Privacy Policy

1.1 Information You Provide Directly

When you create an account and use our platform, we collect:

• Account information: your first name, last name, email address, date of birth, and password
• Payment information: processed securely by Stripe. We do not store your credit card number, expiration date, or CVV on our servers
• Questionnaire responses: the personal narratives, memories, values, and end-of-life wishes you enter in response to our guided questions. This is the most sensitive data we hold on your behalf
• Profile information: any additional details you provide in your account settings
• Gift recipient information: if you purchase Wishes & Stories as a gift, we collect and store the recipient's name and email address indefinitely
• Communications: messages you send us via our contact form or by email

1.2 Information Collected Automatically

When you visit or use our platform, we automatically collect certain technical information:

• Device and browser information: browser type, operating system, and device type
• Usage data: pages visited, features used, time spent, and navigation patterns
• IP address and approximate location: country/region level
• Cookies and similar tracking technologies: see Section 6 for details

1.3 Information from Third Parties

We may receive limited information from third-party services that help us operate the platform, such as confirmation of successful payment from Stripe or email delivery status from Resend.

We use the information we collect for the following purposes:

• To provide the service: create and manage your account, save and retrieve your questionnaire responses, generate your personal document, and deliver it to you via download or email
• To process payments: complete your purchase and send you a receipt via Stripe and Resend
• To deliver gifts: notify gift recipients and activate their accounts on your behalf
• To communicate with you: send transactional emails (account confirmation, document delivery, purchase receipts) and, with your consent, marketing emails about updates, features, and promotions
• To improve the platform: analyze usage patterns to improve the questionnaire, user experience, and overall product quality
• To ensure security: detect and prevent fraud, unauthorized access, and abuse
• To comply with legal obligations: respond to lawful requests from authorities where required

3.1 Where Your Data Lives

All user data, including your account information and questionnaire responses, is stored securely in Supabase, hosted entirely in the United States. We do not transfer your personal data outside the United States.

3.2 How Long We Keep It

We retain your personal information and questionnaire responses for as long as your account is active. Specifically:

• Your questionnaire responses are stored in our database until you request deletion of your account
• Your account information is retained until you request that we delete it
• Gift recipient information (name and email) is stored indefinitely unless you or the recipient requests deletion
• Payment records are retained as required by applicable financial and tax regulations (typically 7 years)
• We may retain certain anonymized, non-identifiable data for analytics purposes after your account is deleted

3.3 Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, or disclosure. These include:

• Encrypted data transmission (HTTPS/TLS) for all data in transit
• Row-level security in Supabase, ensuring users can only access their own data
• Secure authentication managed by Supabase Auth
• Payment processing handled entirely by Stripe, which is PCI-DSS compliant

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. Given the sensitive nature of the information you store with us, we encourage you to use a strong, unique password for your account.

We do not sell, rent, or trade your personal information to third parties. We share your data only in the following limited circumstances:

4.1 Service Providers

We work with the following trusted third-party services that process data on our behalf:

• Supabase (supabase.com): database and authentication. Stores your account data and questionnaire responses. US-based servers.
• Stripe (stripe.com): payment processing. Handles all credit card transactions. We share your name and email address with Stripe for billing purposes. Stripe is PCI-DSS compliant.
• Resend (resend.com): transactional and marketing email delivery. Your email address is shared with Resend to send emails on our behalf.
• Vercel (vercel.com): web hosting and application infrastructure. Serves the platform and may process request metadata (such as IP addresses) in the normal course of operations.
• Anthropic / Claude (anthropic.com): AI services used in certain features of the platform. Where Claude is used, only the minimum data necessary to perform the requested function is shared.

Each provider operates under their own privacy policy and data practices. We encourage you to review those policies if you have questions about how they handle data.

4.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Wishes & Stories, our users, or the public.

4.3 Business Transfers

If Wishes & Stories is acquired, merged, or sold, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

With your consent, we may send you marketing emails about new features, updates, promotions, or other news related to Wishes & Stories.

You can opt out of marketing emails at any time by:

• Clicking the “Unsubscribe” link at the bottom of any marketing email
• Emailing us at hello@wishesandstories.com

Please note that even if you opt out of marketing emails, you will continue to receive transactional emails necessary to operate your account, such as purchase receipts, document delivery confirmations, and important account security notices.

We use cookies and similar technologies to operate and improve our platform. A cookie is a small text file placed on your device when you visit our website.

We use or plan to use the following types of cookies:

• Strictly necessary cookies: required for the platform to function, including session authentication and security. These cannot be disabled.
• Analytics cookies: we plan to use tools such as Google Analytics or PostHog to understand how users interact with our platform. These tools may set cookies that track usage patterns in aggregate.
• Marketing cookies: we plan to implement the Meta (Facebook) Pixel to measure the effectiveness of our advertising. This may set cookies that help us understand whether you visited our site after viewing one of our ads.

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the platform. We will seek appropriate consent before activating marketing or analytics cookies where required by law.

You have the following rights with respect to your personal information:

• Access: you may request a copy of the personal information we hold about you
• Correction: you may request that we correct inaccurate or incomplete information. You can update most account information directly in your profile settings
• Deletion: you may request that we delete your account and all associated personal data, including your questionnaire responses
• Portability: you may request a copy of your questionnaire responses in a portable format
• Opt-out of marketing: you may opt out of marketing communications at any time as described in Section 5

To request deletion of your account and data, please email hello@wishesandstories.com with the subject line “Data Deletion Request.” We will confirm receipt within 2 business days and complete the deletion within 30 days. Note that account and data deletion cannot be performed self-service at this time.

We may need to verify your identity before processing certain requests. Some information may be retained after deletion where required by law — for example, payment records required for tax compliance.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: you may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which it is used, and the third parties with whom it is shared
• Right to Delete: you may request deletion of personal information we have collected, subject to certain exceptions
• Right to Non-Discrimination: we will not discriminate against you for exercising any CCPA rights
• Right to Opt-Out of Sale: we do not sell your personal information. If this changes, we will update this policy and provide you a clear opt-out mechanism

To exercise your California privacy rights, please contact us at hello@wishesandstories.com.

Wishes & Stories is designed for adults. We do not knowingly collect personal information from children under the age of 13. If we become aware that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take prompt steps to delete that information.

If you believe we have collected information from a child under 13, please contact us immediately at hello@wishesandstories.com.

Our platform and communications may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policy of any third-party site you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy
• Post the updated policy at wishesandstories.com/privacy
• Send you an email notification if the changes are significant

Your continued use of Wishes & Stories after any changes to this policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please reach out:

We are committed to resolving any privacy concerns promptly. We will respond to all privacy-related inquiries within 5 business days.