📅 Last updated: January 1, 2025 · Effective: January 1, 2025
1 · Who We Are
WishBasket ("we", "our", "us") operates the website and application available at wishbasket.click. We provide a shopping list creation and sharing service.
For questions about this policy, contact us at bouraouitech@gmail.com.
2 · Information We Collect
When you create an account (email):
- Your name
- Your email address
- A hashed (encrypted) version of your password — we never store your actual password
When you sign in with Google:
- Your name and email address from your Google account
- Your Google profile picture URL
When you use the app:
- Shopping lists and wishlist items you create
- Custom categories and items you add
Automatically collected:
- Anonymous usage statistics via Google Analytics (pages visited, session duration)
- Basic server logs (IP address, browser type, timestamp) — retained for 30 days
We do not collect payment information, physical addresses, phone numbers, or any sensitive personal data.
3 · How We Use Your Information
- To create and maintain your account
- To save and sync your shopping lists across devices
- To authenticate you securely via JWT tokens
- To respond to your support requests
- To analyse aggregate usage and improve the app
- To detect and prevent abuse or fraud
We do not use your data for advertising, profiling, or selling to third parties.
4 · How We Store and Protect Your Data
Your data is stored on servers hosted by Hostinger, located in the EU. We apply the following security measures:
- Passwords hashed with bcrypt (cost factor 12)
- Authentication via signed JWT tokens with 30-day expiry
- All traffic encrypted via HTTPS/TLS
- Database access restricted to the application only
We retain your account data as long as your account is active. You may request deletion at any time.
5 · Who We Share Data With
We share data only with the following third parties, and only as necessary to operate the service:
- Hostinger — web hosting and database storage (EU-based)
- Google LLC — if you use Google Sign-In (subject to Google's Privacy Policy); and Google Analytics for anonymous usage data
We do not sell, rent, or trade your personal data to any third party.
6 · Cookies & Analytics
We use the following cookies and similar technologies:
- wb_token — stores your login token in localStorage so you stay signed in. Essential for app functionality.
- wb_cookie_consent — remembers your cookie consent choice.
- Google Analytics (_ga, _gid) — anonymous usage analytics. Only set after you accept cookies.
You can withdraw consent at any time by clearing your browser's cookies and localStorage for wishbasket.click.
7 · Your Rights (GDPR)
If you are located in the European Economic Area, you have the following rights:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your account and all associated data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any of these rights, contact us at bouraouitech@gmail.com. We will respond within 30 days.
8 · Children's Privacy
WishBasket is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.
9 · Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.
For significant changes, we will notify signed-in users via the app.