Privacy policy

Legal

Policy version 2026-10-25

Privacy policy

Last updated: 25 October 2026

This policy explains what GotMyWish, operated by Gan Solutions, Inc., knows about you and what it does with it. The short version: we keep what the site needs in order to work, we show it only to the people you choose, and we do not sell it. On a few public pages, such as the home page and the sign-up page, we use Google Analytics and the Meta Pixel to learn which of our posts and ads bring people to GotMyWish. They are never on your lists, share links, invitations or exchanges, and they are never given your email address, your name or anything on your lists.

What we collect

When you create an account

Your email address and display name.
Your password, stored only in a scrambled form that we cannot read back.
The time you accepted the terms of service and this policy, and which version.
If you sign in with Google or another sign-in provider we offer: your email address, name, and language or time zone if the provider sends them, plus the provider's id for your account. We also receive your profile picture, keep our own copy and show it as your photo on GotMyWish; you can replace it with one you upload, or show your initials instead. We do not receive your password or your contacts.

On your profile, if you choose to add it

Your language, time zone and birthday.
Your choices about reminders and email.
A photo, if you upload one. We keep a small square copy with the details your camera stored (such as where it was taken) removed.

What you add to the site

Your lists and the items on them: names, notes, prices, quantities, pictures and store links.
Your friends on GotMyWish, and the invitations you send.
Occasions and exchanges you set up or join, including any preferences you write for the person who draws you.

If you claim a gift without an account

Your email address, so that we can send you a link to manage the claim. Nothing else.

About other people

When you invite a friend or add someone to an exchange, you give us that person's email address and perhaps their name. We use it only to send that invitation and to run that exchange.

Activity records

The site records some account activity so its operators can see what happened and answer questions about it: sign-ins, invitations, friendships, wishlists and share links, exchanges and draws, and gift claims. These records hold account and item ids only - they do not contain email addresses, item titles or list names. Only administrators can see them, and they are deleted after 12 months. Sign-in records also include the network address the sign-in came from.

Other records the site keeps

Usage counts. We count events such as a list being created or a gift being claimed, to see which parts of the site are used. These hold ids, never an email address or a network address. They do not yet have a fixed deletion date.
Store clicks. When someone follows a link from a list to a store we record which item and which store, and the time. We do not record who clicked.
Error reports. When something goes wrong we record the page, the error and, if you were signed in, your account id. These are deleted after 14 days.
Sent email. We keep a copy of each email the site sends for 30 days, so that we can see whether it was delivered.

Your network address is also used briefly, in memory, to limit how fast one visitor can make requests.

Cookies

GotMyWish sets a small number of cookies of its own. These are needed for the site to work:

a sign-in cookie, which lasts until you close the browser, or for 14 days if you ask to stay signed in or sign in through a provider such as Google;
a security cookie that protects forms from being submitted by another site;
if you claim a gift without an account, a cookie that remembers you on that one list for up to two hours after you confirm your email address;
short-lived cookies while a sign-in through a provider such as Google is in progress.

And these help us measure where visitors come from:

if you arrive through a link that names where it was posted (for example a link from our Instagram), a cookie that remembers that name, such as "instagram", for 90 days. When you create an account we record it with the account, so we can count sign-ups by where they came from;
after you sign up or create an exchange, a cookie that lasts at most a day and says only that this happened, and for a sign-up whether it was by email, Google or Facebook. It is read and deleted on the next page that carries the analytics and advertising tags described below.

On the pages listed under "Analytics and advertising tags", Google and Meta also set cookies of their own. Apart from those tags, fonts and scripts are served from our own site.

Analytics and advertising tags

We use two outside tags to see which of our posts and ads bring people to GotMyWish, and to show GotMyWish ads to people who are likely to find it useful:

Google Analytics, from Google, which counts visits and shows us where they came from;
the Meta Pixel, from Meta (the company behind Facebook and Instagram), which tells us whether our ads on Facebook and Instagram lead to sign-ups.

Where they run. Only on these pages: the home page, "How it works", sign up, sign in, this policy and the terms of service. They are not on your lists, share links, invitations, exchanges, messages or any other page.

What they receive. The address of the page, with everything removed except the name of the post or ad that brought you (for example "utm_source=instagram"); the kind of browser and device you use; your network address; and the cookies Google and Meta set. When you sign up or create an exchange, they are also told that this happened, and for a sign-up whether it was by email, Google or Facebook. They are never given your email address, your name, your lists or items, or who you are buying for.

What Google and Meta do with it. Each handles this information under its own privacy policy. Meta may connect a visit to a Facebook or Instagram account you are signed in to, to measure our ads and to choose who sees them. Google keeps the Analytics data for two months.

Turning them off. If your browser sends the Global Privacy Control signal, these tags do not load at all. Blocking third-party scripts or cookies in your browser also stops them. You can also use Google's Analytics opt-out browser add-on, and change how Meta uses this information in your Facebook or Instagram ad settings. Turning them off does not change how the rest of GotMyWish works.

How we use it

To run the site: keeping your lists, showing them to the people you choose, running exchanges and draws.
To send email: account confirmation, password resets, claim links, invitations, reminders and exchange updates.
To keep the site secure and to find and fix faults.
To understand, in total, how the site is used.
To measure which of our posts and ads bring people to GotMyWish, and to show GotMyWish ads to people likely to find it useful, through the tags described above.

We do not sell personal information. The analytics and advertising tags described above give Google and Meta information about visits to a few public pages, which they use for advertising. Some laws call this "sharing" personal information for advertising. You can opt out as described under "Turning them off", or by writing to support@gotmywish.com. Nothing you put on GotMyWish, such as your lists, your friends or your exchanges, is used for advertising.

Who can see what

Your lists. A list marked Public can be seen by the friends you have accepted. A list marked Private can be seen only by you. There is no public directory of people or lists.
Share links. Anyone who has a share link can open that list without an account. You can pause or revoke the link at any time.
Claims. Buyers can see that a gift has been claimed. The list owner is not shown whether a gift was claimed, or by whom.
Exchanges. Each person is shown only their own draw. The organizer sees who has joined and how far along things are, and is not shown who drew whom.
Friends. A friend can see your display name, your photo and your Public lists.
Your photo. Your photo is shown beside your name to your friends, to people in your exchanges and to people you message. A list opened from a share link shows your initials, not your photo. Anyone given the photo's own web address can open it.
Administrators. The people who run GotMyWish can see account details, the records described above and the database itself, in order to operate and support the site.

Stores and affiliate links

When you paste a store link, our server fetches that page to read the item's name, picture and price. The store sees a request from our server. It does not see you.

When you follow a link from a list to a store, you leave GotMyWish and the store's own privacy policy applies. Some of these links are affiliate links: the address carries a code that tells the store the visit came from GotMyWish, and the store may set its own cookies to remember that. If a purchase follows, the store may pay us a commission and may tell us what was bought. It does not tell us who bought it. As an Amazon Associate, Gan Solutions earns from qualifying purchases.

Who we share it with

We share personal information only with the services we need in order to run the site:

the hosting company whose server the site and its database run on;
the email service that delivers the mail the site sends;
the storage company that holds our backups, which are encrypted before they are sent, so it cannot read them;
the sign-in provider you choose, such as Google, when you sign in that way;
the bot-protection service on the sign-up form (Cloudflare Turnstile), which sees the address and

browser of anyone who opens that form, so it can tell people from automated sign-ups;

Google (Google Analytics) and Meta (the Meta Pixel), on the pages and in the way described under

"Analytics and advertising tags".

We may also disclose information when the law requires it, or to protect the safety of a person or the security of the site. The server and the backups may be in a different country from the one you live in.

How long we keep it

Your account, lists, friends and exchanges are kept until you delete them or your account is deleted.
Activity records are deleted after 12 months, error reports after 14 days and copies of sent email after 30 days.
A guest's email address is kept with the claim it belongs to, until the claim or the list is removed.
Encrypted backups of the database are kept for up to 12 months, so deleted information can remain in a backup for that long.

Your choices

See and correct. You can see and change your details on your profile page.
Email. Every reminder, invitation and update carries a link that stops them, and you can change the same settings on your profile. Emails about account security, such as password resets, cannot be turned off.
Analytics and advertising tags. Turn on Global Privacy Control in your browser, or block them, as described under "Analytics and advertising tags".
A copy of your data. Ask from your profile page or by writing to support@gotmywish.com.
Deletion. Ask from your profile page or by writing to support@gotmywish.com. Requests are handled by a person, within 30 days.

When an account is deleted we remove its photo, lists, items, share links, claims, friends, invitations, occasions, the exchanges it organized and its sign-in details. In exchanges organized by someone else, your place is kept but your name and email address are replaced with a placeholder, so the exchange still works for the others. Activity records, usage counts and error reports are not removed at once. They hold an id that no longer belongs to any account.

If you received an email from GotMyWish and have no account, because someone invited you or added you to an exchange, write to support@gotmywish.com and we will remove your address.

Depending on where you live you may have further rights over your information under local law. Write to us and we will honour them.

Children and people you manage

GotMyWish is not for children under 13 to use themselves, and we do not knowingly collect information from them. If you believe a child under 13 has created an account, write to support@gotmywish.com and we will delete it.

A parent, guardian or carer may add someone they look after, such as a child, a pet or an adult without email, and keep wish lists for them. That person never signs in. We keep only what you enter for them: a name, whether they are a child, a pet or an adult, an optional emoji, and an optional birthday without the year. We never ask for their email or a photo.

Their Public lists are shown to your friends, and to the friends of anyone who helps you manage them. The people who manage them can see what has been bought from their lists and who bought it; everyone who shops from those lists is told this. You can change or remove what you entered at any time, and removing them deletes their lists. If you delete your account, the people you added are deleted with it, unless someone else still helps manage them.

Security

The site is served over an encrypted connection, passwords are stored only in scrambled form, and access to the server and database is limited to the people who run the site. No system is perfectly secure, and we cannot promise that information will never be lost or seen by someone it should not be.

Changes to this policy

When this policy changes we will post the new version here and change the date at the top. If a change is significant we will also tell account holders by email.

Contact

Gan Solutions, Inc. operates GotMyWish and is responsible for the personal information described in this policy (its data controller). Questions and requests go to support@gotmywish.com.