Privacy Policy

This Privacy Policy explains what information Wish & Witch (“we”, “us”) collects when you use our website at wishandwitch.com or the Wish & Witch iOS app (together, the “Service”), how we use it, and the choices you have.

Wish & Witch is a reflective wellbeing and journaling product. It is not a medical, psychological, or legal service.

1. Information we collect

Information you provide

• Quiz answers. Your responses to the onboarding and reading quizzes (goals, feelings, preferences, optional birth date).
• Email address. If you enter it to receive your reading or product updates.
• Palm photo (optional). If you choose to use the Palm Reading feature, an image of your hand is captured locally. We do not use it to identify you. See “Palm images” below.
• Journal and wish entries. Entries in the iOS app are stored locally on your device unless you enable a backup feature. In the Personal Year website, your answers are saved to your private account on our servers so you can return to them from another device.
• Personal Year details. Your name, birth date, optional birth time, birthplace, its coordinates and historical time zone, your chosen journal time zone, calculated chart and generated reading. For gifts, we also store the recipient email, sender name and optional gift message to deliver the invitation.
• Support messages. If you email us at hello@wishandwitch.com, we receive your address and the content of your message.

Information collected automatically

• Device and usage data. Approximate device type, operating system, app version, anonymized event counts (e.g. “quiz started”, “paywall viewed”), and crash diagnostics.
• Purchase data. If you subscribe, we receive a transaction identifier and subscription status from Apple (iOS) or Stripe (web). We do not receive your full payment card details.

Palm images

The Palm Reading experience is reflective, not biometric. Images captured for this feature are processed on your device to produce a visual “scan” animation. We do not run face or fingerprint recognition on them, we do not sell them, and we do not share them with third parties. Images are not uploaded to our servers by default. If a future feature requires upload, you will be asked explicitly and can opt out.

2. How we use your information

• To generate and deliver your personalized reading and 28-day path.
• To operate subscriptions, billing, and receipts.
• To send the emails you requested (reading, updates, reminders).
• To understand aggregate usage, fix bugs, and improve the product (analytics).
• To respond to your support requests.
• To comply with legal obligations and enforce our Terms.

If you are in the EEA or the UK, the lawful basis for each of those is as follows. Delivering your reading, the 28-day path, and running your subscription and billing are all necessary to perform the contract you entered into with us. Marketing emails, optional analytics, and the palm-reading feature rely on your consent, which you may withdraw at any time without affecting anything we did while it was given. Keeping the Service secure and working, and understanding aggregate usage, rest on our legitimate interests in running a product that functions — weighed against your interests, which is why the analytics are anonymous and switchable off inside the app. Responding to legal obligations rests on exactly that.

3. Service providers we use

We rely on a small number of vendors, each bound by their own privacy terms:

• Apple Inc. — iOS distribution and in-app subscription billing.
• Stripe, Inc. — website payments and subscription billing.
• Supabase Inc. — account authentication, private website readings, Personal Year journals and answers, and email lead storage when you opt in.
• Anthropic — writes and checks Personal Year content using calculated chart facts and journal chapter dates. We do not send it your name, email, raw birth date, birthplace or written journal answers for this feature.
• Resend — transactional email delivery.
• Vercel — hosting for our website.
• Cloudflare — DNS and domain.
• RevenueCat — managing and validating subscriptions on iOS.
• Meta Pixel and Microsoft Clarity — optional analytics on the website. Disabled if you opt out.

4. Advertising and tracking

We do not sell your personal information. On iOS we do not request tracking permission unless we later enable it; if we do, you will see Apple’s standard App Tracking Transparency prompt and can decline. On the website, pixel-based analytics only fire if the corresponding environment IDs are configured; you can block them with any standard tracker blocker.

5. Data retention

Personal Year pages do not load advertising pixels or session-replay tools. Your account email and password control access to your journals. A gift purchaser does not receive access to the recipient’s birth details or answers.

• Quiz answers and reading result: saved in the app on your device. Website quiz profiles, compatibility answers and paid website readings are also stored on our servers. Account deletion removes the personal records linked to the verified account.
• Email: kept while your account is active, or until you ask us to delete it.
• Subscription and billing records: retained where needed for tax, accounting, payment disputes and subscription administration. Minimal technical records are also retained to confirm deletion, prevent duplicate processing and suppress unwanted messages.

6. Your rights

Personal Year settings include entry downloads, password recovery, permanent deletion of an individual journal and deletion of your whole Wish & Witch account. Account deletion also removes birth details, saved answers and personal invitation records owned by that account. Gifts already purchased remain with their recipients, including the sender name and gift message. Minimal transaction records remain for the billing purposes described above.

Subject to your local law, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (“right to be forgotten”).
• Port your data to another service.
• Withdraw consent or object to certain processing.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@wishandwitch.com. Inside the iOS app, you can also use Profile → Account → Delete account, which removes that account’s local content and owned files. For a website account, it also removes the sign-in, server readings, quiz answers and personal profile records, and stops future web subscription renewals. Necessary billing records are retained. If the connection is interrupted, the app keeps the deletion request and can continue it when connectivity returns. Other accounts saved on the device are kept. Apple subscriptions must be cancelled separately in Apple subscription settings.

7. Children

Wish & Witch is not directed at children under 13 (or under 16 in the EEA and UK). We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will delete it.

8. International transfers

Our vendors operate from the United States and the European Union. When your data leaves your region, we rely on Standard Contractual Clauses and the providers’ own safeguards.

9. Security

We use TLS in transit, access controls, and secret management for keys. No online service can be perfectly secure, and we encourage you to use a strong, unique email password.

10. Changes to this policy

If we make a material change, we will update the “Last updated” date above and, where appropriate, notify you in-app or by email.

11. Who we are, and how to reach us

Wish & Witch is operated by GRAPPES LLC, which is the data controller for the personal data described in this policy. Card statements from us read WISHANDWITCH.COM; charges before 24 July 2026 read GRAPPES LLC. They are the same company.

For any privacy question, or to exercise any of the rights in section 6, email hello@wishandwitch.com. We answer from that address and nowhere else.