Dear Little Wish
Back to the app
Privacy policy
Last updated: 6 November 2026 (payments added)
- We keep only what the app needs to work: your account, and the ideas, dates, wishlists and Secret Santa groups you create.
- We don't sell your information, and we don't use advertising or tracking cookies.
- The surprise is protected: a wishlist's owner can't see what's been reserved, and in Secret Santa each person sees only their own match.
- You can ask us to show you, correct or delete your information at any time.
Who we are
Dear Little Wish (dear-little-wish.netlify.app) is run by Thalia, trading as Dear Little Wish, based in the United Kingdom. We are the "controller" of your personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Contact us about anything in this policy at dearlittlewish@gmail.com.
What we collect
Your account
- Your email address and first name.
- How you sign in: with your email and a password, an email link, or Google. If you use Google, Google shares your name, email address and a link to your profile picture with us (we don't display the picture). We never see your Google password, and your Dear Little Wish password is stored only in encrypted (hashed) form.
What you create
- Saved gift ideas, and who they're for.
- Special dates: the title, date, who it's for, colour and reminder choice.
- Wishlists: their names, dates and the gifts on them, including any shop links and notes you add.
- Reservations you make on other people's wishlists.
- Secret Santa groups: the group details, the names of the people taking part, who has joined, and the draw.
Gift searches
Your answers in the gift finder (who it's for, the occasion, interests, budget and any extra details, such as their age, style or brands they love) and anything you type into the search box. If you use AI gift ideas, these are sent to our AI provider to write the ideas (see "Who we share it with"). We count how many AI searches each account makes per day, to keep the service fair.
Information about other people
When you add a date, a wishlist note or Secret Santa names, you may include other people's names (for example "Mum's birthday"). Please add only what's needed, and nothing sensitive about anyone.
Technical information
When you visit, our hosting provider and the services that deliver our fonts and code receive your device's IP address and basic browser details, as any website does. We don't use analytics tools.
Cookies and storage on your device
We don't use advertising, analytics or tracking cookies. The app stores a few things in your browser so it can work:
- your sign-in session, so you stay signed in;
- if you're not signed in, your saved ideas and dates (they move into your account when you sign in);
- your choices, such as whether the seasonal snow is on, and links to lists and groups you've opened.
These are needed for features you ask for, so they don't need a cookie banner. You can clear them at any time in your browser settings.
Shop links: when you follow a link to a shop, the shop and its affiliate network (such as Amazon or Awin) may set their own cookies on their websites, so they can tell that you came from Dear Little Wish if you buy something. Their own privacy policies explain this. You pay the same price either way.
How we use it, and why we're allowed to
| What we do | Lawful basis |
|---|---|
| Create and run your account; save your ideas, dates, wishlists and groups; show wishlists and Secret Santa to the people you share them with | To provide the service you asked for (contract) |
| Write AI gift ideas from your answers | To provide the service you asked for (contract) |
| Send sign-in, confirmation and password-reset emails | To provide the service you asked for (contract) |
| Keep the service secure, prevent misuse and apply daily search limits | Our legitimate interests in running a safe, fair service |
| Earn a commission when you buy through a shop link | Our legitimate interests in funding the service (we don't share your account details with shops) |
| Keep records we're required to keep, and respond to lawful requests | Legal obligation |
We don't sell your information, use it for advertising, or make decisions about you that have legal or similarly significant effects.
Who we share it with
We use a small number of trusted providers to run Dear Little Wish. They process information only on our instructions:
- Supabase: our database and sign-in service. Your account and everything you create are stored in its London data centre.
- Netlify: hosts the website.
- Anthropic: writes AI gift ideas from your gift-finder answers and searches. Under its commercial terms, Anthropic doesn't use this information to train its AI models.
- Google: if you choose "Continue with Google", and for the fonts on our pages.
- jsDelivr: delivers a piece of code the app uses to talk to our database.
- Stripe: takes payments for paid plans (see "Paid plans and payments").
Some of these providers are based in, or use services in, the United States. Where your information leaves the UK, it's protected by the safeguards UK law requires, such as the UK–US data bridge or standard contractual clauses.
Shops and affiliate networks (such as Amazon and Awin) don't receive your name, email or wishlists from us. They only know that a visitor arrived from our link.
We'll share information if the law requires it, or to protect people's safety.
Who can see what inside the app
- Saved ideas and dates: only you.
- Wishlists: anyone with the link can see the list and its gifts. Friends can reserve gifts; they see whether a gift is free or already reserved, but never who reserved it. The list's owner never sees reservations at all.
- Secret Santa: people with the invite link who sign in can see the group, the names, who has joined and who has looked. Each person can see only who they are buying for. The organiser cannot see the matches.
These rules are enforced by our database, not just by what the app shows. As the people who run the service, we can technically access the database, but we only do so to fix a problem or when the law requires it.
How long we keep it
We keep your information while your account is open. If you delete something (an idea, a date, a list or a group), it's removed from our database straight away. If you ask us to close your account, we delete your account and everything you created within 30 days, apart from anything we're legally required to keep, such as payment records. Our providers may keep backups for a short time before they're overwritten.
Your rights
You have the right to:
- ask for a copy of your information;
- ask us to correct it;
- ask us to delete it, including your whole account;
- ask us to limit how we use it, or object to how we use it;
- ask for your information in a format you can take elsewhere.
To do any of these, email dearlittlewish@gmail.com from the address on your account. We'll reply within one month.
If you're unhappy with how we handle your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Children
You must be 13 or over to create an account. If you think a child under 13 has given us information, contact us and we'll delete it.
Paid plans and payments
When you buy a plan or a search pack, Stripe handles the payment. You type your card details on Stripe's own secure page, and we never see or store them. We give Stripe your email address and an account reference, so your receipts and subscription stay together. Stripe tells us what you bought, how much you paid, and when a subscription renews or ends. Stripe also uses payment information to prevent fraud and meet its own legal duties, as explained in Stripe's privacy policy.
We use this to switch your plan on and off (to provide the service you asked for), and we keep payment records for six years, because UK tax law requires it.
Changes to this policy
If we make important changes, we'll tell you in the app or by email before they take effect. The date at the top shows when this policy last changed.