Privacy Policy

1. Who we are

WishDaily is operated by Goodmorrow Technologies Private Limited (CIN U62099KA2026PTC224790), whose registered office is at No.148, BBMP No.170/148, 5th Main Road, Sector-6, HSR Layout, Bangalore South, Bangalore 560102, Karnataka, India ("WishDaily", "we", "us"). We decide how and why your personal data is processed, so under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for it.

This policy covers the WishDaily app for Android and iOS ("App") and the website wishdaily.app, including its share-link pages. It explains what we collect, why, who we share it with, how long we keep it and how you can use your rights.

2. What we collect

2.1 Information you give us

• Phone number. Needed only if you sign in. We use it to send you a one-time code and to identify your account.
• Profile. The display name you choose, your language and category choices, and your notification settings.
• Favourites. The videos and images you save. They are stored on your device, and with your account if you are signed in.
• Your profile photo. If you add a photo to put on greeting cards, it stays on your device. It is uploaded only if you use it in the Photos tab (section 3).
• Photos tab. The photo of your face you choose or take, and the portraits made from it (section 3).
• Messages to us. What you write when you email support or privacy requests.

2.2 Information collected automatically

• A random app ID. The App creates a random identifier when you first open it. We use it for analytics and crash reports instead of your name or phone number.
• Usage events. For example which screens you open, which videos you view, save or share, and which Photos looks you try. If you are signed in, some of these events are stored with your account.
• Session recordings. Both apps record how you use them with PostHog, to find what is confusing or broken and improve the app: pictures of the app's screens as you use it, and where you tap, scroll and swipe. Recordings are linked to the random app ID. They leave out:
  • What you type, such as your phone number and one-time code. On Android, all text in the app, including what you type, is covered over in recordings. On iPhone, recording pauses while a screen where you type is open, such as signing in.
  • Your photo and your portraits. Recording pauses while the Photos tab is on screen (where you take or choose your photo and see your portraits), and while the camera is open. Everywhere else your profile photo appears, it is covered over in recordings.
• Device and app information. Device model, operating system, app version, language and similar technical details.
• Crash reports. Technical details of a crash or error, sent with the random app ID.
• Push notification token. If you allow notifications, a token that lets us send notifications to your device.
• Installs from a shared link (Android). The first time the App opens after an install from Google Play, it reads Google Play's install referrer. If the install came from a shared WishDaily link, the App sends us that link's share ID and the random app ID; we keep only the share ID and a one-way hash of the two, to count installs per share without storing the app ID.
• Purchase records. If you buy a subscription, pass or credits, the App Store or Google Play tells us, through RevenueCat, what you bought, when, and whether it is active. We never see your card, UPI or bank details.

2.3 What we do not collect

• Your location, contacts, microphone or call logs.
• Your device's advertising identifier (Android Advertising ID or Apple IDFA). The App does not track you across other companies' apps or websites for advertising.
• Payment card, UPI or bank details.

3. The Photos tab and your face photo

In the Photos tab you can make a stylised portrait of yourself in a chosen look. Because this uses a photo of your face, we ask for your consent before your first portrait. Here is exactly what happens.

1. On your phone. You take a selfie with the camera or choose a photo (your WishDaily profile photo or one from your gallery). The App checks on your device that there is a face in it (Google ML Kit on Android, Apple Vision on iPhone). That check runs offline and nothing from it is sent to us.
2. Upload. The photo is uploaded to a private storage area of our cloud provider, Supabase, in a folder that belongs to your account. It is not public.
3. Safety check. Before any portrait is made, an AI model that understands images looks at the photo once to check it is suitable for a family app (no nudity, violence or anyone who looks under 18), how many faces it shows, and whether the look's women's or men's outfit should be used. We store that outcome (for example "woman" or "man"), not the analysis itself. An unsuitable photo is refused and deleted straight away.
4. Making the portrait. We send your photo, as a private link that expires within minutes, and the look's instructions to OpenAI, which makes the portrait with its image model; we call it directly with our own OpenAI account, under its standard terms for business API customers. If OpenAI is unavailable, the request goes instead to Kie.ai, a US-based AI platform, which passes it to the company that developed the image model it runs (for example OpenAI or Google). Kie.ai says it deletes generated images after 14 days and its request logs after two months; its terms do not say whether submitted content is used to train or improve AI models, and they do not list the companies it passes requests to.
5. Quality check. We may use an AI model that understands images to compare a portrait with your photo and grade it, for example whether it still looks like you, and store the grade. This check is currently switched off; if we switch it on, it works as described here.
6. Which models run the checks. We test AI models regularly and use the one that does these checks best, so the model can change. Today it is Anthropic's Claude, which we call directly with our own Anthropic account; if it is unavailable, OpenAI's GPT, called directly with our own OpenAI account. Anthropic and OpenAI handle these requests under their standard terms for business API customers, which do not promise to keep no copy. If both are unavailable, the request goes through one of two AI platforms: OpenRouter, where we ask for endpoints that keep no copy of the request, or Kie.ai, which passes it to the company that developed the model (Google, OpenAI, Anthropic, xAI, DeepSeek or Moonshot AI). Kie.ai does not promise to keep no copy; what its terms say is in "Making the portrait" above. Whichever route is used, the model only checks the photo and the portrait for us.
7. Keeping your photo. We keep the latest photo you used, so you can make more portraits without uploading it again ("Use my last photo"). When you use a new photo, the previous one is deleted. Any other copy, for example from an upload that did not finish, is deleted automatically after 24 hours.
8. Storage. The finished portrait is saved in a private storage area in your account so you can see it again in My creations. Our staff may look at portraits (never your uploaded photo) to judge and improve quality.

What we do not do with your face photo:

• We do not create a face template, faceprint or any other biometric identifier, and we do not use your photo to recognise or identify you.
• We do not use your photos or portraits to train AI models, and we do not show them to other users. The sample pictures for each look are made with our own model faces, never a user's photo.
• We do not make your photo or portraits public. A portrait leaves your account only when you download or share it.

How long we keep them. We keep your latest photo until you use a new one, delete it with Forget my photo in Settings, or delete your account. We keep your portraits until you delete them in the app (in My creations) or delete your account. Forget my photo and deleting a portrait in the app are available from version 1.2.0 of the App; you can also email privacy@wishdaily.app with the phone number of your account to delete your photo or any portrait. If you delete your account, your photo is deleted straight away and your portraits 30 days later (see Delete your account).

Only use a photo of yourself. Do not upload a photo of anyone else, or of anyone under 18.

4. Why we use your data

We process your personal data on the basis of your consent, or where the DPDP Act allows it without consent (for example to comply with the law). We use it to:

• run the App: sign-in, your profile, favourites, the Videos feed and Photos portraits;
• sell and deliver paid features, and check what you are entitled to;
• send notifications you asked for;
• keep the service safe, prevent abuse and keep spending on AI providers within limits;
• understand how the App and website are used, fix bugs and improve features;
• answer your messages and requests, and meet legal, tax and accounting duties.

5. Who we share it with

We share personal data only with service providers that process it for us, and only what each one needs:

• Supabase: database, sign-in, file storage and server code. Privacy policy
• MSG91: sends the sign-in code to your phone number by SMS. Privacy policy
• OpenAI, called directly with our own account: makes Photos portraits and receives your face photo when you make one (section 3). Privacy policy
• Kie.ai: runs the AI models that make our greeting videos, and makes Photos portraits when OpenAI is unavailable, in which case it receives your face photo. Privacy policy
• The developers of the image models Kie.ai runs (for example OpenAI or Google), to which Kie.ai may pass a Photos request when it makes the portrait. OpenAI privacy policy
• Anthropic and OpenAI, called directly with our own accounts: the safety and quality checks on Photos described in section 3 (Anthropic first, OpenAI if it is unavailable), and writing and checking our greeting content. Anthropic privacy policy, OpenAI privacy policy
• OpenRouter and Kie.ai, and through them the developer of the AI model in use (currently Google; possibly OpenAI, Anthropic, xAI, DeepSeek or Moonshot AI), when Anthropic and OpenAI are unavailable: the same checks and greeting content. OpenRouter privacy policy, Google privacy policy
• RevenueCat: manages purchases and subscriptions made through the App Store and Google Play, using your WishDaily account ID. Privacy policy
• Apple and Google: process payments for purchases in the App (under their own privacy policies), and deliver push notifications (Google Firebase Cloud Messaging and Apple Push Notification service).
• PostHog: product analytics and session recordings for the App and the website. Privacy policy
• Meta (Meta Platforms): the Meta Pixel on the website (section 9). Privacy policy
• Sentry: crash and error reports. Privacy policy
• Cloudflare: hosts the website and share-link pages, and measures visits to the website (Cloudflare Web Analytics). Privacy policy

When you share a video or portrait to WhatsApp or another app, you send it yourself through that app, under its own terms. We do not get access to your contacts or messages.

We may also disclose data when the law requires it, to protect people's safety or our legal rights, or to a company that takes over WishDaily, which would have to keep to this policy. We do not sell your personal data.

6. Where your data is processed

Our database, file storage (including your Photos photo and portraits) and server code run on Supabase in Mumbai, India. Analytics and session recordings go to PostHog's US Cloud in the United States, crash reports to Sentry in the United States, and purchase records to RevenueCat in the United States.

OpenAI, which makes Photos portraits (section 3), is in the United States, as are Kie.ai (the fallback), Anthropic and OpenRouter. The AI models that check photos and portraits run on their developers' servers, which may be in the United States, the European Union, China or elsewhere.

We transfer data only to countries the Government of India has not restricted under the DPDP Act, and we protect it as this policy describes wherever it is processed.

7. How long we keep it

• Account, profile and favourites: until you delete your account, then 30 days more (the time you have to change your mind), after which they are deleted.
• Photos uploads and portraits: as described in section 3.
• Usage events stored with your account: when you delete your account, the link to your account is removed and the events are kept only as anonymous statistics.
• Analytics, session recordings and crash reports: kept by PostHog and Sentry under their retention settings and linked only to the random app ID, not to your account. You can ask us to delete them (section 8).
• Purchase records: kept as long as tax and accounting laws require, even after your account is deleted. The App Store and Google Play keep their own records.
• Messages to us: as long as needed to deal with them and any follow-up.

Data on your device (preferences, cached videos and your profile photo) stays until you clear the App's data or uninstall it.

8. Your rights

Under the DPDP Act you have the right to:

• Access: get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
• Correction: have inaccurate or incomplete data corrected, completed or updated. You can change your name and settings in the App yourself.
• Erasure: have your data deleted when it is no longer needed or when you withdraw consent, unless the law requires us to keep it. You can delete your account in the App (see Delete your account).
• Withdraw consent at any time, as easily as you gave it. Withdrawing does not affect processing already done. For the Photos tab, delete your saved photo (Forget my photo in Settings) and your portraits in the app, or ask us to; for everything else, delete your account or write to us. Some features cannot work without the data they need.
• Grievance redressal: complain to our Grievance Officer (section 13).
• Nomination: name another person to use these rights for you if you die or become unable to act.

To use any of these rights, write to privacy@wishdaily.app from any address, with the phone number of your account. We may ask you to confirm the request from that number so that no one else can get your data. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

9. The website and cookies

On wishdaily.app and its share-link pages:

• PostHog measures how the website is used, with a random identifier stored in your browser: page views, clicks and other interactions, where visitors click and scroll (heatmaps), how fast pages load, and recordings of visits to wishdaily.app (what the page shows and how you move through it). Anything typed into a form field is masked in recordings. The share-link pages report to PostHog when a shared video or image is opened and when their buttons are tapped; they are not recorded.
• The Meta Pixel, from Meta Platforms, lets us measure visits to wishdaily.app and the ads we run on Meta's apps (such as Facebook and Instagram). It sets a cookie on wishdaily.app and sends Meta a record of each page you view, with your IP address, browser details and any Meta cookies in your browser. Meta uses this data under its own privacy policy. The share-link pages do not load it.
• Cloudflare Web Analytics measures visits to wishdaily.app and how fast its pages load: the page address, the site you came from, your browser, device type and country. It does not use cookies.

Cloudflare, which hosts the site, also processes your IP address and browser details to serve and protect it. You can block or delete cookies and site data in your browser; the site works without them.

10. Children

WishDaily is a devotional app for the whole family, but if you are under 18 you may use it only with the consent of a parent or guardian, and purchases by anyone under 18 need a parent's or guardian's approval through the App Store or Google Play. The App is not directed at children, and we do not knowingly process the personal data of anyone under 18 without that consent. Our Photos safety check refuses photos of people who look under 18. If you believe a child has given us personal data, write to privacy@wishdaily.app and we will delete it.

11. Security

Data travels over encrypted connections (HTTPS). Photos uploads and portraits are kept in private storage that only our server code can open. The App gets short-lived links to show you your portraits, and providers get links that expire within minutes. Access to our systems is limited to the people who need it. No system is perfectly secure; if a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

12. Changes to this policy

We will update this page when our practices change and change the "Last updated" date above. If a change affects how we use data you have already given us, we will tell you in the App and ask for your consent again where the law requires it.

13. Grievance Officer and contact

Grievance Officer, Goodmorrow Technologies Private Limited
Email: privacy@wishdaily.app
Post: No.148, BBMP No.170/148, 5th Main Road, Sector-6, HSR Layout, Bangalore South, Bangalore 560102, Karnataka, India

Write to the Grievance Officer about any complaint on how we handle your personal data, with "Grievance" in the subject. We acknowledge every grievance within 24 hours and resolve it within 15 days of receiving it.

For help with the App itself, write to support@wishdaily.app.