WishRise
Settings

Privacy & Legal

Your privacy matters. WishRise lets you send a personal moment without an account. Here is what stays private, what is stored and who operates WishRise.

Updated 6 October 2026

Your cards and wishes

An optional Spotify link, title and artist are stored with your card. When you request song details, our server contacts Spotify. Cover images load from Spotify when the card is shown; this shares your IP address with Spotify. Playback takes place only on Spotify.

Creating or receiving a card does not require an account. Its private link works for 720 days. You can revoke it in My cards in the original browser, while its management cookie is valid.

Anyone with the link can open the card, unless you add an optional six-digit PIN. Share links and PINs only with people you trust. The PIN is stored as a protected verification value; an essential cookie keeps an unlocked card open for one hour.

Your message and card link stay private. The recipient cannot see your payment amount or private saved content.

Photos and group cards

Free cards can include one image; Premium supports up to six. Group cards combine 2 to 30 messages through private invitations. The organiser can read contributions and finish the card. Recipients see them in the completed card. These contents stay private.

Payments

Cards without Premium extras are free, with no limit. Premium is paid once through PayPal; there are no subscriptions. PayPal loads when checkout starts and handles payment details. WishRise stores order and transaction references, status, amount, currency and timestamps.

For payment problems or refund requests, contact us with your transaction reference.

Sharing and scheduled email

You decide who receives the private link: through WhatsApp, an email draft, copying the link, a QR code or your device’s sharing menu where supported. These choices open the service or app you select. An email draft is sent by your email application, not automatically by WishRise.

For Premium, you can schedule one email recipient up to 30 days ahead, before the card expires. WishRise sends this email through Resend only when you request it. Resend receives the recipient address, sender name, private card link and sending time, but not your card message, photo, PIN, private wish or payment amount. Enter an address you are authorised to use.

My cards and browser storage

My cards uses the essential stillwell_session cookie, valid for 30 days, to associate your browser with cards, purchases, wishes and group drafts stored on our server. It contains a random key, not card content. Clearing it or letting it expire removes your management access; a shared card link can still work until its own expiry.

Local storage remembers language, currency, theme, display name and country until you change or clear them. A card draft stores recipient, message, sender, occasion, selected options and creation references for up to seven days after the last edit; expired drafts are removed when next read. Drafts do not include private wishes or payment details.

Downloads and music

Premium keepsakes support PNG, JPG, PDF and MP4 on compatible browsers. Files are generated in your browser and can be saved or shared independently of WishRise. Premium’s optional instrumental music is hosted by WishRise; playback starts only when you turn it on. Music can also be included in MP4.

Your feedback

Reviews are optional and available through genuine cards, not demos. A rating and short note stay private unless you expressly allow public use and WishRise approves publication. This verifies access to a card, not a person’s identity. Contact us to request removal of published feedback.

Hosting and technical data

WishRise is hosted with OpenAI Sites on Cloudflare infrastructure, using a database and photo storage. To serve requests, the infrastructure receives IP addresses, requested URLs and browser information. Operational logs can contain request times and technical errors. Our application logs error types, not card messages. Infrastructure processing follows the providers’ policies linked below.

Optional statistics

With your consent, WishRise uses Google Analytics 4 to measure visits, card creation, checkout, sharing, opening and the journey to a new card. Google receives browser and device information and processes your IP address. Processing in the United States is possible. Google states that Analytics does not log or store individual IP addresses from EU, Swiss or UK users.

The integration sends fixed event names and generic page paths, never personal names, messages, wishes, amounts, PINs or private card links. Google advertising signals and ad personalisation are disabled. Analytics cookies (_ga and _ga_…) are configured to expire after 180 days without renewal. Your consent choice also lasts 180 days. Google’s measurement-data retention depends on its Analytics property settings; WishRise’s code does not specify that period.

With consent, WishRise also stores daily totals for home and ideas visits and card actions in its own admin statistics, without visitor identifiers, private links or content. Known campaign labels and journey timestamps stay in this tab for at most 24 hours, or until the tab closes. Without consent these optional measurements do not run. You can decline or withdraw consent in Statistics settings below; withdrawing stops future measurement and removes accessible Analytics cookies.

Retention

Card links expire after 720 days; group drafts after 30 days. Photos are stored for up to 720 days from upload, extended to the card’s expiry when linked to a completed card. Scheduled recipient addresses are encrypted in WishRise until the card expires. Unapproved reviews expire after 90 days. Expired server records are removed during subsequent requests, photos in batches. Revocation blocks the card immediately but does not immediately delete every associated record or downloaded file.

Order and card creation records, approved reviews and aggregate statistics currently have no automatic deletion deadline in WishRise. They support payment enquiries, service operation, published feedback and reporting. Contact us to request access, correction or deletion. Provider-side logs and measurement data follow the respective service’s policies and settings.

Third-party services

Our active providers are OpenAI Sites and Cloudflare for hosting, PayPal for payments, Google Analytics for consented statistics, and Resend for requested scheduled emails. WhatsApp and your email application receive information when you choose them for sharing. Their privacy policies also apply; data may be processed outside your country.

Your choices

You choose whether to create a card, add a photo or wish, enable music or a PIN, join a group, share, schedule or download. You can revoke a card in My cards and delete saved wishes. For privacy requests or withdrawal of public-review permission, use the contact below. Please never send us your PIN or payment credentials.