Privacy & Cookies

We process email and account verification information for sign-in, profile name, username, biography, preferences, optional Instagram link and profile photo. Wishlists, saved products, uploaded photos, notes, product options and follow relationships are stored to provide the service. Your password is not shared in analytics or with other members. We do not sell products or collect payment or card details.

Full name, Instagram profile, email and optional introduction are stored to review your application and contact you if needed, together with submission and privacy-acknowledgement time. Only the authorized administrator can read applications. Applying does not create a public profile or grant Editor access. A new application is also emailed to the administrator.

The contact form stores your name, email, subject and message to handle your request and reply, together with submission and privacy-acknowledgement time. Only authorized administrators can read messages; a notification is sent to hello@onmywishlist.com. Message content is not added to public profiles or analytics.

Private wishlists are owner-only; unlisted wishlists do not appear in Discover or search. Guests with a valid non-private shared link can see products, notes and options; the link is not recipient-exclusive. Approved Editor profiles are public; Discover requires membership and shows selected public Editor lists only. Regular members are excluded from profile search by default; search preference does not change wishlist privacy. Other members’ relationship lists and raw analytics records are not shared.

The server measures product impressions, retailer clicks, wishlist visits, detail opens and saves with product/list, page, time, device and referral context. Where trusted hosting information is available, only country codes are stored, not precise location or raw IP addresses. Without analytics permission, an IP and limited connection information may be converted into a salted daily-changing one-way code for deduplication; the IP itself is not stored. Self-engagement may be excluded from popularity. Members see their own aggregate reports; administrators see platform summaries. Small country groups are combined.

Lovable visitor analytics on the published site records pages visited, where visitors came from, country, browser, operating system, device type, time spent, page loading speed, errors and button/link clicks. Detailed data is retained for 90 days and daily summaries for one year.

Because the current preference panel is not connected to Google Consent Mode, these measurements, including clicks, are recorded for all visitors. Page visits, time on page, page speed and errors are measured for every visitor without cookies or identifying anyone. Lovable analytics uses no cookies, stores nothing on a visitor’s device, keeps no IP addresses and does not identify visitors. The platform’s own account and browser records described above are separate.

Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.

Sign-in sessions are stored in the browser. An HTTP-only access cookie secures private photos and links and is cleared at sign-out. Language and analytics choices use local storage; campaign and referral information may use session storage. Accepting analytics creates a random visitor identifier and a session record with a 30-minute inactivity timeout. Essential only removes persistent analytics identifiers; aggregate server measurement and Lovable’s cookieless measurement may continue. Your choice remains until changed or browser data is cleared.

Manage cookie preferences

Lovable Cloud supports accounts, data storage, private photo storage and access; Lovable email services process verification, password resets, invitations and application notices. Google processes authentication when Google sign-in is selected. Fonts load from Google Fonts; technical data such as IP address and browser requests may be transmitted to Google. Product links lead to retailers and Instagram links lead to Instagram, whose own practices apply. Product import and eligible image processing may send product URLs or photos to extraction/image services, not your account email. International providers may process data in different countries.

Data supports accounts and wishlists, application review, security, communication and service measurement. Depending on processing and applicable law, grounds may include providing the service, legal obligations, legitimate interests subject to balancing, or consent where required. Account and application records are retained for service/review needs and applicable obligations; this notice does not specify a single fixed period for them. Personal data is not sold or used to build advertising profiles.

Subject to applicable GDPR and Turkey’s Law No. 6698 (KVKK), you may exercise information, access, correction, deletion, objection and other applicable rights, and withdraw consent for consent-based processing. Identity verification and legal retention requirements may affect a request. Rights to complain to the competent data protection authority remain unaffected.

For questions, content reports and personal data requests, email hello@onmywishlist.com or use our contact form.