Privacy Policy

1. What we collect

We only collect what we need to run Wish Generator and keep the site fast and safe. We do not track you silently and we do not sell your data.

Everything we see fits into three groups: the inputs you type, a bit of technical data, and account details if you sign up.

• What you type in the generator: occasion, tone, language, relationship and the context you give.
• Technical data like browser type, device info and simple usage logs for security and performance.
• Account details if you sign up: username, email and the preferences you save.

2. How we use it

We use this information to generate the text you asked for, keep the service reliable, fix problems when they show up and protect the site from abuse.

None of it feeds outside advertising. We do not sell your data and we do not share it with partners to build profiles on you.

3. AI processing & cookies

Two things happen behind the scenes on every request: the AI model runs on the server, and a small set of cookies runs in your browser.

AI processing

When you generate a message, your prompt is sent to our AI provider through the OpenAI API. The provider returns the result, we show it to you, and that is the full exchange. We do not train models on what you type. When a greeting is for someone you saved in People, we also send their name, who they are to you, their birthday (the day, the month and the age they turn) and your notes about them, so the text is about them. Nothing that came from your Facebook account is ever sent. When you ask the chat about your account, only the part that answers the question goes along - your credit balance or your reminders, for example - never your name, your email or anything from Facebook. When you speak instead of typing, the recording goes to OpenAI to be turned into text and is not kept.

Cookies

We use a small set of cookies to keep you signed in, remember simple preferences and see how the site is performing. You can manage or disable them from your browser settings at any time.

Service providers

Parts of the service are run by companies we hire, and each sees only what it needs: OpenAI writes the message text and runs our safety check on the words and photos of each paid request and on the finished picture or video; fal.ai runs the AI models that draw cards and videos and make songs and voices, and passes each request, with the photos you chose for it, to the maker of the model - Google, OpenAI, ByteDance, Kuaishou (Kling), MiniMax, ElevenLabs, Alibaba, xAI, Black Forest Labs, PixVerse, Lightricks, Tencent, Topaz Labs or Luma AI; our email provider delivers wishes and notifications, Twilio sends SMS, Telegram delivers messages you send there, our payment provider handles subscriptions, Google Analytics counts visits (without cookies until you accept them), and Smartlook records site sessions so we can see where the interface fails people. They act on our instructions and may not use your data for their own ends. We do not sell your data, and we do not give it to advertisers or data brokers.

Your own voice

If you make your own voice (paid plans), you read a short sentence aloud and your browser records it - we do not accept uploaded files. We check that the recording is the sentence we showed, then send it once to our voice provider (MiniMax, through fal.ai) to create a voice that only your account can use for your greetings. We delete the recording from our servers as soon as the voice is ready and keep only its ID and two readings made in that voice: a short sample so you can hear it, and a longer one that gives your greetings your voice. The provider keeps the voice under an ID that only we know; when you delete your voice we erase that ID and both readings at once, so it can no longer be used. We never use your voice for anything you did not ask for and never share it.

Invitations, reviews and Explore

When you open a friend's invitation link, a cookie (_dg_ref) keeps the invitation code for 30 days so the sign-up counts; if you confirm your email on another device, we keep the code with that email for one day. People who open your own invitation link see your first name. To stop fake invitations we keep a hashed marker of the network you last used - never the address itself. A review you send in our form reaches our team together with your account email. A photo card or video you share to Explore is shown publicly until you remove it, and its words and names never are. When you sign in with Google or Facebook, a cookie (dg_dev) remembers this browser for a year, so we can email you when someone signs in from a device we have not seen.

Photos of people and children

Upload photos only of people who agreed to it; for a child, the parent or guardian decides. Adding a photo confirms this, and so does every greeting that animates or redraws a real person - the line beside the button says so. We keep a record of each confirmation - when, and for which photo (a fingerprint of the file, not the photo itself) - for as long as your account exists and up to three years after, so we can show that consent was given if anyone asks. The photos are used only to make your greetings: they go to our safety check and to the AI services listed above that draw the card or the video, and nowhere else. When the safety check refuses a request, we keep only the date and the reason, never the words or the picture. The photos themselves are seen by no one but you; the greeting made from them is seen by the people you send it to. You can delete any photo in My uploads or People, and all of them go when you delete your account.

4. Signing in with Facebook or Google

You can create an account with an email and password, or sign in with Facebook or Google. Social sign-in is optional - the service works the same either way.

If you sign in with Facebook, we receive only what you approve on the Facebook permission screen, and we use each piece for one clearly defined purpose:

• Public profile (your name): to create your account and show who is signed in. We do not request or store your Facebook profile picture.
• Email address: to identify your account, send delivery confirmations for the wishes you send, and important notices about the service.
• Birthday: saved to your profile, and used on the day itself to send you a greeting written for the age you are turning. To write it we pass your first name and your age to our AI provider - not your date of birth. Your birthday is never used for the wishes you write to other people, and we never collect your friends' birthdays.

We do not post anything to Facebook on your behalf and we do not read your friends list. We never sell this data and never hand it to advertisers or data brokers; the service providers listed above handle it only to run the service, on our instructions. You can remove the birthday at any time on your Profile page, and you can disconnect the app in your Facebook settings.

5. Security & retention

We keep data only as long as we need it to run the service, meet legal obligations and prevent misuse. Account data lives until you delete your account; wishes and uploaded photos stay in your account until you delete them or close the account. When we no longer need data, we delete it.

Your wishes and photos belong to you. We never sell them, never share them with advertisers, and never train AI models on them.

Your information is protected with reasonable technical and organisational safeguards: encrypted connections, access controls and regular reviews of who can see what.

6. Deleting your data

You can delete everything yourself, at any time, without writing to us:

• Sign in and open Profile, then choose Delete account. This permanently removes your account, your saved wishes and photos, contacts, reminders and any birthday we stored - including data received from Facebook.
• To remove only the birthday, clear the Birthday field on the Profile page and save. If Facebook gave us a date without the year, the field stays empty by design - use the Remove button shown next to it.
• To cut the Facebook connection, open Settings and privacy - Settings - Apps and Websites in Facebook and remove Wish Generator.
• To delete only your own voice, open Whose voice - Your own and choose Delete my voice.

Prefer that we do it for you? Write to support and we will delete your data within 30 days. If you delete your Facebook account, any data we received through Facebook Login is deleted from our side as well.

7. Your rights & contact

Depending on where you live, you may have the right to request access to your data, correct it, delete it or limit how we use it. To exercise any of these rights, reach us through the contact form on the site and we will walk you through it.

Questions about this policy? Write to us through the support channel listed on the site. A real person reads every message.

Wish Generator is responsible for the data described in this policy, and [email protected] is the contact point for any privacy request. Billing data is handled separately by Paddle.com as merchant of record, under its own privacy policy - we never see your full card number.