Privacy Policy
CraftAWish.com ("CraftAWish", "we", "us", "our") lets people create personalized, interactive digital wishes and surprise experiences to share with someone else. This policy explains what information we collect when you use the site, why we collect it, and what choices you have.
1. Who this policy covers
This policy covers two kinds of people:
- Creators — people who register an account, build a wish, and (for paid plans) make a payment.
- Recipients — people a wish is created for, who may never register an account themselves but whose name, photos, or other details a creator has chosen to include in a wish.
If you are a recipient and have concerns about content a creator has published about you, see Section 7 ("Your choices and rights") — you can contact us directly even without an account.
2. Information we collect
Account information (creators only)
- Full name, username, email address, and mobile number, provided when you register.
- Your password — we never store this in readable form. It is transformed with a one-way cryptographic hash (bcrypt via PHP's
password_hash) before it touches our database, and that hash cannot be reversed back into your original password by us or anyone else.
Wish content
- Whatever you choose to include when building a wish: the recipient's name, your own name, a personal message or letter, photos you upload, and any other details the creator wizard asks for.
- Uploaded photos are stored on our servers so the published wish can display them; we do not use them for any purpose beyond rendering the wish you created.
Technical information
- Your IP address is used briefly to enforce rate limits that stop abuse (e.g. spammed publish attempts or login guessing). It is stored only as a one-way cryptographic hash, never in a form that can be turned back into the original address.
- Standard web server logs (timestamps, requested pages, browser/device type) generated automatically by our hosting provider as part of normal operation.
- A login session cookie, set only after you log in, used solely to keep you signed in. It is marked so it cannot be read by page scripts and is not sent to any other site.
Payment information
When paid plans are enabled, payments are processed by Razorpay, a third-party payment gateway. We do not collect or store your card, UPI, or bank details ourselves — Razorpay handles that directly, under its own privacy and security practices. We only receive confirmation that a payment succeeded, an amount, and a transaction reference.
3. How we use your information
- To create your account, let you log in, and remember your session.
- To build, store, and publish the wishes you create, and display them to whoever opens the link.
- To process payments for paid plans and keep a record of what was purchased.
- To detect and limit abuse — for example, rate-limiting repeated publish or login attempts from the same source.
- To respond if you contact us with a question, request, or report.
We do not use your personal information for advertising, and we do not sell it to anyone.
4. Who we share information with
- Razorpay — receives the minimum information needed to process a payment when you purchase a paid plan.
- Hostinger (our hosting provider) — stores our application's data and files on our behalf, as any hosting provider does.
- We do not share, rent, or sell your personal information to any other third party, and we do not share it for their own marketing purposes.
- We may disclose information if required to by law, or to protect the rights, safety, or property of CraftAWish, our users, or the public.
5. Published wishes are unlisted, not private
A published wish gets a hard-to-guess link (e.g. craftawish.com/w/xxxxxxx). It is not listed anywhere on the site or submitted to search engines, so in practice only people who receive the link from the creator can open it. This is not the same as encrypted or access-controlled — anyone who obtains the link, by any means, can view the wish. Do not include information in a wish that must remain strictly confidential.
6. How long we keep information
- Account information is kept for as long as your account exists.
- Published wishes are kept indefinitely by default, so the link keeps working — unless you ask us to remove one (Section 7).
- Rate-limiting records are short-lived and automatically age out.
7. Your choices and rights
You can ask us to:
- Give you a copy of the personal information we hold about you.
- Correct information that's inaccurate.
- Delete your account, or delete a specific published wish (including one made about you, if you're a recipient rather than the creator).
We don't yet have a self-service option for these in the app itself — email support@dharmdutt.com and we'll action your request directly. We may ask for reasonable verification before making changes, to make sure we're not acting on someone else's behalf without permission.
8. Cookies and browser storage
We use one cookie: a login session cookie, set only once you log in, and only used to keep you signed in. We also use your browser's local storage for things like remembering a draft wish while you're actively building it in the creator tool — that data stays on your own device and is not something we collect or transmit unless you explicitly publish it.
9. Security
We take reasonable technical measures to protect your information — passwords are hashed, not stored in plain text; the site is served over HTTPS; database queries are built to prevent common attacks like SQL injection. That said, no method of transmission or storage is 100% secure, and we can't guarantee absolute security.
10. Children's privacy
CraftAWish is not directed at children, and we do not knowingly collect account information from anyone under 18. If you believe a child has provided us with personal information, contact us and we'll remove it.
11. Changes to this policy
If we make material changes to this policy, we'll update the effective date at the top of this page. Continued use of CraftAWish after a change means you accept the updated policy.
12. Contact us
Questions about this policy, or a privacy request of any kind: support@dharmdutt.com