Privacy Policy for Wish-it

A. Controller

This notice provides information pursuant to Articles 12–14 GDPR in a transparent, intelligible and easily accessible way about the processing of your personal data when using our app and website.
Quote (Art. 12(1) GDPR): “The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language.”

B. Types of processed data and data subjects

Categories of personal data

Depending on how you use the service, we process in particular:

• Account / login data Email address, user ID (UID), login provider (Google/Apple) if applicable, tokens
• User content Wish lists, names, descriptions, images/metadata
• Device / usage data IP address, user agent, timestamps, interactions
• Log data / error reports Technical logs for stability and security
• Terminal device storage Local/session storage for settings/session
• Affiliate redirects Partner ID / URL parameters when clicking Amazon links (no third‑party tracking on our site)

Legal bases are listed under section C.

C. Purposes and legal bases of processing

1. Provision and operation (app/web)

Processing for authentication, account management and synchronisation of user-generated content. Legal basis: Art. 6(1)(b) GDPR (performance of a contract / use of the service).

2. Security, troubleshooting and abuse prevention

Processing of technical logs for stability, security, error analysis and prevention of misuse/fraud. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, functional operation).

3. Terminal device access (local/session storage)

• Strictly necessary (without consent): e.g. login session / CSRF or comparable security tokens in session storage.
• Optional (only with prior consent): Convenience/settings/caches (e.g. app_locale, tutorial_*, flutter.group_cache / flutter.participant_cache). Refusal has no functional disadvantages other than loss of convenience.

Legal framework: ePrivacy / Section 25 TDDDG (Art. 5(3) ePrivacy Directive 2002/58/EC) – selection in the consent dialog, withdrawal at any time in “Settings”.
Quote (Art. 5(3) Directive 2002/58/EC): “the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent …; this shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication … or as strictly necessary …”.

4. Affiliate redirects (Amazon)

We label Amazon links as advertising/affiliate links. On our site we only redirect; Amazon sets cookies/tracking on its own domain. Legal basis for our processing: Art. 6(1)(f) GDPR (monetisation / referrer transfer via URL parameters).

D. Services, technologies and third parties

E. Affiliate marketing

F. Retention and deletion

G. Recipients of data & third-country transfers

Where data is transferred to third countries (in particular the USA) (e.g. Firebase Auth, Cloudflare), this takes place exclusively in accordance with Articles 44–46 GDPR (Standard Contractual Clauses; where applicable EU‑US Data Privacy Framework; supplementary measures).

• Processors: Firebase/Google and Cloudflare (each with DPA, SCC/where applicable DPF and documented technical and organisational measures).
• Affiliate: When you click Amazon links, referrer information/URL parameters are transmitted to Amazon; any cookies/tracking take place on Amazon domains.

H. Rights of data subjects

You have rights of access, rectification, erasure, restriction, data portability as well as objection/withdrawal (for consent-based processing). You can lodge a complaint with a supervisory authority.

I. Changes to this notice

We adapt this notice to technical/legal developments and will inform you about material changes in the app and on the website.

J. Other information

Security

We implement appropriate technical and organisational measures (e.g. encryption in transit/at rest, access controls, logging, deletion concepts), based on risk and industry standards.

Terminal device settings and withdrawal

You can withdraw your consent for optional local/session storage purposes at any time in the settings; until consent is given, these optional storage items are disabled. This corresponds to the ePrivacy requirements for terminal device access (in particular Section 25 TDDDG) and the “right to refuse”. Refusal is equally possible; optional convenience remains disabled.