Popwish lets a creator publish their wishlist and their fans fund the items on it together. This policy explains which data we process, why, for how long and how to exercise your rights. It applies to the popwish.app website and to the Popwish app (iOS and Android).
Who is responsible for your data
The data controller is Elodie DUMAY EI, publisher of Popwish, to be completed. For any question about your data: support@popwish.app.
What we collect
If you are a creator
- Your email address, to sign you in with a code and send you emails about your account.
- Your public profile: display name, handle, bio, category, colors, links to your social accounts, profile picture.
- Your gifts: title, link to the shop, price, image.
- Your unboxings: the photos, videos and captions you publish.
- In the app: your phone's notification token and language, to send you notifications.
- Your Stripe account: we only keep its identifier and status. Your identity and bank details are entered on Stripe; Popwish has no access to them.
- Moderation: the addresses of fans you block, the messages you report.
If you chip in for a gift
- Your name or nickname (optional), your email address and your message (optional), the amount, your language and whether you chose to show your contribution publicly.
- Payment happens on Stripe: Popwish never sees your card. We receive the payment identifier and its status.
- If the creator has not enabled payments yet, you can pledge a contribution: we then keep your name, email, message and the amount to let you know when you can pay.
Demo pages
To introduce Popwish to some creators, we may prepare a demo page from information they made public (handle, display name, profile picture, links). It is only reachable through a private link, is not indexed by search engines and is erased after 30 days unless the creator keeps it. You can ask us to erase it sooner.
If you write to us
Through the contact form or by email: your name (optional), your email address and your message, to reply to you. We keep them while handling your request, then for 3 years at most.
Technical data
- Cookies: only the necessary ones (sign-in session, chosen language). No advertising or analytics cookies, which is why we do not ask for your consent. Stripe's payment page uses its own cookies, needed to fight fraud.
- Technical logs (IP address, browser, date), kept by our hosting providers for the security of the service.
- Clicks to shops: we count how often shop links are opened (shop, gift, email or app), with no data about who clicks.
No ads, no analytics, no tracking, no location, no access to your contacts. We never sell or rent any data.
What is public
A creator's page is public: profile, gifts, amounts raised, unboxings. On a gift's page, a fan's name and message appear if they chose to make their contribution public; otherwise they show as "A fan". A fan's email address is never public: only the creator they support sees it, to thank them.
Why we process it
| Purpose | Legal basis |
|---|---|
| Running the service: account, page, contributions, related emails and notifications | Performance of a contract (our terms of use) |
| Keeping the accounting record of contributions | Legal obligation |
| Moderating content, handling reports, preventing fraud and abuse | Legitimate interest and legal obligations |
| Preparing demo pages and reaching out to creators | Legitimate interest |
Our processors
These providers process data on our behalf, following our instructions:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, sign-in, storage of photos and videos | European Union (Frankfurt) |
| Vercel | Hosting of the website and servers | European Union (Frankfurt), global network for static files |
| Stripe | Payments and creator accounts | European Union (Ireland) and United States |
| Resend | Sending emails | United States |
| Google Firebase | App notifications | United States |
Transfers outside the European Union rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. Stripe is also responsible for its own processing, notably verifying creators' identity and preventing fraud: see Stripe's privacy policy.
How long we keep it
- Creator account: as long as the account exists.
- Contributions: 10 years, the retention period for accounting records, even after the creator's account is deleted.
- Pledges: at most 12 months after their last update.
- Notification token: until the app replaces it, or until the account is deleted.
- Demo pages: 30 days.
- Technical logs: a few days to a few weeks, depending on the provider.
Deleting your account
You can delete your account at any time, in the app or on the website: Settings, then Delete my account. Erased right away: your email address and sign-in, your profile (name, bio, picture, social links), your photos and videos, gift images and your notification tokens. Gifts not yet received are cancelled, and so are pending pledges. Your page goes offline and your handle becomes available again.
What remains: the accounting record of contributions already paid (amounts, dates, gift titles, fans' names, emails and messages), attached to an anonymized profile, for the legal period stated above. Your Stripe account belongs to you: Popwish forgets its identifier but does not touch it; you manage or close it on Stripe.
If you chipped in for a gift without an account, write to us to have your message or name removed from the creator's page.
Your rights
You can access your data, correct it, have it erased, restrict its use, object to processing based on our legitimate interest and get it in a common format. Write to support@popwish.app: we reply within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or the authority of your country.
Security
All connections are encrypted (HTTPS). Access to data is restricted by rules at the database level: each creator can only reach their own private data.
Age
You must be 18 to create a page. Popwish does not knowingly collect data from children under 15.
Changes
We may update this policy. The date of the last update is shown at the top of the page; for significant changes, we let creators know by email.