Privacy at WishPop

What is stored

Your sign-in name, password hash, recovery-code hash, cards, and replies voluntarily sent to you are stored on the server. Plaintext passwords and recovery codes are not stored. A necessary session cookie keeps you signed in.

Only the signed-in card owner can retrieve their dashboard and submitted replies through the app. The service operator and hosting/database providers may have access to stored data. This is not end-to-end encrypted messaging.

Guest cards

Guest mode stores a display name, a necessary session cookie, and up to five temporary cards. The guest session and its links expire 24 hours after the session starts. Guest cards have no secret questions, saved-card dashboard, or submitted replies. A typed recipient wish stays in that browser page only.

Expired guest links are blocked immediately. Expired guest records are deleted during later server cleanup; hosting backups may retain copies under the hosting provider’s retention policy. Ending a guest session does not immediately delete links already sent.

Card links

Anyone holding a full card link can view that card. Share it with the intended recipient and avoid including sensitive information. Deleting a card from your dashboard also deletes its stored reply and disables that link.

Recipient wishes and answers

Your typed wish and selected answer stay in the current browser page until you choose “Send my reply.” “Keep it private” sends neither. Preview mode does not send replies.

Hosting and fonts

Hosting providers may process connection details such as IP addresses and service logs. Fonts are requested from Google Fonts, which receives connection information. WishPop does not add advertising or analytics trackers.

Your choices

You can skip writing a wish, keep a reply private, or delete a card you created. Signing out removes your current session. Losing both your password and recovery code prevents account recovery.