Privacy

This website

The homepage and its information pages are served through Cloudflare Pages. We do not add analytics, advertising trackers, external fonts or cookies. There is no account form or newsletter. Technical connection data and processing by Cloudflare and Hostpoint are described in the providers section. Hostpoint handles the domain and email, not website hosting.

Cloudflare · Hostpoint

Responsible for processing your data

About this policy

Pick My Wish helps you collect wishes, coordinate gifts, plan celebrations and share messages and moments. This policy describes processing in the app and on the public website https://www.pickmywish.ch.

We use personal data for your account, the features you use, notifications, support and protection against abuse. The app contains no advertising or tracking across other apps or websites. We do not sell user data or include third-party analytics SDKs in the app.

Data we process

Account and profile: email address, internal account ID, sign-in information, name, username, avatar, birthday, form of address, language, time zone and other details you add to your profile. This includes optional gift preferences such as sizes, colours, interests and exclusions. With Sign in with Apple, we receive the identifier Apple provides and the details you authorise, which may include an Apple relay address.

Wishes and gifts: photos, product links, prices, sizes, colours, quantities, notes, visibility, reservations, gift status and group-gift details. Group-gift amounts support coordination; Pick My Wish does not process payments.

Connections and celebrations: contacts within the app, follows, circles, partner connections, blocks, invitations, dates, places and addresses you enter, guest lists, replies, bring-along lists and polls. The app does not read your iPhone address book or request access to your device location. Event addresses you enter are separate from device location. You can also respond as a guest through an invitation link without an app account, providing your name, an optional email address or phone number, your attendance response, companions and a message. These details are processed for the invitation and your response; the hosts receive your response and contact details.

Communication and media: posts, comments, reactions, messages, greetings, moments, photos, videos and voice recordings with sender, recipient, read and time information. Selected files may include capture details and other file metadata.

Operations and support: push device tokens, notification settings, notifications with related content excerpts, delivery status, support requests and content reports. Connections to our services may generate technical information such as IP address, time, requested resource, device or client information and error status in operational and security logs.

Information may also come from other people, for example when they invite, tag or message you. Only provide information about others that you are entitled to use for the relevant feature.

Who can see your content

Visibility depends on the feature and the audience you select, such as connections, circles, selected people or event guests. Profile and birthday settings also affect what other people see. Check the selected audience before sharing.

Chats are intended for their participants. Gift reservations are hidden from the gift recipient. People with a guest link can access the information made available through that link; share these links carefully.

Our infrastructure processes content to provide the service and handle reports. Messages are not end-to-end encrypted. Other people can save visible content outside the app; we cannot remotely delete those independent copies.

Service providers and external connections

Supabase provides authentication, the database, media storage and server functions. Our project's primary region is Zurich, Switzerland (eu-central-2). This does not mean every supporting system operates only in Switzerland: edge execution, network infrastructure, logging and support may involve international services.

Supabase's privacy and data-processing documentation describes international processing, including in the United States and Singapore, and contractual safeguards including standard contractual clauses. Its subprocessors are listed at https://supabase.com/legal/customer-resources/subprocessor-list. Further information: https://supabase.com/privacy and https://supabase.com/legal/customer-resources/data-processing-addendum.

Apple is involved in Sign in with Apple and push notifications. If you use a test version through TestFlight, Apple also provides that service. Apple’s own processing is covered by https://www.apple.com/legal/privacy/. Supabase processes the account data needed for confirmation, sign-in and recovery emails; the configured email delivery and messages sent to info@pickmywish.ch are handled through Hostpoint and the participating email providers. Hostpoint’s information: https://www.hostpoint.ch/hostpoint/kontakt-agb.html#datenschutz. Earlier correspondence sent to the previous address may remain in Gmail. Depending on the providers involved, processing outside Switzerland, including in the United States, is possible. Google’s information: https://policies.google.com/privacy.

Fetching a product preview may already connect to the shop and its image or content providers, which receive technical connection data. When you open a product or map link, the external provider's privacy information also applies. Purchases take place outside Pick My Wish.

The public website https://www.pickmywish.ch is hosted on Cloudflare Pages. We do not add analytics, advertising trackers or external fonts to it; you do not need an app account to visit. Cloudflare processes technical connection data, including IP addresses and traffic information, to deliver and protect the pages. Cloudflare is a US company and describes international processing, particularly in the United States and the European Economic Area. Its documentation describes transfer safeguards, including standard contractual clauses: https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/cloudflare-customer-dpa/. Depending on the enabled security features, Cloudflare may set necessary security cookies; see https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/. Hostpoint manages the domain, DNS and contact mailbox.

Notifications and emails

You can adjust or disable push notifications in the app and in iOS Settings. Necessary emails for address confirmation, sign-in, password recovery and account security are separate from optional reminders.

Automatic delivery of optional reminder emails and nudges is currently switched off. The email reminder setting in the app does not activate this delivery. Details of the delivery provider and unsubscribe options will be added before activation.

Permissions and on-device data

The camera, selected media and microphone are used for the relevant photo, video and voice features. You can allow or decline notifications. Permissions can be changed in iOS Settings; a feature may be limited without its required permission.

On-device data includes language settings, sign-in state, app-specific guest identifiers and cached content. Drafts you explicitly save for wishes, events and posts may contain text, media and audience settings. Saving a draft does not itself publish it as a post. Local drafts are not a cross-device cloud-sync feature.

The app stores technical performance and diagnostic reports locally on your device. These reports are not automatically uploaded to us and are excluded from device backups. When saving new reports, the app limits this archive to 5 MB and 14 files and removes reports older than 14 days.

Retention and deletion

Account data and shared content are generally kept to support your account and the relevant feature. Archiving and hiding are not deletion. Retention of technical logs, support and moderation records depends on resolving incidents or reports, preventing abuse and applicable legal obligations. There is no single confirmed deletion period here for these records or the providers’ backups.

You can request account deletion in the app under Settings > Account > Delete account. Automatic cleanup removes, among other things, your own wishes, posts and chat messages, together with related media, from active app storage. Personal profile details are cleared from the remaining profile, which serves as a technical reference; other people’s messages remain. Automatic cleanup currently does not cover every record: comments on other people’s posts, some saved associations, email records and older copies of notification text may remain. Contact info@pickmywish.ch for a review and any further deletion required. Reports or evidence may be retained where needed to handle abuse or meet legal obligations.

Delete Chat removes a conversation only from your own view. It does not delete the other person's chat history. This action cannot recall independent copies, notifications already delivered or backups outside active app data. Backup copies follow their respective backup and overwrite cycles; immediate erasure from every backup is not promised.

Contact us at the address above about retention of specific data or deletion you cannot carry out yourself.

Your rights and legal bases

Applicable data-protection laws, including the Swiss Federal Act on Data Protection, apply. Where the GDPR applies, processing necessary for your account and requested features is based on contract performance (Article 6(1)(b)). Necessary security and abuse prevention may rely on legitimate interests in protecting the service and its users (point (f)). Where separate consent is required, consent is the basis (point (a)); processing necessary to meet legal obligations relies on point (c).

Depending on applicable law, you may request access and a copy of your data, correction, erasure, restriction or portability and object to certain processing. You may withdraw consent for the future without affecting processing lawfully carried out before withdrawal. Optional profile details and media can be omitted; account-based use is not possible without necessary account data.

Send privacy requests to the contact above. We may need proportionate information to verify your identity and protect your account. Do not send passwords or verification codes. You can also contact the competent data-protection authority: the FDPIC in Switzerland (https://www.edoeb.admin.ch), the relevant state data-protection authority in Germany, or the Austrian Data Protection Authority (https://www.dsb.gv.at).

Age, test versions and updates

You can use Pick My Wish from age 16. We use the date of birth you provide to check the minimum age and apply protective settings for people under 18. We do not carry out official identity or age verification. If you believe someone is younger than 16, contact us using the details above and we will review your report.

If you use a test version through TestFlight, Apple processes its own diagnostic and usage data and the feedback you submit through TestFlight. This is separate from data processing within Pick My Wish.

We update this policy when data processing materially changes. Both the public policy and the text included in each app build carry a version date; for an older app version, the public policy may be newer.