WishKeep has no accounts and no sign-up, and your wishes are not kept on anybody's server. They live on your phone and, if you leave it switched on, in your own iCloud Drive. There are exactly four exceptions, and all of them are described below: a list you publish yourself, a list you build together with others, the tidying up of a newly added wish's name, and anonymous usage counts.
Titles, prices, links, notes, priorities, photos, folders and lists are written to the app's own storage on the device. Nothing about them is sent anywhere by itself.
A copy of the same data goes to your iCloud Drive so that a lost or replaced phone does not take the list with it. That copy sits in your Apple account, under your Apple ID, and the developer of this app can neither read it nor reach it. Switching iCloud off for WishKeep in the phone's settings stops it. A backup file you export goes wherever you send it, and from that point it is yours to look after.
Publishing happens only when you tap it, on one list at a time. What travels is that list: item titles, prices, links, notes, priorities, the list's name, the few words you wrote to your guests, and the photos unless you switched them off before publishing. It is stored on Cloudflare (a Worker and an R2 bucket) and served at an address that cannot be guessed.
The page is not protected by a password: anyone the link reaches can read it, on purpose or by being forwarded. It stops working ninety days after the last time you published it, and “Withdraw the link” deletes the list and its pictures right away. Cached copies at the edge of the network may answer for a few days longer.
A guest is never asked for a name, an email or an account. Marking a present as taken puts one random identifier in a cookie, and that identifier does one thing: it lets the page tell your own reservations from everybody else's. Nothing else is stored about a guest, and the owner of the list is never shown who took what — the owner can at most be shown that something was taken, and even that is a switch they choose.
A list is shared this way only when you tap it, one list at a time. From then on that list — item titles, prices, links, notes, priorities, what has been bought, the list's name and the photos — is stored on Cloudflare (a Worker, a Durable Object and an R2 bucket) so that every phone you invited can read and change it. Nothing else from your wishlist goes there: not your other lists, and not the other lists an item happens to be in.
There are no accounts here either. Access is the invitation link: it carries a random key that the server keeps only as a hash, and anyone who has the link can read and change the list — so send it only to your own people. “Stop building together” stops the updates on your phone; “Delete for everyone” deletes the shared copy and its photos from the server at once. A shared list nobody has opened for half a year is deleted on its own.
When you paste a link, the app opens that page from your device to read the title, the price and the picture. When an item has a name but no picture, the app asks a search engine (DuckDuckGo, and Bing after it) about that name. Those sites see a request from your device, exactly as they would if you had opened the page in a browser. Nothing from your wishlist is sent to them beyond the address or the words you gave.
Which search engine is asked, and how its answer is read, is not fixed inside the app: about once an hour it asks WishKeep's own server for those settings, so that a search engine rearranging its pages does not leave the feature broken until the next update reaches the App Store. That request carries nothing — not your list, not a word from it, not an identifier. The server sees what any visit to any website shows: an IP address and the time.
A shop calls its page something like “Nike Air Max 90 — buy online, free delivery | TheShop”. When you add a wish, the app can send two things to WishKeep's own server: the name the wish has at that moment — the shop page's title, or the words you typed — and the shop's bare address, without the rest of the link. The server passes them to OpenAI, which cuts the name back to the product itself and says which of the app's folders it belongs in.
Nothing else travels with them: not the price, not the note, not the photograph, not your lists, not an identifier of any kind, and never the wishlist itself. Neither our server nor OpenAI is told whose wish it is — there is no account for it to belong to. The request is marked as not to be stored, and data sent through OpenAI's API is not used to train their models.
The app asks before it does this for the first time, once, after a wish has been added — and until that question is answered nothing is sent at all. The answer is a switch afterwards, in the app's settings under “Names and folders”. Switched off, the name stays exactly as it arrived and the folder is worked out on the phone from a dictionary built into the app — which is where both came from before this existed, and where they come from anyway whenever the server has nothing to say.
Access to the photo library is used for one thing: putting a picture on a card. Reading the text on a screenshot and recognizing what is in a photo both happen on the device itself, through Apple's Vision framework, and no picture leaves the phone for it. A photo is uploaded only as part of a list you publish with pictures switched on.
The app counts what it does — items added and by which route, whether reading a page or searching for a picture worked and how long it took, purchases, deletions, how many results a search returned, settings changed, backups, publications — and sends those counts to TelemetryDeck, which reports them without identifying a device.
Nothing that identifies a wish is ever recorded: no titles, no links, no prices, no notes, not even a shop's hostname, and never the address of a published list. Only categories, outcomes, counts and durations. There is no advertising in the app, no advertising identifier is read, and nothing is sold or handed to anybody else.
Deleting the app removes the list and the pictures from the phone. The copy in iCloud is deleted from iCloud Drive, where it sits under your own account. A published list is taken down by “Withdraw the link” and disappears by itself once its ninety days are up. If you would like anything else removed, or want to know what is held about you, write — there is nothing here to look up in a database, and the answer will be the one on this page.