Last updated: October 28, 2026
This policy explains what personal data WishJoy (“we”, “us”), operated by WishJoy, Uttar Pradesh, India, collects when you use wishjoy.in, why we collect it, and the choices and rights you have under India’s Digital Personal Data Protection Act, 2023 and other applicable laws. For the purposes of that Act, we are the Data Fiduciary for your personal data.
What we collect
- What you put in a surprise: names, messages, photos, captions, dates and any audio you upload.
- Account details if you create an account: email address, display name and a securely hashed password.
- A device cookie called ww_dk, which holds a random code so your browser keeps ownership of the surprises you make without an account.
- Technical data: your IP address is turned into a one-way code to limit abuse, such as too many uploads or login attempts. Our hosting provider keeps standard server logs for security.
- Things stored only on your device: unsaved drafts, edit keys and favourite templates stay in your browser’s local storage.
- Messages and reports you send through the contact form or the report button.
Cookies and similar technology
- ww_dk (essential): keeps your surprises linked to your browser. It does not track you on other websites.
- WordPress login cookies (essential, only if you sign in): keep you logged in.
- Analytics cookies such as _ga (only if analytics is switched on): help us understand which pages are useful. See “Analytics” below.
Analytics
We may use Google Tag Manager and Google Analytics to understand how visitors use our public pages, such as which templates are popular. These tools use cookies and process your IP address and device information. Shared surprise pages are not included in analytics unless we clearly say otherwise here. You can opt out of Google Analytics with Google’s browser add-on or by blocking cookies in your browser.
How we use your data
We use your data only to provide and improve the Service: to save and display your surprises, keep your account secure, prevent spam and abuse, respond to your messages and comply with the law. We process it on the basis of the consent you give when you use the Service, and for legitimate uses allowed by law, such as security and legal compliance.
We do not sell your personal data. We do not use your photos or messages for advertising or to train AI models.
Who can see your surprises
Private surprises are visible only to you. Public surprises are visible to anyone with the link. Code-protected surprises need the link and the code. Our administrators may access a surprise when needed to investigate a report, fix a problem or meet a legal obligation.
Who we share data with
- Our hosting provider, which stores the website and its data.
- Our email provider, which delivers contact form replies and account emails.
- Google, if analytics is switched on, as described above.
- Authorities, when the law requires it.
Data may be stored on servers in India or in other countries where our providers operate, with appropriate safeguards.
How we protect it
Uploaded photos are re-processed when you upload them, which removes hidden information such as GPS location. Surprise links are long random codes and we ask search engines not to index them. Passwords and secret codes are stored only as one-way hashes. The website uses HTTPS encryption.
How long we keep it
Surprises stay until you delete them. Photos uploaded but never saved into a surprise are deleted automatically within about two days. When you delete your account, we delete your surprises and uploads. Contact messages are kept for up to one year. Backups are overwritten in the normal course of operations.
Your rights
- See, change or delete your surprises at any time from My surprises.
- Delete your account and all its data from the Account page.
- Ask for a summary of the personal data we hold about you.
- Ask us to correct, complete, update or erase your personal data.
- Withdraw your consent at any time. This does not affect processing before you withdrew it.
- Nominate another person to exercise your rights if you die or become unable to do so.
- Raise a complaint with our Grievance Officer, and if you are not satisfied, with the Data Protection Board of India.
To use any of these rights, email hello@wishjoy.in.
Children
The Service is intended for people aged 18 and over. Younger people may use it only with the consent and involvement of a parent or guardian. We do not knowingly track children or show them targeted advertising.
Grievance officer
If you have a concern about how your data is handled, contact our Grievance Officer at hello@wishjoy.in. We acknowledge complaints within 24 hours and aim to respond within 15 days.
Changes to this policy
We will post any changes on this page and update the date at the top. If changes are significant, we will show a notice on the website.