Privacy

Anything you post on Wishcode is public and can be indexed by search engines:

• Wishes (shown as “anonymous wisher”), their me-too counts, and the share images made from them.
• For developers: your GitHub handle and avatar, the wishes you claim, and the links, descriptions and source links you post.

Who posted a wish, who gave it a me-too and how anyone voted are never shown.

• A device cookie. The first time you post, me-too, vote or report, your browser gets a random code in a cookie (wc_device, kept for 2 years). I store only a one-way hash of it. It links your wishes, me-toos, votes, reports and email sign-ups to your browser, so you can take a me-too back and so the daily limits work. It is not linked to your name.
• Your IP address, hashed. To stop abuse from one network, I count actions per network using a salted hash of your IP address. These counters expire within a day. I do not store raw IP addresses, though my hosting providers keep their own short-lived logs.
• Your email address, if you give it. If you ask to hear when someone builds a wish, I store your address with that wish and use it only for those emails. Every email has an unsubscribe link. If you choose “stop all emails”, I keep your address on a do-not-email list so I never email it again.
• Reports. When you report a wish or link, I store the reason with your device hash.
• For developers who connect GitHub: your GitHub user ID, handle, avatar and the email address on your GitHub account. I use the email only to tell you when someone confirms your link works, and you can turn that off from the email. I do not ask for access to your repositories. A session cookie (named sb-…) keeps you signed in.
• Your unsent draft. The wish you are typing is saved in your browser's local storage so it survives a reload. It never leaves your device until you post it.
• Usage analytics. PostHog records page views, how fast pages load and actions such as posting a wish or tapping share, along with standard request details (browser, device type, approximate location from your IP). It sets no cookies, stores nothing in your browser and records no sessions. To count visitors, it uses a one-way hash of your IP address and browser that changes every day.
• Error reports. When something breaks, Sentry receives the error, the page it happened on, your browser and device type, and your IP address. It sets no cookies and records no sessions.
• The CodeHype badge. The footer and the About page show a badge loaded from CodeHype, so your browser sends CodeHype your IP address, browser details and the page you are on when it loads the badge.

I do not use advertising cookies, sell your data, or share it with advertisers.

• To run the service: show wishes and links, count me-toos and votes, and send the emails you asked for.
• To keep it safe: rate limits, bot checks, reports and removing content that breaks the rules.
• To improve it, using aggregate analytics.

If you are in the EU or UK, my legal bases are your consent (emails, which you can withdraw at any time), performance of our agreement (developer accounts), and my legitimate interest in running a safe, working service (everything else).

Only the services that run Wishcode, each for its own part:

• Vercel hosts the website.
• Supabase stores the database and handles GitHub sign-in.
• GitHub, when you choose to sign in with it.
• Cloudflare Turnstile checks that whoever posts a wish is not a bot, using signals from your browser.
• Google (Gmail) delivers the emails.
• PostHog provides the analytics.
• Sentry receives error reports.
• CodeHype serves the badge in the footer and on the About page.

These providers may process data in the United States and other countries. I will also share data if the law requires it.

• Wishes, links and claims stay until they are removed. Removed wishes stop showing their text.
• Email sign-ups last until you unsubscribe; the do-not-email list is kept so the request sticks.
• Rate-limit counters expire within a day.
• Developer profiles last until you ask me to delete them.

You can ask me to access, correct or delete your data, or to stop using it. Email deploylab.ai@gmail.com and I will reply within 30 days. Wishes are not linked to an account, so send me the wish's link if you want one removed. You can unsubscribe from any email with one click. If you are in the EU or UK you can also object to or restrict processing, ask for a portable copy, and complain to your data protection authority.

Under India's Digital Personal Data Protection Act, Raghav Gupta handles grievances at deploylab.ai@gmail.com.

Wishcode is for people aged 18 or over. If you think a child has given me their data, email me and I will delete it.

If I change this policy, I will update the date at the top, and for big changes I will put a notice on the site. See also the terms of use.