Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how we collect, use and protect your personal data when you use the Wishey Telegram mini app, the @wishey_bot and @wishey_support_bot Telegram bots and the wishey.app website (collectively, the “Service”).

We are committed to handling your data responsibly and transparently. While Wishey is currently operated as an independent project without a separate legal entity, we aim to comply with applicable data protection laws, including where relevant the General Data Protection Regulation (“GDPR”) and similar laws in other jurisdictions.

Wishey is free. It has no paid plans, shows no advertising, does not process payments and does not use analytics or tracking tools.

1. Data controller and contact

For the purposes of data protection law, the individual developer(s) maintaining Wishey act as the “data controller” for personal data processed through the Service.

If you have any questions or wish to exercise your privacy rights, you can contact us via our Telegram support bot: @wishey_support_bot.

2. Data we collect

2.1. Data received from Telegram

When you open Wishey inside Telegram, Telegram passes us signed launch data, which we verify to authenticate you. Subject to your Telegram settings, it includes:

• Your Telegram user ID;
• Your first name and last name;
• Your Telegram username;
• Your profile photo URL;
• The language of your Telegram app (used to choose the interface language the first time you open Wishey);
• Whether you have allowed the bot to send you messages;
• Other technical data required to verify the signature (such as the time of authorization).

We store your ID, name, username, profile photo URL and the messaging permission, and refresh them each time you open the app.

2.2. Data you provide

• Wishlists: title, icon and color, event date, description, and your choices about who may see what — whether you see reservations and who made them, and whether the wishlist is private.
• Wishes: title, price and currency, a link to the item, a comment, the “Really want” mark, and a cover — either an icon and color or a photo you upload (JPEG, PNG or WebP, up to 10 MB).
• Reservations: which wishes in other people’s wishlists you have reserved as your gift.
• Settings: your interface language and notification preferences (whether notifications are on, when to remind you about events, and which kinds of notifications you want).

2.3. Data about how you use the Service

• Wishlists you have opened: when you open someone else’s wishlist, we remember that you joined it and when, so it appears in your list and so we can send you the reminders and updates you asked for. The owner learns that someone has opened their wishlist (the app stops suggesting to share it), but not who.
• Notification records: which reminders and updates we have sent you and when, so that you don’t get the same notification twice.

2.4. Telegram bots and chats

• @wishey_bot in chats: if you type @wishey_bot with a title in a chat, we receive that text to offer and create a wishlist. If you add the bot to a group and send /new_wishlist, we receive the command, the chat ID and the chat title (used as the default wishlist name), and post a message with the wishlist link to that chat. The bot processes only commands addressed to it and service messages about being added to a chat; we do not store the contents of chat conversations.
• Support: messages you send to @wishey_support_bot are forwarded to our support chat in Telegram, where we read and answer them. To route our replies back to you, we store the IDs of the forwarded messages and of your chat with the bot. The contents of the messages stay in Telegram.

2.5. Technical data

Our servers log requests to the Service: date and time, the requested path, the response status, a request identifier, and error and diagnostic information. Our hosting and network infrastructure also processes your IP address to deliver requests.

These logs are used for security, debugging and operational purposes and currently do not have a fixed automatic deletion date. We keep them as long as reasonably necessary for these purposes, after which they may be deleted or anonymized as part of system maintenance.

3. How we use your data

• Providing the Service: to authenticate you via Telegram, store your wishlists, wishes and settings, show wishlists to the people you share them with, keep track of reservations so that gifts are not duplicated, and show you your own reservations.
• Notifications: to send you messages through the bot — reminders about events and the gifts you picked, news about new wishes in wishlists you have opened, and alerts when a wish you reserved is deleted. We send them only if you have allowed the bot to message you, and only the kinds you have turned on; you can change this at any time in the app’s settings.
• Chats: to create wishlists from chats and post links to them where you asked the bot to.
• Support: to answer your questions and requests.
• Operating and securing the Service: to monitor performance, find and fix errors, and protect the Service and its users from misuse and security incidents.
• Legal compliance: to comply with legal obligations and respond to lawful requests from authorities, where required.

We do not use your data for advertising, profiling or selling to anyone.

4. Legal bases (EEA/UK users)

If you are in the European Economic Area or the UK, we rely on the following legal bases under the GDPR:

• Performance of a contract (Article 6(1)(b) GDPR): to provide the Service you request — your account, wishlists, wishes, reservations, notifications and support.
• Legitimate interests (Article 6(1)(f) GDPR): to keep the Service secure and stable, to keep logs for security and debugging, and to improve the Service. We balance these interests against your rights and expectations.
• Legal obligations (Article 6(1)(c) GDPR): where we must retain or disclose data to comply with applicable laws.

5. Who can see your data

• Your wishlists: a wishlist is shared by its link. Anyone who opens the link in Telegram can see its title, description, date and wishes (with photos, prices, links and comments), as well as your name and profile photo as its owner. A wishlist you mark as private is visible only to you.
• Your reservations: other people who open the same wishlist see that a wish is taken, but not by whom. By default the wishlist owner sees nothing about reservations. The owner can choose to see which wishes are reserved, and can also choose to see who reserved them — in that case your name and profile photo are shown to the owner next to the wish you reserved.
• Photos: wish photos are stored in object storage and shown by direct link, so anyone who has a photo’s link can open it.
• Chats: messages the bot posts to a group chat at your request (for example, a new wishlist and your name as its author) are visible to that chat’s members.

6. Cookies and local storage

The Service does not use cookies, analytics, advertising or tracking pixels.

• The mini app stores on your device only a note of whether it has already asked for permission to send you messages, so it doesn’t ask again.
• The wishey.app website stores on your device only your language choice. It loads fonts from Google Fonts, which means your browser requests them from Google’s servers under Google’s privacy policy.

If we ever introduce cookies or similar technologies that require consent, we will update this Privacy Policy and ask for your consent first where the law requires it.

7. How we share your data

We do not sell your personal data. Apart from what other users can see (section 5), we share data only in the following limited circumstances:

• Telegram: the Service runs inside Telegram, and all bot messages (notifications, chat messages, support replies) are delivered through the Telegram Bot API. Telegram processes this data under its own terms and privacy policy.
• Infrastructure providers: we use hosting, database and object storage providers who process data on our behalf and are required to protect it.
• Legal reasons: we may disclose data if required by law or in response to valid legal requests (for example, from law enforcement authorities), where we believe in good faith that disclosure is necessary.

Links in wishes lead to third-party websites (such as online stores). We do not open these links or send them your data; if you follow a link, that website’s own terms and privacy policy apply.

8. International data transfers

Our servers are currently located in Germany. Depending on your location and on the infrastructure providers we use, your data may be transferred to and processed in other countries that may have different data protection laws than your country.

Where required by law, we will take appropriate safeguards to protect personal data during such transfers, for example by using standard contractual clauses approved by the European Commission for transfers outside the EEA.

9. Data retention

• Account data (your Telegram profile data and settings) is kept while you use the Service and until you ask us to delete it.
• Wishlists and wishes are kept until you delete them. When you delete a wish or a wishlist, its data and the reservations on it are deleted right away, and its photos are removed from storage shortly after. A photo is also removed when you replace or remove it. Photos uploaded but never saved to a wish may remain in storage until they are cleaned up during maintenance.
• Reservations are kept until you cancel them, or until the wish or the wishlist is deleted.
• Notification records and support message IDs are kept while they are needed to avoid duplicate notifications and to answer your requests, and are removed as part of maintenance.
• Server logs are kept as described in section 2.5.
• If you request deletion of your account and data (see section 11), we will delete or anonymize your personal data unless we are legally required or allowed to keep it for longer.

10. Your rights

Depending on your location, you may have the following rights with respect to your personal data:

• Right of access – to obtain confirmation as to whether we process your personal data and to receive a copy of it;
• Right to rectification – to have inaccurate or incomplete data corrected;
• Right to erasure – to request deletion of your personal data in certain circumstances;
• Right to restriction of processing – to request that we limit our processing of your data in certain cases;
• Right to data portability – to receive certain data in a structured, commonly used and machine-readable format and to transmit it to another controller;
• Right to object – to object to processing based on our legitimate interests, on grounds relating to your particular situation.

Much of this you can do yourself in the app: edit or delete your wishlists and wishes, cancel reservations, and turn notifications off. For anything else, contact us via @wishey_support_bot. We may need to verify your identity and your relationship to the data requested.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

11. Account deletion

At the moment, you cannot delete your account directly from within the mini app, but you can delete any of your wishlists and wishes and cancel your reservations there at any time. To delete your account and all associated data, contact us via @wishey_support_bot.

After verifying your request, we will delete or anonymize your personal data unless we are legally required or allowed to keep it for longer.

12. Security

We take reasonable technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access — for example, every request from the app is verified with Telegram’s signature. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children

The Service is not intended for children under 16 years of age. If we learn that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete it.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page and, where appropriate, provide additional notice (for example, within the mini app or via Telegram).

Your continued use of the Service after the updated Privacy Policy becomes effective will constitute your acceptance of it.