Privacy policy

1. Who we are

my boring wishlist is a small independent service at myboringwishlist.lazarev.fun. For privacy questions or requests, write to myboringwish.lazarev.fun@mail.ru.

We are the controller of the personal data described here. This policy explains what we store, why, and what you can ask us to do with it.

2. What we collect

• Account data: your display name, email address, a password hash, and the date the account was created. We never store your password in plain text. Passwords are hashed with scrypt.
• Wishlist content: the names, emoji, wishes, optional links, and notes you add.
• Reservations: which signed-in guest reserved which wish, and when. This is shown to other guests with the shared link but deliberately omitted from the owner's authenticated view.
• Shared list history: when you open someone's shared list while signed in, we remember that list on your dashboard so you can return to it. Only you see this history, and you can remove an entry at any time.
• Session data: a hashed session token, the account it belongs to, and its expiry time. The raw token lives only in your browser cookie.
• Security data: short-lived rate-limit counters in the server process and standard web-server logs containing IP address, time, path, and user agent. We use these to keep the service available and investigate abuse.
• Support email: whatever you choose to send us.

We do not use third-party analytics, advertising pixels, social login, or cross-site tracking. There are no marketing cookies.

3. Why we process it

• To create and operate your account and wishlists (performance of our agreement with you).
• To make shared links and reservations work, including showing other guests which gifts are taken (performance of the service).
• To protect the service from abuse, brute-force attacks, and spam (legitimate interests in security and availability).
• To answer support and privacy requests (legitimate interests and legal obligations).

We do not sell personal data, build advertising profiles, or use your wishlist content to train machine-learning models.

4. Cookies

We use two strictly necessary first-party cookies:

• bw_session — keeps you signed in. HttpOnly, SameSite=Lax, Secure in production, up to 30 days.
• bw_csrf — protects forms against cross-site request forgery. HttpOnly, SameSite=Lax, Secure in production, up to 30 days.

No cookie banner is shown because we do not use analytics or advertising cookies. Blocking these cookies will prevent sign-in and form submission.

5. Who can see what

Anyone with a wishlist's private share link can see the list's title, owner display name, wishes, notes, links, and — unless they are the signed-in owner — current reservation status, the reserving guest's display name, and their generated initials avatar.

The owner's authenticated pages do not receive reservation details from the server. A different visitor using the same browser while signed out is treated as a guest, because no account identity is available. We do not show email addresses or other account data to guests.

Do not put sensitive information in a wishlist that you would not want anyone holding the link to see.

6. Service providers

We use a hosting provider to run the server and store the database. If password-reset email is enabled, an email provider processes the recipient address and message contents for delivery. These providers act on our instructions and process data only to provide their service.

We may disclose data if required by applicable law, or if necessary to protect the rights, safety, or security of the service and its users.

7. Retention

Account and wishlist data is retained while your account exists. Expired sessions and used reset tokens are deleted; stale records are also cleaned when the service restarts. Server access logs are kept for a short operational period, normally no more than 14 days, unless needed to investigate an incident.

When you ask us to delete your account, we remove the account and cascading records — wishlists, wishes, reservations, sessions, and reset tokens — from the live database. Encrypted backups, if any, rotate out within 30 days.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to lodge a complaint with a data-protection authority. Write to myboringwish.lazarev.fun@mail.ru from the address on your account. We may need to verify that the account is yours.

9. Security

We use HTTPS in production, scrypt password hashing, server-side sessions, CSRF protection, strict security headers, input validation, and private random share tokens. No system is perfectly secure. Please use a unique password and contact us promptly if you suspect a problem.

10. Children

The service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.

11. Changes

If this policy changes materially, we will update the effective date and, where appropriate, notify account holders by email. Continuing to use the service after a change means you accept the updated policy.