Privacy & cookies

Data controller

Data controller: [not yet entered in the admin panel]
Address: [not yet entered in the admin panel]
Email: [not yet entered in the admin panel]

What we process

• The celebration itself: the recipient's name, the sender's name, the message, chosen settings (such as colour, duration, fortune) and the language.
• The emoji the recipient picks to say thanks, and events such as the celebration being opened or watched.
• A one-way hash of your IP address to prevent abuse. We never store the raw IP address, and it can't be recovered from the hash.
• When you report a celebration: the reason you chose, your optional note and the time.
• Aggregate counts that contain no personal data (e.g. how many celebrations were opened today).

We never ask for an email address, phone number or location. Nothing is asked of the recipient.

Microphone and motion sensor

We use the microphone (to blow out the candles on a birthday) and the motion sensor (to shake the phone for a promotion) only if you allow it. Sound and motion are processed on your device only; they are never recorded or sent to our server. Every celebration can also be completed with a button.

How long we keep it

• Celebrations, reactions and reports are deleted permanently 7 days after the celebration is created. The sender can delete it earlier from the tracking page.
• Aggregate counts contain no personal data and may be kept indefinitely.
• Server logs (technical records with IP address and time) are kept for security for the hosting provider's standard period.

Purpose and legal basis

We process this information to create the celebration, show it to the recipient, tell the sender whether it was opened, and protect the service against abuse. Legal bases: necessity for providing the service (KVKK Art. 5/2-c), legitimate interest in keeping the service safe (Art. 5/2-f) and legal obligations (Art. 5/2-ç). We don't sell your information and we don't build advertising profiles ourselves. The ad network's cookies are described in the "Ads" section.

Cookies and browser storage

Cookies the site needs to work:

• ww_lang: your language (1 year).
• ww_country: your country, which decides which occasions are shown first (1 year).
• ww_ref: a signed code with no personal data that measures whether you came from a "Make one too" link in a celebration (7 days; deleted when you create your first celebration).
• ww_consent: your choice about ad cookies (6 months). Only set while ads are shown on the site and after you make a choice.

Your browser's own storage (never sent to our server) also keeps the list of celebrations you made, how many times you watched one, and your fortune draws. Clearing your browser data removes them.

The ad network's cookies are described in the next section.

Ads

No ads are shown on the site at the moment; the rules below apply once ads start.

Ads are shown on the site to keep Wishwiff free. They are served by Google (Google AdSense and Google Ad Manager). Google and its partners may use cookies and similar technologies to show and measure ads and to prevent abuse. If you allow it, these cookies can be used to show ads based on your interests (personalised ads), drawing on your visits to this and other websites.

• Visitors outside the European Economic Area, the UK and Switzerland (including Turkey) see the site's own consent banner on their first visit. No ads are requested until you choose. If you choose "Accept", personalised ads may be shown; if you choose "Reject", only non-personalised ads are shown. Non-personalised ads may still use cookies for frequency capping, aggregated measurement and fraud prevention.
• Visitors in the European Economic Area, the UK and Switzerland see a consent message from Google's certified consent management platform.
• The recipient's celebration page has no consent banner. Visitors from outside Europe who haven't made a choice are not shown ads there.
• You can change or withdraw your choice at any time with the "Cookie preferences" link at the bottom of the page.

The legal basis for ad cookies is your explicit consent (KVKK Art. 5/1). When you allow them, data such as cookie identifiers, IP address and browser information may be transferred to Google's servers outside Turkey (KVKK Art. 9).

How Google uses this data: https://policies.google.com/technologies/partner-sites
Turn off personalised ads in Google's Ad Settings: https://adssettings.google.com
Cookies from other ad companies: https://www.youronlinechoices.eu and https://optout.aboutads.info

Sharing

Your information is stored on the servers the service is hosted on and is never sold to third parties. Fonts are loaded from Google Fonts, which means your browser sends your IP address to Google. When ads are shown, Google processes data under its own privacy policy (see Ads). We may share information with authorities if the law requires it.

Your rights

Under KVKK Art. 11 you can ask whether your data is processed, request information about it and its purpose, learn who it was shared with, ask for it to be corrected or deleted, object, and claim compensation if you are harmed. If you are in the EU or the UK, you also have your rights under the GDPR. Write to us at [not yet entered in the admin panel]; we reply within 30 days. You may also complain to the Turkish Personal Data Protection Authority or your local supervisory authority.

If a celebration is about you and you want it removed (for example, your name was used without permission), use the "Report" button on the celebration page or write to us.