Privacy Policy — WishMeLuck
Effective 31 August 2026 · Samosfi Studio, Dublin, Ireland · Contact: info@kalibrefin.com
This policy follows the structure you'd expect from any serious social app — and states plainly where WishMeLuck, today, simply collects less.
1. Information we process
1.1 Data you provide directly. Your display name and handle (chosen at onboarding); your asks; drawings; photographs of handwritten notes and deeds; voice celebrations; the moment you mark a wish fulfilled; letters you send to one person; and, if you sign in with Apple, the account identifier Apple returns to us (never your Apple ID password, and only a relay address if you choose Hide My Email).
1.2 Data created by using the app. Streak counts, seen/unseen states, moderation reports you file, and how long you spent making an act (the app measures effort rather than asking you to claim it). The app sends a short list of product events — that an ask was posted, that an act was made and on which rung, that a wish was fulfilled — to Google Analytics for Firebase, together with a Firebase app-instance identifier. Never the words of an ask, a letter, or anything from the Book: only that a thing happened. We use it to see whether the effort ladder gets climbed and whether the loop closes. It is not used for advertising or cross-app tracking, and we do not enable Google's advertising features. If you sign in with Apple, your account id is also set as the analytics user id so the funnel can be read per person rather than per install.
1.3 Where this data lives. Everything is stored on your device. If you join a circle, the content you share with it — asks, acts, celebrations, and letters — syncs through Apple iCloud (CloudKit), in a zone shared with that circle, under Apple's infrastructure. Letters are addressed to one person and shown only to them, but they are not end-to-end encrypted: like the rest of your circle's content they live in the shared iCloud zone. Please don't put anything in a letter you would not want recoverable.
Your Book and your Big Wish are backed up to your account — the pages you keep for yourself and the one wish you don't say out loud. They are stored on our Supabase backend (EU region) so your book follows you to a new phone, and they are readable by no one but you: row-level security on the server makes a private page invisible to every other account, and a sealed Big Wish stays that way until you mark it fulfilled. We look at what people wish for in aggregate — the kinds of things, never who wished what — to understand what the app is for. You can delete any page, or the whole account, at any time.
If you sign in with Apple, your display name, handle, and account identifier are stored on our Supabase backend (EU region) so your profile can follow you to a new phone. Content is not stored there. Moderation reports are stored in the app's public CloudKit database for review.
1.4 Signing in is optional. The app works completely without an account. Sign in with Apple only carries your profile to another device; skipping it costs you nothing on the phone you're holding.
1.5 Future versions. If a new third-party SDK ships, this policy will be updated before that version releases, the app will say clearly what changed, and the App Store privacy label will change with it.
2. How we use information
To run the service (showing your circle its wall, syncing acts and celebrations); to keep it safe (automated text/image screening, report handling, enforcement per the Community Guidelines); to comply with law.
3. When we share information
With the people you chose — your circle. With Google (Firebase Analytics) as a processor, under its own data-processing terms, for the purposes above only. With authorities where the law requires it, or where child-safety material must be reported. With no one else: no advertisers, no data brokers, no "partners".
4. Children
WishMeLuck is not for children under 13, and we never knowingly collect data about them. If you believe a child under 13 is using the service, contact us and the account will be removed.
5. International transfers
Circle data is processed by Apple's iCloud infrastructure under Apple's own safeguards, which include the European Commission's standard contractual clauses where transfers outside the EEA occur.
6. How long we keep information
On-device data lives until you delete it or the app. Circle data lives in the shared iCloud zone until the content is deleted or the circle dissolves. Accounts inactive for 2 years may be deleted after notice. Moderation records are kept as long as needed for safety and legal purposes.
7. Your controls
Delete any of your content in the app; leave a circle; block anyone; delete the app to erase local data. Your Private Book is readable by no one but you, ever. Your Big Wish can be rewritten as many times as you like, and deleting it deletes it — there is no earlier version kept anywhere. If you signed in with Apple, write to us and your backend profile row is deleted within 30 days.
8. Your rights (GDPR)
You have the rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. Because your data sits on your device and in your own iCloud, most of these you can exercise directly; for anything else, write to info@kalibrefin.com. You may also lodge a complaint with the Irish Data Protection Commission.
9. Updates
We'll post changes here with a new effective date; material changes are announced in the app.