Browse first
Core discovery works without an account. Sign in only for synced saves, alerts, social features, or rewards.
Privacy Policy
Your taste is personal. We treat it that way.
This Policy explains what Wishlisted collects, why we need it, who receives it, and the controls available to you.
The short version: you can browse resale and retail-sale discoveries without an account, checkout happens at independent stores, and we do not sell your personal information for money.
Effective and last updated:
Stores stay separate
The store you visit—not Wishlisted—controls checkout, payment, authentication, fulfillment, and returns.
Real controls
Export or delete account data, change notifications, reset product signals, and keep profiles private.
Jump to a section
Scope and who is responsible
This Privacy Policy applies to Wishlisted website, web app, mobile apps, luxury-resale discovery, retail Sales experience, newsletters, customer support, rewards program, and related services that link to it (together, the “Service”). Wishlisted is responsible for personal information processed for the Service.
Wishlisted is a search, discovery, comparison, alert, and referral service. When you leave Wishlisted for a resale marketplace, brand, retailer, or aggregator, that destination independently controls the information it collects during checkout, authentication, shipping, returns, and customer support. Review its privacy notice before providing information there.
Information you give us
You may browse much of the Service without creating an account. Depending on what you choose to use, we collect:
- Account and authentication information: email address or phone number, display name, handle, profile image if supplied by a sign-in provider, selected sign-in method, verification status, profile visibility, password credential stored in protected hashed form, one-time verification and recovery challenges, provider identifiers, encrypted provider access, refresh, or ID tokens when supplied, and session records. If you use Google or Apple, Wishlisted receives the account information you authorize but does not receive your Google or Apple password.
- Taste and shopping preferences: brands, categories, sizes, colors, materials, hardware, metals, gemstones, budget, preferred or excluded stores, saved resale listings and retail-sale offers, searches, collections, Hunts, merchant and keyword watches, votes, follows, destination, sale market, and display currency.
- Research and waitlist answers: age range, gender description, shopping frequency, device preference, interests, frustrations, and marketing consent. Optional questions may be skipped where the interface allows.
- Communications, rewards, and collaboration inquiries: newsletter signup, support messages, feedback, notification preferences, missing-reward claims, payout or tax details if redemptions are introduced, partnership type, company, social profile or website, audience, market, proposal, and any other content you send us.
- Social content: profile details, public collections, shared Hunts, shortlists, captions, votes, and other content you choose to publish.
Do not send payment-card information, government identifiers, authentication documents, or sensitive personal information through Wishlisted. Purchases and payment details are handled by the store you choose.
Information collected automatically
We collect limited technical and activity information needed to operate, secure, understand, and improve the Service:
- device type, operating system, browser or app version, language, IP address, approximate region, user agent, crash and performance information;
- session identifiers, referral pages, campaign parameters, pages viewed, searches, filters, impressions, saves, comparisons, Hunts, retail-sale and merchant watches, shares, alert opens, and feature interactions;
- outbound store visits, including the resale listing or retail-sale offer, merchant, storefront market, time, campaign, placement, source price and currency, and a pseudonymous click or Sub ID used for attribution; and
- cookie, local-storage, and similar identifiers used to maintain a session, remember currency and preferences, prevent abuse, preserve referral attribution, and—when you allow analytics—measure page views, acquisition channels, and product performance.
We do not use precise GPS location by default. A destination you select for shipping or landed-price context is treated as a preference, not as proof of your residence.
App and browser permissions
The mobile app asks before accessing your photo library or notifications. The website asks before enabling browser notifications. You can change either permission in your device or browser settings.
- Photo library: used only when you choose the screenshot-search feature. In the current version, the selected image remains on your device and is not uploaded for automated identification. The current flow does not request camera or microphone access.
- Notifications: an app push token or browser push subscription is associated with your account and preferences so we can deliver the Hunt, listing, deal, and Sales messages you select. A browser subscription contains its push-service endpoint and public encryption keys; it does not contain your search or Hunt text.
If a future version processes an image on our servers or with an image-recognition provider, we will explain that processing in the interface and update this Policy before enabling it.
Information from other parties
We may receive information from:
- Sign-in providers if and when you choose an enabled Apple, Google, phone, or other supported account method, limited to the profile and authentication information authorized in that flow.
- Resale stores, retail merchants, aggregators, and catalog partners supplying listing or sale-offer facts, photos, prices, variants, stock, availability, condition language, policies, storefront market, and destination eligibility.
- Affiliate networks and merchants reporting an attributed click or transaction, merchant, order reference, sale amount, currency, commission, approval, reversal, or return status. We do not need your payment-card number to match an eligible reward.
- Email and push providers reporting delivery, bounce, open, click, unsubscribe, and device-token status.
- Referral participants when a referral code is used. We do not show either participant the other person’s purchase details.
How and why we use information
| Purpose | Examples | Primary basis where required |
|---|---|---|
| Provide the Service | Accounts, search, saves, Hunts, alerts, currency, profiles, collections, support, and rewards | Performing our agreement with you |
| Personalize discovery | Taste signals, recommendations, ranking, preferred and excluded stores | Performance of the Service and legitimate interests |
| Measure and improve | Feature use, funnel analytics, reliability, testing, and product research | Legitimate interests; consent where required |
| Attribute and fund rewards | Opaque click IDs, merchant/network conversion reports, fraud review, reversals, and payout records | Performing our agreement and legitimate interests |
| Communicate and assess collaborations | Verification, service notices, requested alerts, support, consented marketing, and reviewing or responding to partnership proposals | Performing our agreement, steps requested before an agreement, legitimate interests, or consent |
| Protect and comply | Security, rate limiting, fraud prevention, disputes, accounting, and lawful requests | Legitimate interests and legal obligations |
Where we rely on legitimate interests, we consider the impact on people and use the information only when those interests are not overridden by your rights. You may object as described below.
Optional Gmail merchant discovery
Signing in with Google does not give Wishlisted permission to read Gmail. If this feature is available and you separately choose to connect Gmail, Wishlisted requests a limited Gmail metadata permission for the single purpose of suggesting fashion and resale stores you may want to follow. Declining or disconnecting it does not prevent ordinary browsing or Google sign-in.
- What is processed: sender-domain headers and received times from messages received during the configured lookback period, currently 100 days. We use those facts to count likely merchant domains and suggest matches for you to confirm.
- What is not collected for this feature: message bodies, subjects, snippets, attachments, Gmail message identifiers, contacts, or outgoing mail. Wishlisted personnel do not read your messages.
- What is retained: encrypted, revocable Google authorization tokens while the connection remains active, plus normalized candidate store name, domain, confidence, aggregate occurrence count, and first or last evidence time. Raw Gmail headers are discarded after processing.
- Admin review: operators may see aggregated, sanitized demand for a candidate domain so they can decide whether to research it for the catalog. Passive mailbox observations are not shown in the user-attributed activity feed. A store you explicitly follow or submit is an account action and may be shown there with your account.
Disconnecting Gmail deletes the stored authorization and your Gmail-derived suggestions. Stores you separately confirmed or submitted can remain as account preferences and operational history. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Gmail-derived information for advertising, credit, employment, insurance, or other unrelated purposes.
Taste profiles and automated processing
Wishlisted may infer style preferences—such as favorite brands, eras, silhouettes, materials, colors, or price ranges—from your activity. We use these signals to personalize discovery, explain recommendations, order results, and create optional shareable taste summaries.
These systems do not make decisions that produce legal or similarly significant effects. You can reset local product data, change preferences, exclude stores, make a profile private, or delete your account. Availability, “rare,” “deal,” and comparable-listing labels are informational estimates based on the catalog snapshot—not appraisals, guarantees, or purchase advice.
Affiliate links and third-party stores
Wishlisted includes both paid and unpaid links. When you open a resale listing or retail-sale offer, we record the visit and may append an affiliate identifier. The destination store, affiliate network, and their technology partners may use their own cookies, pixels, device information, or account information under their policies. Wishlisted does not control those practices.
Loading store-supplied product images may also send ordinary web-request information—such as IP address, user agent, and referrer—to the image host. We use authorized local or hosted copies where available, but some images may be delivered by the source store.
How long we keep information
We retain information only for as long as reasonably necessary for the purposes above, considering account status, feature needs, security, dispute and chargeback windows, contractual requirements, and law.
- Account and product data: while your account is active, then removed or de-identified following a valid deletion request unless an exception applies.
- Gmail merchant discovery: encrypted authorization remains only while connected. Disconnecting deletes it and the user-specific derived suggestions; transient raw headers are not retained after a scan.
- Incomplete research signups: only while needed to measure and secure the signup flow, then deleted or aggregated.
- Affiliate and rewards records: through merchant approval, return, reversal, payout, accounting, fraud, and legal limitation periods.
- Support, security, and consent records: long enough to resolve the request, demonstrate choices, prevent abuse, and meet legal obligations.
- Collaboration inquiries: while we assess and respond to the proposal and, if discussions continue, for the relationship, contract, dispute, and legal-retention periods that apply. Closed or declined inquiries are deleted or de-identified when no longer reasonably needed.
Deletion removes information from active systems; limited residual copies may remain in protected backups until overwritten on their ordinary schedule. We may retain de-identified or aggregated information that cannot reasonably identify you.
Security and international transfers
We use administrative, technical, and organizational safeguards designed for the nature of the information, including access controls, signed sessions, rate limits, data minimization, and encrypted transport. No system is perfectly secure, so we cannot promise absolute security.
Wishlisted and its providers may process information outside your province, state, or country, including in Canada and the United States, for hosting, database operations, authentication, email, push delivery, security, support, analytics, and affiliate attribution. Those locations may have different privacy laws, and foreign courts, law-enforcement agencies, or authorities may be able to access information under local law. Where required, we use contractual or other recognized transfer safeguards and make supplementary information available on request.
We assess suspected security incidents and provide notice to affected people or regulators when applicable law requires it.
Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, or obtain a portable copy of personal information; withdraw consent; object to or restrict processing; and appeal or complain to a regulator.
Verified account holders can export core account-connected information in Settings, including the originating signup record, versioned legal-acceptance receipts, and reward, referral, attribution, watch, communication, support, collaboration inquiry, newsletter, and usage records currently linked to the account. Account deletion is available inside Settings and through our public account-deletion request page. It removes the active account, connected rewards data, device tokens, watches, and identified product activity; it also clears Wishlisted’s current web or iOS session identifier on that device. A legal-acceptance receipt is de-identified rather than erased when it remains reasonably necessary to demonstrate the document version and choice, resolve a dispute, or meet a legal obligation. It does not automatically erase a collaboration inquiry submitted separately from the account because we may need it to evaluate the proposal, continue requested discussions, or meet contract, dispute, or legal obligations. An earlier research submission, anonymous funnel event, de-identified conversion record, or information subject to a legal-retention exception may also remain. Contact us for a broader access or deletion request. We will verify requests proportionately, respond within the legally required period, explain any lawful refusal, and will not discriminate against you for exercising a right.
Canada
You may request access and correction, withdraw consent subject to legal or contractual restrictions, and challenge our compliance. Depending on the activity and location, Alberta’s Personal Information Protection Act, Canada’s Personal Information Protection and Electronic Documents Act, or another provincial law may apply. You may complain to the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, or the applicable provincial regulator.
European Economic Area and United Kingdom
You may also request restriction, object to legitimate-interest processing or direct marketing, and complain to your local supervisory authority. Where processing is based on consent, withdrawal does not affect earlier lawful processing.
United States
Applicable state law may provide rights to know, access, correct, delete, and obtain a copy of personal information; opt out of sale, sharing, targeted advertising, or qualifying profiling; limit certain uses of sensitive information; and use an authorized agent. We do not currently sell or share personal information as those terms are commonly defined for cross-context behavioral advertising.
Age requirements
The Service is intended for adults and is not directed to anyone under 18. We do not knowingly create accounts for or collect personal information from children. If you believe a child provided information, contact us so we can investigate and delete it as appropriate.
Changes and questions
We may update this Policy as the Service, providers, or law changes. We will change the date above and provide additional notice—such as an in-app message or email—before a material change when required.
For a privacy request, use the Contact Us form and select Privacy or data request. You may also review the Terms of Service and mobile-app EULA. If we cannot resolve a concern, you may contact the privacy regulator where you live.
Questions or requests
Talk to a person.
Use our secure contact form and choose the account, privacy, rights-holder, or other topic that best fits your request. We may need to verify your identity or authority before acting on some requests.