Privacy | Wish

Who looks after your data?

Wish is operated by Cauld and Clark IT Solutions, Philippines. This notice covers the Wish website and game. For privacy questions, contact [email protected].

This is a draft notice, not a claim that every privacy process has been independently audited. The operator must review it against the live service before public launch.

What we collect and why

Your account: Your chosen username and a password hash are used to create your account, sign you in and protect access. Choose a username that does not identify a child.
Your game: Your cards, decks, match history and wish activity are stored so you can play, keep your collection and maintain fair play.
Your wishes: The prompts you enter and the resulting card content are processed to judge and create cards. Do not include personal, confidential or sensitive information.
Support requests: If you email us, we receive your email address, your message and any attachments you choose to send. We use these to help you and handle reports.
Connection information: Hosting and security services receive technical information such as your IP address and browser information when delivering the website and protecting it from abuse.

We process data to provide the game you request, protect the service, answer support requests and meet legal obligations. Where consent is required, we must obtain it. We do not sell personal information or use it for advertising.

AI judging and service providers

Wish prompts are sent to AI providers DeepSeek/OpenAI and TypeSafe Jev for judging. This can include the card details needed to interpret your wish. AI can produce mistakes or unexpected content. Do not use a wish as a place to share a real person’s information.

Cloudflare delivers this website. Game hosting and support providers may process information needed to run their services. Providers may process data outside the Philippines, subject to applicable safeguards and their own terms. We remain responsible for our obligations under Philippine privacy law.

Before public launch: the operator must confirm the active providers, hosting countries, contractual safeguards, and provider retention and model-training settings. This draft does not promise that providers never retain prompts or use them for training.

What other players may see

Your username and the cards you play can be visible to the people you play with. Don’t put real names, school names, contact details or private information into usernames, wishes or card content.

For children and their grown-ups

Players under 13 should play using a parent’s account, with that parent’s permission and supervision. If you are under 13, ask a grown-up before you play or send us information. Parent permission is not a substitute for any consent or verification the law requires.

Parents can contact us to ask about, correct or request deletion of a child’s information. If you believe a child has shared personal data without appropriate permission, email [email protected]. We will review the report and take appropriate action.

AI content is not guaranteed to be suitable for every child. Play together, keep wishes free of personal details, and report concerning content.

Cookies and the website

This marketing website has no advertising, analytics scripts or tracking cookies. It loads its images and styles from its own domain. The game may use sign-in storage necessary to keep you logged in; that is not advertising tracking.

Keeping and protecting information

Account and gameplay records are kept while needed to provide your account, maintain fair play, resolve disputes or meet legal obligations. Support messages are kept while needed to handle your request. Data that is no longer needed should be deleted or anonymised, subject to lawful exceptions and backup cycles.

The exact retention periods, backup deletion windows and provider retention settings need to be confirmed before public launch. We do not promise instant deletion from every backup. Passwords are stored as hashes, not as readable passwords. No online service can promise absolute security.

Your privacy rights

Under the Philippine Data Privacy Act of 2012, you have rights over your personal data, subject to the law’s conditions. These include being informed, accessing and correcting data, objecting to processing, requesting erasure or blocking, and data portability where applicable. You may also withdraw consent for processing that relies on it.

Contact us to exercise a right. We may need reasonable proof that the account is yours, but never send your password. You can raise a concern with the National Privacy Commission (NPC). Other applicable privacy laws may give you additional rights.

Delete an account or request your data

Email [email protected] with the subject “Wish account deletion” and your username. You do not need to sign in to the game to make a request. A parent may make a request for a child.

We will verify the request and explain what can be deleted, what may need to be retained and why. Deleting an account can remove access to its cards, match history and cosmetic items. You can also ask for a copy or correction of your data. See account help.

Changes to this notice

We will update the date on this page when the notice changes and provide appropriate notice of material changes. Questions are welcome at [email protected].