Privacy

In short

• No tracking, no analytics services, no advertising, no sharing for advertising purposes.
• Cookies are only used for signing in and for your language choice. That’s why you won’t see a cookie banner.
• Fonts, illustrations and videos come from our own server. Only product images are loaded by your browser directly from the shop.
• Lists and wishes are stored in a data centre in Frankfurt am Main, Germany.
• People who join via a link don’t need an account and don’t provide an email address.

Who is responsible

For any privacy questions and to exercise your rights, simply send an email to this address.

Hosting and server logs

The website runs on a server operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with netcup.

Every time you visit, the web server automatically stores a log containing:

• your device’s IP address
• date and time
• the address requested, including the secret link you came through
• status code and amount of data transferred
• browser and operating system (user agent)

This is necessary to run the website securely and to detect attacks or errors (Art. 6(1)(f) GDPR). The logs are deleted automatically after 14 days.

Database and sign-in (Google Firebase)

For signing in and as our database, we use Firebase Authentication and Cloud Firestore provided by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. A data processing agreement (Cloud Data Processing Addendum) is in place with Google.

The database with lists, people and wishes is located in the Frankfurt am Main region (europe-west3). Firebase Authentication may also process sign-in data on Google servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the European Commission’s standard contractual clauses apply (Art. 45 and 46 GDPR).

If you sign in with “Sign in with Google”, a Google window opens. Google’s privacy policy applies there. Afterwards, we receive your name, email address, profile picture and a user ID.

Account and lists

Only people who create a list need an account. For this, we process:

• email address and password (stored only as an irreversible hash) or the data from your Google sign-in
• title, occasion and date of your lists
• the names and emojis of the people you add
• the secret links to your lists

This is necessary for Wunschliste to work for you (Art. 6(1)(b) GDPR). You can’t create an account without this information; everything else is optional.

Joining via a link

People who join via a link don’t need an account. We store what you enter yourself: wishes with title, note, price, shop link and image, your gift ideas for others, and whether you are getting a wish, have bought it or are chipping in on a group gift.

Your name was entered by the person who created the list. They can change it or remove you from the list at any time. The legal basis is the use of the list you are taking part in (Art. 6(1)(b) GDPR) and the legitimate interest of the family in coordinating gifts together (Art. 6(1)(f) GDPR).

Who is getting what, and which ideas others add for you, is filtered out by the server before the list reaches you. That way, the surprise stays secret on a technical level too.

What is stored on your device

Wunschliste only stores what is strictly necessary for it to work (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). We don’t need your consent for this.

• Cookie “__session”Only people with an accountKeeps you signed in. Not readable by JavaScript, sent over HTTPS only.Stored: 14 days or until you sign out
• Firebase sign-in state (IndexedDB)Only people with an accountNeeded by Firebase Authentication for signing in.Stored: Until you sign out
• Chosen person per list (localStorage)Everyone who joins via a linkSo you don’t have to pick who you are on every visit. Contains name, emoji and the secret link key.Stored: Until you tap “Switch person” or clear your browser data
• Cookie “NEXT_LOCALE”Only people who switch the languageRemembers whether you want to see Wunschliste in German or English.Stored: 1 year or until you clear your browser data
• Animations off (localStorage)Only people who pause the animations on the homepageRemembers this setting.Stored: Until you switch them back on

Shop links, previews and product images

When you add a shop link, our server fetches the shop’s page to take over the title, image and price. The shop only sees our server, not you.

Product images, however, are loaded directly from the shop’s server when the list is displayed. The shop receives your IP address and information about your browser, but not which page you came from. We show the images so you can recognise wishes at a glance (Art. 6(1)(f) GDPR). What the shop does with this is described in its privacy policy.

Protection against misuse

To prevent anyone from triggering the link preview en masse, we count how often a person uses it within a short time. We don’t store IP addresses for this. The counters are deleted automatically once the time window has passed (Art. 6(1)(f) GDPR).

How long we store data and how to delete it

• Delete list (in the list’s settings) removes the list with all people, wishes and links immediately and completely.
• Deleting your account is possible via the account menu or by email to kontakt@pweimann.de. All your lists will be deleted as well.
• People and wishes remain stored until someone deletes them or the list is deleted.
• Server logs are deleted after 14 days.

Who receives your data

Only the service providers named above, netcup and Google, who process it on our behalf. We don’t sell data and don’t pass it on for advertising. No automated decision-making or profiling takes place.

Your rights

You have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• rectification of incorrect data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)

Right to object: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just send an email to kontakt@pweimann.de. We will reply within one month.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit.