Privacy Policy

Wish Angel ("we", "us") is a greeting-card service that remembers your important dates, designs AI-generated cards, and delivers them by email. Privacy contact: mehdi.amir.app@gmail.com.

Your account: email address and a password (stored as a secure hash by our authentication provider), your plan, preferences (send time, timezone, tone, sign-off), and yearly usage counts.

Contacts you add: names, email addresses, event dates (such as birthdays), how you know them (for example “family” or “colleague”), and any personal notes or memories you write about them. You provide this data so Wish Angel can create and deliver cards on your behalf.

Cards: the headlines, messages, and images Wish Angel generates, plus delivery logs (whether an email was delivered successfully).

Purchases: if you subscribe in our mobile app, the purchase is processed by Apple or Google and managed through RevenueCat. We receive your subscription status — never your card number or payment details.

Technical data: when you sign in, sign up, reset a password, or respond to a card, we briefly store the IP address the request came from, together with a counter, so we can rate-limit abuse and protect accounts. These records are not linked to your account and are deleted automatically, typically within about two days.

We do not collect precise location, advertising IDs, or contact lists from your device — you type in only the people you choose.

Only to run Wish Angel: generating card text and artwork, sending cards at the time you chose, showing you your history, enforcing plan limits, and notifying you about deliveries. We do not sell personal data, use it for advertising, or share it with anyone except the service providers below.

We share the minimum data required with the providers below. Each is bound by its own terms to protect your data to the same or an equal standard as this policy, and none may use it for any purpose other than providing the service to us:

• Supabase — database, authentication, and image storage.
• OpenAI (and optionally Ideogram) — recipient first name, occasion, relationship, the age the occasion marks (so a milestone birthday can be named), and your notes and memories are used to generate the card message and artwork. Only the first name is sent, never a surname. None of it is used to write or illustrate a card until you give explicit permission in the app, and you can withdraw that at any time in Settings → AI-written cards; cards then use our built-in designs. Separately, and whether or not you give that permission, text you type (names, labels, notes and memories) is checked by OpenAI's automated moderation service before it is saved, so that content we deliver on your behalf can be screened for abuse. Recipients' email addresses are never sent to OpenAI. OpenAI processes this data only to provide these services to us, does not use it to train its models, and retains it for at most 30 days for abuse monitoring.
• Resend — recipient email address and the card, to deliver emails.
• RevenueCat / Apple / Google — subscription status for in-app purchases.
• Vercel — hosting; requests to the app pass through its infrastructure.

When you add someone to Wish Angel you confirm you know them personally and have their permission (or a reasonable basis) to send them greetings. Recipients can contact us at mehdi.amir.app@gmail.com to have their information removed.

Your data is kept while your account is active. You can delete your account at any time in Settings → Delete account inside the app — this permanently removes your profile, contacts, cards, images, and notifications. You can also email us to request deletion. Backups and delivery records held by our providers are purged on their standard schedules.

You can download a copy of your data anytime from Settings → Download my data.

Data is encrypted in transit (HTTPS) and at rest by our providers. Sessions use secure, httpOnly cookies. Access to production data is limited to the operator of the service.

Wish Angel is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

Depending on where you live (e.g. GDPR, CCPA, PIPEDA), you may have the right to access, correct, export, or delete your personal data. The in-app tools above cover all of these; for anything else, email us and we will respond within 30 days.

If we change this policy we will update the date above and, for material changes, notify you in the app.