, sharing or invitation link, privacy notice, and a link to prevent further external invitation messages.

Automatic recommendation or referral emails to third parties entered by users are disabled. Users can copy referral links and send them through a service of their choice.

WishCache also displays internal functional and administrative notifications to registered users. Their content, recipient assignment, read status, timestamps, and required references are stored for this purpose.

To honor an objection, the normalized recipient address is hashed with a secret HMAC key. Only this hash, its purpose, and timestamp are stored. Opt-out tokens are also stored only as hashes and become invalid after 30 days; expired tokens are scheduled for deletion by the daily cleanup. The suppression hash remains for as long as the objection must be honored.

Invitation messages generated by the WishCache application code contain no tracking pixels or externally loaded images. The configured email provider processes the recipient address and message content for delivery.

For product imports, the WishCache server first retrieves the product page directly. Your local browser does not perform this retrieval. Known marketing parameters and obviously session-, account-, authentication-, or cart-related URL parameters are removed before storage and import. The shop receives the WishCache server’s connection data, not your Supabase session.

If direct retrieval fails and the additional import service is enabled, Scrape.do may be used as a fallback. It receives the cleaned product URL and a region code derived from browser language. WishCache cookies and authentication headers are not forwarded. Only use public product links without personal information or credentials: not every personal element of a URL can be identified automatically. Items can also be entered manually without an automatic import.

Externally stored product images are retrieved through an access-controlled WishCache image endpoint. Your browser therefore does not connect directly to the image host. That host receives the WishCache server’s connection data and a technical proxy user agent, but no visitor WishCache cookies, authentication headers, or referrer.

Actively opening a product or social-sharing link connects your browser directly to the chosen third party. It receives the usual connection data and processes it under its own responsibility. WishCache does not embed social-media SDKs.

In non-commercial project mode, WishCache does not automatically add affiliate parameters to product links. Product-link clicks may still be counted internally per item.

WishCache does not set advertising, analytics, or tracking cookies. The reviewed code retains only storage used for login, language, appearance, protected sharing, and short security lockouts:

• •Supabase Auth cookies (typically named sb-<project-reference>-auth-token and potentially split into cookie chunks): session and token refresh; up to 30 days; host domain; path /; Secure in production; HttpOnly: no, because the Supabase browser client refreshes the session; SameSite: Lax.
• •locale: selected or account-related language; up to 1 year; host domain; path /; Secure in production; HttpOnly: yes; SameSite: Lax. It is not used for audience measurement.
• •wishcache_theme: actively selected light or dark appearance; up to 1 year; host domain; path /; Secure on HTTPS; HttpOnly: no, so appearance changes can be saved immediately in the browser; SameSite: Lax. No appearance cookie is set without an explicit choice. Selecting “System” deletes it and follows the device setting again. Not used for tracking.
• •share_access_<share-token>: access to a successfully unlocked password-protected list; 24 hours; host domain; path /share/<share-token>; Secure in production; HttpOnly: yes; SameSite: Strict.
• •sessionStorage mfa_locked_until and mfa_settings_locked_until: lockout timestamps after repeated failed TOTP attempts; only for the relevant browser session; domain, path, and cookie attributes do not apply.

The reviewed code uses neither IndexedDB nor a service-worker cache. Section 25(2) no. 2 TDDDG applies to the technically necessary storage listed above. Because no non-essential storage occurs before consent, no general cookie banner is used.

Depending on the function used, the following services and recipients are involved:

• •Vercel: hosting and execution of the web application, processing web requests, necessary connection data, and application data needed for the relevant request.
• •Supabase: storage of account, wishlist, and other application data, authentication, and session management.
• •Hetzner Online GmbH, Germany: email service through Webhosting S for account messages, user-initiated invitations, and support communication, processing sender and recipient addresses, message content, and technical delivery data. A data processing agreement under Article 28 GDPR has been concluded with Hetzner for this processing.
• •Scrape.do: an additional service for failed product imports, where enabled. It receives the data described in section 9, not access to the WishCache user account.
• •Shops and image providers: recipients of server-side product and image requests. When you actively open external links, shops, social networks, or messengers also receive your browser’s connection data.
• •Other users or link recipients: content and invitation data according to your sharing choices.

International services such as Vercel, Supabase, and Scrape.do may process data outside the European Economic Area, including in the United States. A European server location alone does not rule out access or further processing in other countries.

The provider information linked below describes their services and privacy terms. It does not confirm a particular WishCache project region or a contract concluded for WishCache. You can request information about transfers affecting your data and, where applicable, a copy of the relevant safeguards through our contact form.

Vercel: https://vercel.com/legal/privacy-notice
Supabase: https://supabase.com/privacy
Hetzner: https://www.hetzner.com/legal/privacy-policy/
Scrape.do: https://scrape.do/privacy-policy/

Technical records for the personal year review remain after individual items or lists are deleted so that earlier annual figures do not disappear retrospectively. They are retained for the year-review feature while the account exists; no additional fixed automatic expiry applies. Permanent account deletion also deletes this history through its database relationship to the account.

Secret Santa invitation addresses, participation and delivery status are stored separately from ordinary member invitations; their 7-day period does not apply here. Data remains for administration, redelivery and participation. Restarting deletes old assignments and cancels outstanding old delivery jobs while preserving personal wishlists. Deleting an account anonymizes its associated Secret Santa invitation data and deletes its own lists; affected assignments become invalid. There is currently no automatic deletion period for remaining round and delivery records. Data no longer needed is reviewed and removed on request through the contact form.

When the organizer deletes a Secret Santa round, it is removed from active overviews and its assignments are deleted. Personal wishlists and items remain with their owners and are detached from the round. A deletion notification is queued for everyone still in the round, subject to existing email opt-outs. Round and recipient references, invitation addresses, nicknames, deletion time and delivery status are retained for delivery, status checks and retries; this does not immediately erase all round data physically.

Retention depends on the respective purpose and any statutory retention or evidence obligations. Daily runs are scheduled for the automated cleanup described below. With regular daily execution, technical removal may take until the next run after a threshold is reached.

• •Account, profile, wishlist, and item data: generally until deletion by the user or list expiry. Account deletion scrubs known address-based references and permanently deletes the Supabase Auth account. The associated profile, owned lists, and their items are deleted through database relationships.
• •Direct list shares and recipient addresses: until the share is removed, the recipient leaves, or the list or account is deleted.
• •Pending member invitations: scheduled for cleanup from an age of 7 days. On acceptance or rejection, the invited email address is removed from the member record.
• •Historic referral invitations: email addresses and personal messages are scheduled for removal from 30 days after creation. New automatic referral emails to third parties are disabled.
• •Opt-out tokens: invalid after 30 days and then scheduled for cleanup. The HMAC suppression value remains for as long as the objection to further invitations must be honored.
• •Completed content reports: optional contact addresses are scheduled for removal from 90 days after completion. The remaining moderation record follows the purpose and deletion criteria in section 7.
• •Individual item-click events: scheduled for cleanup from an age of 90 days. Aggregate counters remain with the list or item until its deletion.
• •Functional user notifications and user-specific deliveries of administrative notices: scheduled for cleanup from an age of 60 days. General administrative notices have no fixed automated deletion period; continued retention depends on their information and evidence purpose.
• •Authentication audit entries in the project database: scheduled for cleanup from an age of 90 days. This is not a retention period for additional provider logs.
• •Rate-limit data: cleanup after the protection window and a technical grace period.
• •Support emails: monthly manual review and deletion of resolved inquiries according to the handling and retention criteria in section 7; not automatically deleted by database cleanup.

For the Hetzner email service in use, the provider specifies a retention period of 7 days for mail server logs. For Webhosting S, Hetzner describes daily backups retained for 14 days. These periods apply to logs and backup copies, not messages in the active mailbox; those messages are not automatically deleted after 7 or 14 days.
Hetzner data protection information: https://docs.hetzner.com/de/general/company-and-policy/data-protection-at-hetzner/
Webhosting service description: https://docs.hetzner.com/de/managed/webhosting/overview/

Technical provider logs and backups are separate from active application data. Their retention depends on the service, configured retention and backup cycles, and necessary troubleshooting or security investigations. The database periods above therefore do not promise simultaneous deletion of all provider logs and backups. You can ask about retention and deletion of your data through the contact form.

Where particular data is still needed to meet statutory obligations or resolve specific legal claims, deletion may be deferred for that purpose.

WishCache uses technical and organizational measures intended to be appropriate to the risk. They include database access controls, server-side input validation, rate limiting, security headers, protection against impermissible internal network targets during product and image retrieval, and optional TOTP two-factor authentication.

Security measures are adjusted over time. No permanently fixed encryption, certification, or security guarantee is made.

Subject to the statutory requirements, affected persons have rights including access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), and objection to processing based on legitimate interests (Article 21). Consent may be withdrawn for the future where a particular operation actually relies on consent.

Requests may be sent by email to support@wishcache.app or through the contact form. Affected persons also have the right to lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR.

Version date for non-commercial operation: October 14, 2026. This policy will be updated to reflect changes to features, providers, or data processing.