Privacy Policy

Last updated: October 2026

WishCopy ("we", "our", "the app"), operated by Timothy D Anderson, ABN 24 461 519 751, is committed to protecting your privacy. This policy explains what information we collect and how we use it.

Information We Collect

Most of WishCopy runs entirely in your browser. General preferences (favourites, ratings, feedback history, theme preference, a random device identifier) are stored locally on your device using browser localStorage and are not linked to your real identity.

If you use the Interactive Experience feature to turn a wish into a shareable link (any of WishCopy's reveal formats, including Time Capsule, Group Wish, and Invitations), the message text, recipient/sender names you enter, and any photos, sticker images (created in Sticker Studio), or voice or video message you choose to add are uploaded to our database so the link can be opened by the recipient. Voice and video are alternatives to each other — you can attach one or the other, not both, since a video already includes its own audio. Experience links and their media are automatically deleted 7 days after they become openable: for a normal or Musical Card experience that's 7 days after creation; for a Time Capsule (which you can schedule up to a year ahead) it's 7 days after your chosen unlock date; for a Group Wish that hasn't been sent yet, the collection board is kept for up to 90 days so contributors have time to add their wishes, and then follows the same 7-day window once you send it; an Invitation instead follows a 14-day window after its event date, as described below. If you purchase the optional Encore add-on described below, that automatic deletion is switched off for that link: it and its media are then kept indefinitely, until you delete the wish yourself from its Encore management page. Your device identifier is stored alongside each link so you can track its status (opened/not opened, or still collecting) in the "Sent" tab — we do not otherwise know who you are.

When someone opens a wish, they can tap an emoji to let the sender know it landed, and may add a short note (up to 140 characters) and their first name. We store that reaction, the optional note and name, and a random identifier from the recipient's device, against the wish so the sender can see it in their "Sent" tab. It is not shown to anyone else, is never sent by email, and is deleted along with the wish. Please don't put anything in a note you wouldn't want the sender to read.

A Group Wish lets you share a private link so multiple friends can each add their own name, line, and an optional photo or sticker (created with the same Sticker Studio available elsewhere on the site) plus a voice message or video message to one shared experience before you send it (each contributor may add one experience-worth of content — one photo/sticker and one of voice/video — to keep the board from being flooded). Each contributor's content is stored the same way as any other Interactive Experience content, and is visible to anyone with the private contribution link until the board is sent or expires.

An Invitation lets you send a private link with an event date, an optional location, and an optional personal message, along with any photo, sticker, or voice/video message you choose to add — stored the same way as other Interactive Experience content. Anyone with the link can open it and reply with an RSVP (yes, no, or maybe), an optional name and note, and an optional photo, sticker, voice, or video message of their own; each guest's reply is stored the same way as a Group Wish contributor's. Guests only ever see the total RSVP counts and their own reply — never other guests' names, notes, or media — while you, as the organizer, can see every guest's reply on a dashboard. Because guests need to be able to reply for a while after the event, an Invitation link and its replies are automatically deleted 14 days after the event date you set, rather than the 7-day window used for other Interactive Experiences.

Encores (Paid Add-On)

Encore is an optional, one-time paid add-on for an Interactive Experience link: it lets you schedule up to 12 dated follow-up notes — each a short message and, if you want, a photo and/or an animated GIF — that reopen the same link with something new on each date, over up to a year. When you add a GIF, the search runs through our own server (so GIPHY, the GIF provider, does not see you); the GIF you pick is then loaded straight from GIPHY's servers by the recipient's browser when they open the note. The management link you use to set these up carries an unguessable access token in its URL fragment, which is never sent to our servers or to Google Analytics. Payments are processed by Stripe — its own checkout page will ask for your email address (so it can send you its payment receipt) and your card details; we never receive or store either. See the Stripe Privacy Policy for how Stripe handles that data. As described above, buying Encore switches off the automatic 7-day deletion of the underlying Experience link and its media: they are then kept indefinitely, until you delete the wish yourself using the delete control on its Encore management page, which permanently erases the link, its media, and every Encore.

Separately, when a wish has Encores scheduled, the person who received it can choose to enter their email address on the reveal page to be told when each one unlocks. That address is used only to send those notifications, for that one wish; it is never added to a mailing list or used for marketing, and every email carries a one-click unsubscribe link. It is stored in our database and passed to our email provider, Resend, solely to send the message. It is deleted when the sender deletes the wish, or immediately if you use the one-click unsubscribe link in any of the emails, whichever happens first; until then it is retained only to send these per-Encore notifications. These notification emails never reveal the content or the date of an upcoming Encore.

Birth Sky (Paid Reveal)

Birth Sky is an optional paid reveal that draws the real night sky from the moment someone was born. To make one, you give us the birthday person's date of birth, the time of birth if you know it, and the town or city they were born in (picked from a fixed list of cities, so no street address is ever asked for), along with their name, your name and your message. These are stored in our database with the link so the sky can be drawn when it's opened; the star positions themselves are calculated in the browser. A date and place of birth are personal information, so please only make a Birth Sky for someone you're confident would be happy for you to share those details with us. The free preview runs entirely in your browser and saves nothing. Payments are processed by Stripe in the same way as Encore, above: we never receive or store your card details.

A Birth Sky link is saved as soon as you go to pay. If payment isn't completed, it can't be opened and is deleted automatically 7 days later, like any other Experience link. Once paid, it is not deleted automatically: the link, the birth details and your message are kept until you delete the wish yourself from the "Sent" tab on the device you made it on (or from its Encore page, if you also bought Encores). If you add the optional printable sky, that A4 picture is created on the recipient's own device at the end of their reveal and saved there by them; it is never uploaded to us.

Music Box (Paid Reveal)

Music Box is an optional paid reveal that plays a tune made from the birthday person's name. To make one, you give us their name, your name, your message, which carousel riders you'd like and, if you choose, one photo for the locket. These are stored with the link (the photo in the same file storage as other Experience photos) so the reveal can be shown when it's opened; the tune itself is worked out in the browser. The free preview runs entirely in your browser and saves nothing. Payments are processed by Stripe in the same way as Encore, above: we never receive or store your card details.

A Music Box link is saved as soon as you go to pay. If payment isn't completed, it can't be opened and is deleted automatically 7 days later, like any other Experience link. Once paid, it is not deleted automatically: the link, the photo and your message are kept until you delete the wish yourself from the "Sent" tab on the device you made it on (or from its Encore page, if you also bought Encores).

Pop-Up Book (Paid Reveal)

Pop-Up Book is an optional paid reveal that tells someone's birthday as a 3D pop-up book. To make one, you give us their name, the age they're turning, your name, your message and, if you choose, a few short notes and lines that appear inside the book. These are stored in our database with the link so the book can be shown when it's opened; all the pictures are drawn in the browser. The free preview runs entirely in your browser and saves nothing. Payments are processed by Stripe in the same way as Encore, above: we never receive or store your card details.

A Pop-Up Book link is saved as soon as you go to pay. If payment isn't completed, it can't be opened and is deleted automatically 7 days later, like any other Experience link. Once paid, it is not deleted automatically: the link, the words inside the book and your message are kept until you delete the wish yourself from the "Sent" tab on the device you made it on (or from its Encore page, if you also bought Encores).

The Shed (Paid Reveal)

The Shed is an optional paid reveal in which the birthday person follows a note out to a shed and finds a ute with their name on its number plates. To make one, you give us their name, your name, your message and, if you choose, their age, a few short notes that appear during the reveal, one photo and a short voice message (recorded on the page or uploaded). These are stored with the link (the photo and the recording in the same file storage as other Experience photos and voice messages) so the reveal can be shown when it's opened. The microphone is only used on your device, and only while you are recording your message. The free preview runs in your browser and saves nothing. Payments are processed by Stripe in the same way as Encore, above: we never receive or store your card details.

When the recipient opens The Shed it does not ask for their camera, microphone, location or motion sensors. The picture of their registration papers at the end is drawn on their own device for them to save or share; it is never uploaded to us.

A Shed link is saved as soon as you go to pay. If payment isn't completed, it can't be opened and is deleted automatically 7 days later, like any other Experience link. Once paid, it is not deleted automatically: the link, the name and age, the photo, the voice message and your message are kept until you delete the wish yourself from the "Sent" tab on the device you made it on.

Zodiac (Paid Reveal)

Zodiac is an optional paid reveal that forms the birthday person's birthstone in their own hand, through their phone camera. To make one, you give us their name, their date of birth, your name, your message and, if you choose, a few short notes and lines that appear during the reveal, up to three photos and a short voice message. These are stored with the link (the photos and the recording in the same file storage as other Experience photos and voice messages) so the reveal can be shown when it's opened. A date of birth is personal information, so please only make a Zodiac for someone you're confident would be happy for you to share it with us. The free preview runs in your browser and saves nothing. Payments are processed by Stripe in the same way as Encore, above: we never receive or store your card details.

When the recipient opens a Zodiac, it asks to use the camera (to show their hand and work out where it is), the microphone (to hear them blow out the candles and breathe on the stone) and the motion and orientation sensors (to look around inside the stone). The camera picture, microphone sound and sensor readings are processed only on the recipient's own device. They are never uploaded to us or stored on our servers. If the recipient says no to any of them, the reveal carries on without it, on a jeweller's tray with buttons to press instead. Hand tracking is done on the device by MediaPipe, open-source software published by Google. We serve it from our own site, so nothing is fetched from Google or any other outside host to run it, and no camera pictures leave the device. At the end, a short video clip of the finished stone is made on the recipient's own device for them to save or share; it is never uploaded to us.

A Zodiac link is saved as soon as you go to pay. If payment isn't completed, it can't be opened and is deleted automatically 7 days later, like any other Experience link. Once paid, it is not deleted automatically: the link, the date of birth, the photos, the voice message and your message are kept until you delete the wish yourself from the "Sent" tab on the device you made it on.

The Atrium (Free AR Reveal)

The Atrium is a free reveal in which a door rises out of the recipient's floor, with a small museum about them behind it. To make one, you give us the birthday person's name, your name, your message, a birth year, an optional secret note, up to four short exhibit labels, an optional tick for "a real gift is on its way", and up to three photos for the paintings. These are stored in our database and file storage with the link so the reveal can be shown when it's opened. The Atrium is free, takes no payment, and has no Encore add-on. Like other Experience links, it and its photos are automatically deleted 7 days after it becomes openable.

When the recipient opens an Atrium, it asks to use the camera (to show their room behind the door), the motion and orientation sensors (to keep the door fixed in place as they move) and the microphone (for the blowing, knocking and calling-out moments). The camera picture, sensor readings and microphone sound are processed only on the recipient's own device. They are never uploaded to us or stored on our servers. A call into the dome is played back to them on their device and then discarded. At the end, the recipient can record a short video of their own reveal; it is built and saved on their device only if they choose to save or share it, and we never receive a copy. Each permission is optional and every moment has a touch alternative if it is declined.

Floor tracking is provided by the 8th Wall XR Engine (by Niantic Spatial), which is loaded from the jsDelivr content delivery network when the reveal opens, so jsDelivr will see the recipient's IP address like any host serving a file. The engine runs in the browser and may send technical usage information (such as device and session details, not camera or microphone content) to Niantic Spatial; see Niantic Spatial's privacy policy. The page you use to make an Atrium does not run this engine.

Microphone, Camera & Motion Sensor Access

Some features request device permissions: the "blow out the candles" interaction and "Shake to Reveal" (which read volume/motion data only, in your browser, to detect a blow or a shake, and never record, transmit, or store that data), the Atrium and Zodiac reveals (which use the camera, motion sensors and microphone only on the recipient's device, as described above), and the optional voice- or video-message recording feature (which does save the recording you create, as described above — video recording additionally requests camera access). These permissions are only requested when you actively use the relevant feature, and only with your device's consent.

Feedback and Reviews

When you submit a star rating and review through the Feedback feature, your rating and written comment are stored in our database hosted on Netlify. Reviews may be displayed publicly within the app and do not contain your name, email, or any identifying information unless you choose to include it in your comment text.

Advertising

WishCopy uses Google AdSense to display advertisements. Google may use cookies and similar technologies to serve ads based on your visits to this and other websites. Where required (for example, for visitors in the EEA, UK, or Switzerland, or under US state privacy laws), we present a consent choice screen powered by Google's Funding Choices before any personalised advertising cookies are set. You can review or change your choice at any time using the "Manage Ad Preferences" link in the footer of the WishCopy home page, or opt out of personalised advertising generally via Google Ad Settings. This Privacy Policy page itself carries no advertising.

Affiliate Links

WishCopy is a participant in the Amazon Associates Programme, an affiliate advertising programme designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon. The "🛒 Buy" links in the Gift Ideas feature, and the gift ideas on The Atrium's create page, may be Amazon affiliate links (they are never shown to the person opening an Atrium); if you follow one and make a qualifying purchase, WishCopy earns a commission at no extra cost to you. Amazon may use cookies to track that a purchase came from one of these links, subject to Amazon's own privacy policy.

AI-Generated Content

The Custom Vibe Creator feature uses the Anthropic Claude API. When you use this feature, your vibe description and recipient name are sent to Anthropic's servers to generate birthday messages. Please review Anthropic's Privacy Policy for details on how they handle API data.

Because this is a paid, metered feature, we apply usage limits to prevent automated abuse. To do that, your IP address is recorded in our server logs alongside each generation attempt and counted against a short-lived usage quota. These counters expire within the hour and are deleted automatically; the IP address is used only to enforce the limits and to investigate abuse, and is not linked to your wishes or shared with anyone.

Third-Party Services

• Google AdSense & Funding Choices — advertising and ad-consent management (google.com/adsense)
• Google Analytics — site usage analytics (analytics.google.com)
• Cloudflare Turnstile — bot detection on message, photo, and RSVP submissions, so the service stays usable for real people (cloudflare.com)
• Amazon Associates — affiliate links for the Gift Ideas feature (amazon.com.au)
• Stripe — payment processing for the optional Encore add-on and the Birth Sky, Music Box, Pop-Up Book, Zodiac and The Shed reveals (stripe.com)
• jsDelivr and Niantic Spatial (8th Wall) — delivery and operation of the floor-tracking engine used by the Atrium reveal (jsdelivr.com, nianticspatial.com)
• Resend — sending the optional Encore reminder emails, when a wish recipient opts in (resend.com)
• GIPHY — GIF search for the optional Encore add-on, and delivery of a chosen GIF to the recipient's browser from GIPHY's servers (giphy.com)
• Anthropic Claude API — AI phrase generation (anthropic.com)
• Netlify — hosting, database storage for reviews, visit counts, and Interactive Experience links (including any photos, voice recordings, or video messages you choose to add)

Cookies

WishCopy itself does not set tracking cookies. Google Analytics sets cookies to measure site usage, and Google AdSense and Funding Choices may set cookies for advertising and consent-recording purposes, subject to the consent choice described above. Cloudflare Turnstile may also set a cookie to verify you're not a bot when you submit a message, photo, or RSVP. You can also manage cookie preferences through your browser settings.

Children's Privacy

WishCopy is intended for users aged 13 and over and is not directed at children. We do not knowingly collect personal information from children under 13. If you create an Interactive Experience for a child's birthday, please avoid uploading identifying photos, voice recordings, or videos of children without a parent or guardian's consent.

Your Choices

You can prevent an Interactive Experience link from being opened by not sharing it further — links are not indexed or made discoverable, and are automatically deleted on the schedule described above. You can clear your local favourites and device identifier at any time by clearing your browser's site data.

Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of WishCopy after changes constitutes acceptance of the updated policy.

Contact

For privacy-related questions, contact us at hello@wishcopy.com