Privacy Policy

Who We Are & Contact

The service is run by Tobias, operating as a sole proprietorship (Webbvavaren) based in Sweden, who is the data controller for the processing described on this page.

Contact: onskelista4@gmail.com

Information We Process

• Wishlist title, wish text, and first name: Used to display the list on your screen and encode it inside a share link.
• Email address: Collected solely if you voluntarily choose to receive a backup link by email.
• Name when reserving a gift: When marking a gift as taken, you may voluntarily enter a name or nickname. It is stored together with that gift in our database and is shown only to people who have the share link, to help avoid duplicate purchases. It is deleted together with the list and is never used for marketing or profiling.
• Technical request data: Standard information sent by web browsers (IP address, browser type, approximate country). This is processed by our technical providers to deliver the site and protect against automated abuse.
• Language preference: Saved locally in your own browser so the site opens in your selected language next time.

Age Limitation

The service is intended for users who are at least 13 years of age. Users under 18 should use the service with parental guidance. The service is primarily directed at adults and families creating, coordinating, and purchasing from wishlists. We do not knowingly collect personal data from children under 13. No user accounts or profiles are ever created.

How Your Wishlist Is Stored

Your wishlist is stored on our servers (database storage), not in your browser. Each list is identified by a unique, randomly generated code (token) — no account, no login, no name or email address is required to create or edit a list.

We use two separate links to the same list: an owner link, which you use to edit, share and delete your list, and a share link, which you send to family and friends so they can view the list and mark gifts as "already taken".

As a general rule, the list owner does not see which gifts have been marked as taken, in order to preserve the surprise for the person the list is for. This is enforced in the owner's editing view specifically. However, since the owner also has access to the share link (in order to send it to others), the owner can choose to open that link themselves and see claim status like any other visitor — this is a deliberate part of the link-based model, not something we can technically prevent. The exception is lists imported from wishlist4santa.com, where the owner (parent) is intentionally shown claim status directly in the editing view, in order to coordinate before sharing the list further. See the 'Import from wishlist4santa.com' section for details.

What Is Stored Locally in Your Browser

Your browser stores two small data points, with no personal connection: a list of the owner codes of your own lists, so you can easily find your lists again via the "Find saved wishlists" feature, and an anonymous session ID used to determine whether it was you (in this specific browser) who marked a specific gift, so that you can undo your own choice.

When you open a wishlist someone has shared with you, the code from that share link is also saved locally on your device (shown under "Received lists"), so you can easily find the list again. This stays only on your own device. You can remove it at any time with the trash icon; doing so only removes it from your device and never deletes the list itself.

None of these contains a name, email address or any other identifiable information.

Deletion

You can delete your list at any time via your owner link. When deleted, the list and its contents are permanently removed from our servers. Lists are also deleted automatically three (3) months after the last access of their unique link.

Import from wishlist4santa.com

If you receive a wishlist created by a child on wishlist4santa.com (via the email-based recovery feature), a new list is created according to the storage principles described above on wishlist4.com when it is imported.

The recipient/first name field is always reset during import — no child's name is transferred from wishlist4santa.com to wishlist4.com as part of this process.

Share Links

When you generate a share link, the link points to the list stored on our servers. No personal information is attached to the link itself. Anyone who has the link can open the wishlist and mark gifts as taken. Treat share links as semi-public and do not enter sensitive personal information.

Temporary Handling, Storage, and Statistics

We distinguish between three types of data handling:

• Handled temporarily in memory: The wish text, first name, email address, and technical request data are processed in memory only while fulfilling your request and are immediately discarded.
• Stored on your device: A list of your own lists' owner codes, an anonymous session ID for undoing gift markings, and your language choice remain in your browser's local storage.
• Stored by us: Your wishlist content (title, wishes, first name if provided) in our database, plus anonymous aggregate counters. We do not store your email address in our database.

Retention Periods

We keep different categories of information only for as long as necessary for the purpose described:

• Wishlist content (title, wish text, and first name): Wishlist data (including the list content and any recipient name) is stored for three (3) months after the last access of the unique link, and is then deleted automatically. Each access to the link extends the storage period by a further three (3) months. We use no login, so the storage period is tied to the activity of the link, not to a user account. Automated requests such as link previews and crawlers are not counted as access. You can also delete the list yourself at any time via your owner link.
• Share links: A share link works as long as the list it points to exists. When the list is deleted, the link stops working.
• Email address: Used solely to send the single backup message you request. We do not store it in our database; our email delivery provider processes it only to deliver that message.
• Technical request data (such as IP address and browser type): Processed temporarily in memory while handling your request and for short-term rate-limiting. It is not written to our trend database.
• Anonymous aggregate statistics: Retained indefinitely because they contain no names, email addresses, IP addresses, session IDs, or any other data that could identify you.

Anonymous Analysis of Wishes & Aggregate Trends

When created, wish text may be sent once to our server to be analyzed in memory against a fixed list of known categories, products, and brands.

The original text is never saved to our database and is discarded instantly when analysis finishes.

Structured matches generate aggregate counters (e.g., product category, product, brand, language, country level, number of lists per day).

These statistics contain no names, email addresses, IP addresses, or session IDs and cannot be linked back to an individual user or list.

The Backup Email Feature

Entering an email address is completely voluntary.

The address is used for a single, one-time transmission of your wishlist link.

We do not send newsletters, advertising, or marketing follow-ups. We do not sell or rent email addresses.

We do not store the address in our database. The address is passed to our email delivery provider to send the message.

Reviews

If you choose to leave a review on wishlist4.com, we collect your rating (1–5 stars), your optional comment, a timestamp, and the language version of the site you were on. Reviews are submitted anonymously. We do not collect names, email addresses, or any other identifying information in connection with a review.

Submitted reviews are manually moderated before being published publicly on the site. Approved reviews, including the rating and comment, are displayed to all visitors on the start page.

Review data is retained indefinitely so that we can display an aggregated average rating and a selection of reviews on the site.

Security & Abuse Prevention

Technical information (such as IP address) may be processed temporarily in memory on the server to prevent automated abuse (e.g., rate-limiting requests). The IP address is never stored in plain form — it is converted into a daily rotating, one-way hashed value used only for rate-limiting, which expires automatically. IP addresses are never stored in our trend database.

Affiliate Links & Third-Party Cookies

Wishlist4 contains affiliate links to partner retailers and services through affiliate networks and programs we participate in.

Commissions: If you click an affiliate link and make a purchase, we may earn a small commission at no extra cost to you. Product recommendations reflect our own genuine suggestions; affiliate relationships do not dictate which products are featured.

Tracking & Cookies: We do not use advertising or tracking cookies of our own, and no third-party trackers are loaded while you simply browse the site. Tracking by retailers or affiliate networks is only activated when you actively choose to click an affiliate link and leave Wishlist4. At that point, the third party may set its own cookies or tracking technologies to attribute purchases to us. We do not control that tracking; it is governed entirely by the respective third party's privacy policy. No personal data (such as your name or email) is shared by us with these retailers.

Service Providers & Data Transfers

We use a minimal set of infrastructure providers:

• Lovable (lovable.dev): Website hosting and server execution.
• Supabase: Database technology storing wishlist content and anonymous aggregate counters.
• Lovable Email Service: One-time backup email delivery. Your email address is transmitted to the delivery provider only for the purpose of sending that single message.
• Cloudflare: Content delivery network (CDN) and country-level routing.
• Some providers may process technical request logs outside your country of residence (including in the US and EU) solely to maintain infrastructure security and performance.
• All fonts and assets are served directly by us. The site does not contact third-party font or asset services (such as Google Fonts), so no visit data is shared with such providers.

Why We Process Data

Displaying and sharing wishlists: To provide the service you've requested. The content is stored on our servers and accessed via your owner and share links.

Backup email delivery: Based on your voluntary action of submitting your email address.

Aggregate trend analysis: To understand general wish trends, using strict data minimization — the original text is discarded instantly.

Site security: To maintain safe and stable operation of the service.

Affiliate links: To help fund a free service.

For users in the European Economic Area: Under GDPR, the legal bases above correspond to our legitimate interest (Art. 6(1)(f)) for displaying wishlists, aggregate analysis, and site security, and your consent (Art. 6(1)(a)) for backup email delivery, which you may withdraw at any time before a message is sent.

Your Rights

Your wishlist is stored on our servers under a random code with no name or email address attached. You can delete it permanently at any time via your owner link. Since lists are not linked to an identity, we cannot look up or restore a list for you without the link.

All users: You may contact us to inquire about personal data. In most cases, we hold no identifiable data beyond what is reachable via your own links.

EU/EEA/UK residents (GDPR): You have the right to access, correct, delete, or port any personal data we hold, and the right to object to processing based on legitimate interest. You may lodge a complaint with your local data protection authority (e.g., IMY in Sweden, imy.se).

California residents (CCPA/CPRA): You have the right to know, delete, and correct personal information we may hold. We do not sell or share personal information as defined by California law.

All US users: You may contact the Federal Trade Commission (reportfraud.ftc.gov) or your state Attorney General's office with privacy concerns.

Changes to This Policy

We may update this policy as the service evolves. Material changes will be reflected by the "Last updated" date at the top of this page.