Privacy Policy

Last updated: September 19, 2026. 繁體中文 · 日本語

SHU NING LIANG ("we" or "us") is responsible for data processing in the Pocket Wish app and website. For privacy requests, email support@pocketwish.win or use our Support page.

Data we handle and why

Accounts and social features: Depending on your device and choice, Apple or Google sign-in gives us the identifiers needed to create an account and any name or email the provider supplies under your settings. We also process your display name, username, avatar, friend invitations and relationships, blocks, reports, and necessary security records. We use these to sign you in, identify users, manage access, respond to reports, and prevent abuse.

Wishes and gifts: We store wishes, lists, images, product URLs, prices, notes, sharing settings, gift reservations, and purchase markers that you choose to save to your account. This lets us sync your content, support sharing, and coordinate gifts. An unfinished or unsaved editing draft may stay on your device so you can resume after restarting the app. Discarding the draft, clearing app data, or removing the app may erase it.

Notifications and diagnostics: If you allow notifications, we process a device push token, installation and permission information to send friend and gift updates and wish reminders you set. Wish reminder text includes the wish title and may appear on your device's lock screen; other notifications do not show wish content. Delivery data for a wish reminder may include a wish identifier so the app can open the relevant wish. You can adjust notification previews in device settings. We use Firebase Crashlytics to process crash records, app and device information, and diagnostic identifiers to maintain stability.

In-app purchases and support: If you use the digital shop, we process the item, purchase status, platform transaction evidence, and necessary account linkage to verify purchases, grant or revoke use, and resolve disputes. If you contact support, we process the contact details, message, and related case records you provide. The website and service providers may also process IP addresses, device or browser information, and connection records to deliver and secure the service.

Who can see shared content

Lists are private by default. When friend sharing is enabled, friends who meet the access conditions can see the list and shared wish fields. Individual wish links have a different audience: while sharing is enabled, anyone with the link, including a signed-out visitor or a non-friend, may see the shared wish content such as images, product details, and notes. Avoid placing sensitive information in shared content. Turning off sharing or blocking can limit future access, but cannot retrieve copies others have already saved. The website host may process the full URL and connection information when a sharing link is opened. Reservations still require friendship and other access conditions.

Retail links and affiliate platforms

When you import a product, the service may contact its website for public product information. When you open a retailer link, the retailer or an affiliate platform may receive the product URL and ordinary connection data, such as your IP address and device or browser information. Their own policies govern further processing. Some links may result in a commission to us after a qualifying purchase. We do not add your Pocket Wish account, wish, or list identifiers for affiliate attribution.

Service providers and processing locations

We use Google Firebase for sign-in, cloud data, backend services, and crash diagnostics, and Cloudflare for the website and image storage. Apple, Google, and device push services assist with sign-in, notifications, and in-app payments. We send purchase evidence to the relevant store for verification and may send it to IAPKit for additional diagnostics. These providers process data needed for their services. Core cloud data and backend services are deployed in Osaka, Japan. Firebase Authentication processes sign-in data in the United States. Website, image, notification, and other provider data may be processed in Taiwan or other countries or regions where those providers operate, and transmitted over the internet.

Retention and deletion

We generally keep account and wish data while your account is active and as needed to provide the service. Friend invitations expire after use or 30 days. After a username change, the former name is kept for 30 days to prevent immediate reassignment. Firebase says it keeps crash records and associated identifiers for 90 days before starting removal from live and backup systems. Other notification, support, and security records are kept as needed for their purposes and are subject to provider retention and backup periods.

You can delete wishes or lists in the app and delete your account in app settings. If you cannot use the app,request account deletion on the web. Account deletion removes linked content and social data, disables sharing, and disconnects notification devices. Unpurchased reservations are cancelled. A purchased marker may remain without the buyer's identity to help avoid a duplicate gift. For digital purchases, we remove the account link and stored Google purchase tokens, but may retain platform transaction identifiers and limited duplicate-check data to prevent duplicate claims or handle disputes. Legal obligations, dispute resolution, and provider backups may require longer to clear some data.

Your choices and rights

You may decline optional information, sharing, notifications, or product links. You can edit a draft without signing in, but cannot sync it to an account or use features that require sign-in. Declining notifications does not stop you checking relevant status in the app. If you do not provide images or product URLs, related import or display features may be unavailable. Email us at the address above to ask about, access, or obtain a copy of your personal data, or request that we supplement, correct, stop collecting, processing or using, or delete it. We may verify your identity to protect the account and will handle requests subject to applicable law.

Controlling language

This Privacy Policy is prepared and operated in English as the authoritative document. Translations into Traditional Chinese, Japanese, or other languages are provided for convenience only. In the event of any conflict, discrepancy, or gap between the English version and any translation, the English version shall control and prevail.

If our data handling changes materially, we will update this policy and give notice in an appropriate place.