Privacy

What we collect

• What you put in a card: names, your letter and wishes, photos, a song link or music file, the PIN hint, and the date for a time-lock if you set one.
• Your email address, to send you the card link and your manage link.
• The PIN, stored only as a one-way hash. We can check a PIN against it but can’t read it back.
• Payment records: the amount, plan, and Razorpay’s order and payment references. Razorpay collects your card, UPI or bank details; we never receive them.
• When a card is opened: the time of the first opening and a count of openings, so you can see them on your manage page.
• Wrong-PIN attempts: a scrambled form of the visitor’s network address, kept to slow down guessing. It can’t be turned back into the address.

We don’t run advertising or analytics trackers, and we don’t sell or rent personal data to anyone.

Cookies and storage on your device

While you build a card, the draft is saved in your browser so you don’t lose it. When you go to pay, we set one cookie that proves the draft is yours. Both are needed for the site to work; there are no advertising or tracking cookies.

How card content is protected

• Photos, the letter and the song are sent to a browser only after the correct PIN is entered.
• Photos and music are kept in private storage and served through links that stop working after an hour.
• Card pages are marked so search engines don’t list them.

Who helps us run the service

These companies process data for us, only to provide their part of the service:

• Supabase: the database and private file storage.
• Cloudflare: hosting and delivery of the site.
• Razorpay: payments.
• Resend: sending our emails.

Some of these providers store or process data on servers outside India.

How long we keep it

• A published card is kept until you delete it.
• When you delete a card, its photos, music, letter, names, PIN hash and your email address are removed and the link stops working.
• Payment records are kept after deletion for as long as tax and accounting law requires. They hold no card content.
• An unfinished draft that was never paid for can be removed on request, and we may clear old ones.

Your choices

• Delete: open the manage link from your confirmation email and choose “Delete this card”.
• See or correct your data, or withdraw consent: write to support@wishlock.in from the email address you used to buy the card.
• If you appear in someone else’s card and want it taken down, write to us with the link and we will look into it.

Children

WishLock is for people aged 18 and over. We don’t knowingly collect data from children.

Contact and complaints

For privacy questions, requests or complaints, including under India’s Digital Personal Data Protection Act, contact us. We aim to reply within two working days.

• Operated by: WishLock
• Email: support@wishlock.in

If we change this notice, the date at the top will change with it. See also our terms of use.