Privacy Policy
Last updated: July 2, 2026
People trust Wishwell with the most personal things they own: family photos and letters written from the heart. This policy explains what we collect, why we collect it, who helps us process it, and the rights you have over all of it. The short version: your photos and letters exist here for exactly one purpose, making the book and slideshow you asked for. We do not sell your information, we do not run ads, and we do not use your photos or letters to train AI models.
1. What we collect
From organizers (account holders)
- Your name and email address, and your sign-in details (via Google or an email link; we never see a Google password).
- The project details you enter: the honoree's name, the occasion, the event date, and your chosen web address for the project.
- Purchase history for your projects. Card numbers go to Stripe, never to us.
From well-wishers (contributors)
- Your name, email address, and your relationship to the honoree.
- The letter you write and the photos you upload, including captions and any date or place details you add. Photo files can carry embedded metadata such as when and where they were taken; we use it only to order and caption pages, and we strip it from the optimized slideshow images.
From everyone
- Standard technical logs (IP address, browser type, pages visited) that any website receives, used for security and to keep the service working.
2. Why we collect it
- To make the thing you asked for. Photos and letters become the book, the printable download, and the slideshow. That is their only use.
- To run the project. Contributor emails let us confirm a wish was received and remind people before the wishing deadline. Organizer emails carry receipts, timelines, account notices, policy updates, and delivery updates. These transactional emails are sent so we can provide the service.
- To send optional updates and tips. We send marketing emails only if you explicitly opt in. You can unsubscribe from those messages at any time.
- To take payment and ship the book, through the processors listed below.
- To keep the service safe: preventing abuse, debugging, and meeting legal obligations.
We do not sell or rent personal information. We do not show ads. We do not use your photos or letters for marketing without asking you separately and explicitly. We do not send marketing email unless you opt in, and every marketing email includes a way to unsubscribe.
3. Who helps us process it
Four service providers touch your data, each for one job, each bound by its own data protection terms:
| Provider | Job | What it handles |
|---|---|---|
| Supabase | Database and photo storage | Holds the project database and the uploaded photos, including the private bucket for full-resolution originals and the public bucket for optimized slideshow images. |
| Stripe | Payments | Processes every purchase. Card details go directly to Stripe; we never see or store card numbers. Stripe keeps the payment records the law requires it to keep. |
| Lulu | Printing and shipping | Prints and ships the hardcover books. Receives the finished book file and the recipient's name and delivery address, and nothing else. |
| Vercel | Website hosting | Runs the Wishwell website and, like any host, sees standard technical request data such as IP addresses. |
Beyond these, we disclose personal information only if the law requires it, or to protect the safety of the service and the people using it.
4. Who can see the wishes
Contributions are private to the project. The organizer and any co-admins they invite can see every wish; individual well-wishers see only their own. Nothing is public unless the organizer shares the slideshow link, and then anyone holding that link can view the slideshow. Share it with the care it deserves.
5. How long we keep it
The full details live in our Data Retention Policy. The heart of it: 90 days after a book is delivered (or a project is archived), we purge the full-resolution photo originals from storage. The optimized slideshow images and every written wish are preserved, so the honoree keeps the slideshow. Contributor emails are kept for paid projects and removed for free-only projects on the same schedule.
6. Your rights
Wherever you live, we honor these as a baseline, and we honor stronger local rights (such as those under GDPR or the CCPA) where they apply:
- Access and export: ask for a copy of the personal information we hold about you.
- Correction: fix anything that is wrong.
- Deletion: ask us to delete your account, your wish, or your photos. If you contributed to someone else's project, we may coordinate with the organizer, and copies already printed in a book cannot be recalled.
- Complaint: you can also raise concerns with your local data protection authority.
To exercise any of these, email hello@wishwellbooks.com. We respond to every request.
7. Children
Wishwell is not directed to children under 13, and children under 13 may not create accounts or contribute directly. Photos of children, uploaded by the adults who love them, are of course part of many books; the adult uploading is responsible for having the right to share them.
8. Security
Full-resolution originals live in a private storage bucket that is not publicly reachable, database access runs through server-side code only, and payment details never touch our systems. No internet service can promise perfection, but if a breach ever affects your information we will tell you promptly and plainly.
9. Changes to this policy
If we change this policy in a way that matters, we will email account holders and post the new version here with a new date.
10. Contact
Questions about any of this? Write to us at hello@wishwellbooks.com. A person reads it.