Privacy

Voodoo Wish needs no account and has no passwords, no advertising, no analytics and no third-party trackers of any kind. In the phone app it asks for one thing: the wish you want to hang, which is public. There is nowhere to type an email address, and the app does not send email. You may, if you choose, sign in with Apple or with Google so that your own wishes follow you to your next phone; that is described below, and it changes nothing about what is public.

Your wish, the name you signed it with if you chose to sign it, and the moment it was lit. That is the entire product: a tree strangers can read. It is on a page anyone can find, it is in the sitemap, and search engines are welcome to it.

You are told this before you write. You can take your own wish down at any time from Yours in the app, and the light and its page go at once — but a thing that has been public cannot be made never to have been public, and search engines and anyone who saw it keep their own copies. Do not put anything in a wish that you would not put on a postcard — and do not put anything in it about someone else that they have not agreed to.

Your email address, if we have one at all. In the phone app there is nowhere to type one: the only address that can exist is what Apple or Google hands over when you sign in, and if you never sign in we have none. It is shown back to you inside the app so you know which account you used, and it is stored against your account and nothing else. It is never shown beside your wish, never sold, never given to anyone, and never used for marketing — there is no mailing list to be added to.

Nothing is sent to it. The app does not email you: not a receipt, not a reminder, not an anniversary. Apple and Google send the receipt for the payment, because they are the seller. If we ever start sending anything, this page says so before it happens.

In the phone app you can sign in with Apple or with Google. You never have to: a wish is the same wish whether or not you did, and nothing about the tree changes. Signing in does one thing — it keeps the right to your own wishes on our server as well as on your phone, so a new phone, a wiped phone or a deleted app does not take it with it, and so you can see your own wishes and say one came true from any phone you sign in on.

What we keep when you do: which provider you used, the provider’s opaque identifier for you (stored as a one-way hash), and your email address if the provider handed one over — Apple does so once and may give a private relay address instead, and Google gives the address on the account. The email is shown back to you inside the app so you know which account you used, and nothing is sent to it. Only the email scope is ever asked for: no name, no photo, no contacts, and nothing else from either account. Nothing about the account is ever shown beside a wish.

You can sign out at any time, and you can delete the account from inside the app (Yours → Delete account). Deleting it removes the account and its record of which wishes are yours; the wishes themselves stay in the tree, and the keys on your phone still open them — including the right to take any of them down.

You can block the person who wrote a wish, not merely hide the wish. For that to mean anything, wishes that came from the same hand have to be recognisable as such — and this app has no accounts, so there was nothing to recognise.

So the app makes up a random id for itself the first time it runs, and keeps it on your device. It is 26 random characters. It is not derived from your phone, your hardware, your network or anything about you, so it cannot be matched to you anywhere else; it is not an advertising identifier; and it goes to one server, ours, and to nobody else. We never store it as it is — what is stored beside a wish, and in your block list, is a salted one-way hash of it.

It does two things and nothing else: it marks which wishes came from the same device, so that blocking a writer blocks all of them, and it holds your own list of who you have blocked. It is not a login and proves nothing. Delete the app and it is gone — a fresh install is a new stranger with an empty list. If you sign in, your account id is used for the same two jobs instead, which is what carries your blocks to your next phone.

Blocking is private. The person you blocked is never told, nothing about their wishes changes for anybody else, and no count of anything is shown to anyone.

Card details never reach this server. In the phone app the payment is handled by Apple or by Google, who are the seller, and who tell us only that a purchase is genuine.

We keep one payment reference per wish so that a payment can be matched to the wish it bought and, if the wish is ever refused, refunded.

Wishes are checked automatically before they are shown. Anything the check is unsure about is held, and a person reads it before it hangs or is refused. That person sees the wish and the reason it stopped. Paying does not buy publication, and a refusal is always refunded — on the terms set out in the Terms.

Anything reported is read and acted on within 24 hours. When a wish is taken down for breaking the Terms, the device or account that wrote it is recorded as ejected — as the same salted hash described above — so that their other wishes come down and nothing they write afterwards is hung. That record is the hash and a date, and it is not linked to a name, an address or a person.

Your IP address is used in memory, briefly, to stop one machine flooding the tree with drafts. It is never written to the database and does not survive a restart.

Ordinary visitors are set no cookies at all.

Your own wish is yours to take down, at any time, with no reason and nobody to ask: Yours, in the app, and the light goes out for everyone at once.

If the wish is not yours — somebody else has written something about you — write to the address below. A person reads it, those requests are taken seriously, and they are always honoured where the law requires it.

Asking for your email address to be deleted is simpler and is always honoured — deleting your account from inside the app (Yours → Delete account) does it immediately. Deleting the app removes the id described above from your device.

When you write to us from inside the app, we keep what you typed, the moment you sent it, the word the app used to say which screen you wrote from, and the email address you gave if you gave one. Nothing else — not your IP, not the device id described above.

The address is optional and is used to answer that message and for nothing else. A message with no address is read exactly the same.

From inside the app: Yours → "Write to a person". From anywhere: fatihturker35@gmail.com. A person reads both.