Privacy Policy

Who operates WishAway

WishAway is operated by Luca Sarbia trading as WishAway, established in the United Kingdom. For anything in this policy you can write to luca90sarbia@gmail.com.

We are the controller of the personal data described below — that means we decide why and how it is used.

What we collect

• Account data. Your name (if you give one) and email address when you create an account. If you sign in with Google, we receive your email, name and profile identifier from Google — never your Google password.
• Dream inputs and saved journeys. The destination, dates, travellers, trip types, budget and any notes you enter, plus the AI-generated journey we create from them.
• Technical and security data. Your IP address is used in a transformed (hashed) form to apply rate limits and prevent abuse of the dream generator. Standard server logs may record request times and errors.
• Preferences. Your chosen language and currency.
• Anonymous product analytics. Counts of a few product steps, tied only to a code that lives in your browser tab and disappears when you close it. No IP address, account identifier or trip details are stored with them.

We do not ask for payment details, passport data or health data, and we do not knowingly collect data from children under 16.

Cookies, localStorage and sessionStorage

WishAway uses no advertising, marketing or third-party tracking storage. We use only the following, classified as strictly necessary, preference, or our own anonymous session-only analytics (described in Product analytics):

None of this is advertising or marketing storage, and none of it identifies you across sites or across browsing sessions, so we show an informational notice rather than a consent banner. If we ever add advertising or cross-site tracking, we will block it until you actively agree and give you Accept all, Reject non-essential and Manage choices options.

Product analytics

We count a small number of anonymous product steps so we can see where WishAway is working and where it is confusing: a home page view, starting the create flow, choosing a destination, month, travel dates, trip styles and a budget, starting and finishing (or failing) a dream generation, saving, reopening or deleting a dream, creating an account or signing in, requesting or completing a password reset, viewing or completing your profile, viewing your wish list, and opening “Make it real” or one of its four categories.

These counts are first-party — stored in our own database, never sent to an analytics or advertising company. Each event records only the step name, whether the visitor was signed in, and a random code that lives in the browser tab and is destroyed when the tab closes. A few events carry a tiny, fixed set of non-identifying labels: the month name, trip-style labels, currency code, a broad budget band (never the exact amount), what the budget should cover, trip length, whether exact dates were used, how long a generation took, a general failure category, how many dreams are saved and how many travel personalities were chosen. We do not store your IP address, your account identifier, your email, your destination, your exact dates, your origin, your exact budget, dream titles or any free text, and we do not fingerprint your device. Because the code is session-scoped, we cannot link two visits to the same person. Raw events are deleted after 90 days.

Our lawful basis is our legitimate interest in understanding and improving the product, with the minimum data possible. Since these events contain no identifier tied to your account, they are not part of an account export or deletion — there is nothing in them to find, and they age out on their own.

Why we use your data, and our lawful bases

• To run your account and save your dreams — performance of our agreement with you (the Terms of Use).
• To generate travel ideas from your inputs — performance of that same agreement.
• To keep the service safe and available (rate limiting, abuse prevention, error logs) — our legitimate interest in protecting WishAway and its users.
• To remember your language and currency — our legitimate interest in giving you a working, consistent experience.
• To answer your messages — legitimate interest, or your consent where you volunteer extra information.

We do not sell your personal data and we do not use it for advertising profiling.

Authentication providers

You can sign in with an email and password or with Google. Authentication is handled by our hosting and database provider (Supabase, on infrastructure provided through Lovable). Passwords are stored by that provider in hashed form; we never see them. If you use Google sign-in, Google processes the sign-in under its own privacy policy.

AI processing

Your trip inputs are sent to third-party AI model providers through our AI gateway so a journey can be written for you. We send only what is needed to produce the result — typically destination, dates, duration, travellers, trip types, budget range, language and currency. We do not send your email address or account identifiers to the AI provider. Place, photo, map and weather information may be requested from mapping and weather providers using the destination, not your identity.

Hosting and processors

Data may be shared with the providers that make WishAway work:

• Supabase — database, authentication and storage.
• Lovable — application hosting and the AI gateway.
• AI model providers reached through that gateway.
• Mapping, place, image and weather providers used to illustrate journeys.
• Email delivery for account emails, sent from notify.wishaways.com.

We may also disclose data where we are legally required to, or to establish or defend legal claims. We do not share your data with advertisers.

International processing

Some of these providers operate outside your country, including in the United States. Where personal data is transferred outside the UK or European Economic Area, it is protected by appropriate safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

How long we keep data

• Account and saved dreams — kept until you delete them or delete your account.
• Dreams created without an account — kept so the private link keeps working; they contain no name or email.
• Rate-limit records — short-lived counters keyed to a hashed identifier; they contain no name, email or trip content.
• Server and provider logs — kept for a limited period by our providers for security and reliability.

Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to certain processing, and withdraw consent where processing is based on consent. You also have the right to complain to your local data protection authority.

You can act on most of these yourself: sign in and open your account page to download a JSON export of your account email and saved dreams, or to permanently delete your account and its dreams. For anything else — correction, restriction, objection or a question — email luca90sarbia@gmail.com. We aim to respond within one month.

Security

Access to saved dreams is restricted to their owner by database-level rules. Privileged operations such as account deletion run only on our server; no privileged keys are ever sent to your browser. No service can be perfectly secure, but we work to protect your data and to fix issues quickly.

Changes to this policy

If we make meaningful changes we will update this page and the date at the top. Please check back from time to time.

Contact

Luca Sarbia trading as WishAway — luca90sarbia@gmail.com