Privacy policy

Wishweaver is run by Your Social Gathering LLC ("Wishweaver," "we," "us"). Wishweaver Watch checks public Walt Disney World availability and alerts you when an opening appears. Stella, our optional planner, builds itineraries from a conversation with you. This policy explains what personal information each one collects, why we collect it, and how we use it. Plain English, no dark patterns.

What we collect

Details you tell Stella during chat. Family composition, ages, heights, interests, budget, hotel preferences, dietary needs, and any concerns you share while planning. This is the data Stella uses to build your itinerary. We store it so you can come back and refine your plan.

Your email address. Collected when you sign in to Wishweaver Watch, so we can send alerts and a link to manage your watches, and at Stella checkout, so we can send your itinerary, booking reminders, and updates.

Payment information. Handled entirely by Stripe. We never see or store your credit card number. We receive a payment confirmation and a Stripe session ID.

Basic usage data. Which pages you visited, how you moved through the flow, and what buttons you clicked. Collected via PostHog (analytics) and Sentry (error monitoring). We use this to understand what works, what breaks, and how to improve.

Advertising measurement. When we run ads on Facebook or Instagram, the Meta pixel on this site tells Meta that a page was viewed, and when someone creates a free account or buys a pass we tell Meta that it happened, with the email address hashed so Meta sees only a scrambled form of it. This is how we learn which ads work. Meta may link it to your Meta account under its own privacy policy. You can opt out of ad measurement with Meta directly, or block the pixel with any ad blocker; the site works the same either way.

Technical data. IP address (for rate limiting to prevent abuse), browser type, timestamp of visits. Standard stuff, kept for a reasonable window then discarded.

What we don't collect

Social security numbers. Government IDs. Medical records. Passwords of any kind: Wishweaver accounts sign in by email link, and we never ask for or store your Disney password. Your credit card number (that's Stripe's domain, not ours). Contact lists from your phone. Location data beyond IP-based geolocation.

Wishweaver Watch accounts

What Watch stores. Your email address; your watches, meaning the rule you set (restaurants, experiences, resorts or parks, dates, party size, time windows, notes); push subscriptions, if you turn browser notifications on; your alert history; and the time zone your browser reported at sign-in, used for quiet hours. Sessions are a signed cookie tied to a server-side record you end by signing out. We never receive or store your Disney credentials: no Disney password, no Disney session, nothing from your Disney account.

How watches work. A watch tells our systems what public Disney availability to check. We check from our own infrastructure and never from your Disney account; alerts link you to Disney's site, where you book as yourself. With Book It on, we book for you as a Family & Friends connection. Watches expire after their last date and you can delete them at any time, which also deletes their alert history.

Passes. A Trip Pass or Agent plan is a one-time purchase processed by Stripe. We store the pass tier, its start and end dates and the Stripe session id, never your card.

Text message alerts. If you confirm a mobile number, we store it and when you confirmed it; if you also tick the separate text-alert consent box, we store a record of that consent (the wording you agreed to, the time, and the address of the device you used). A request made on wishweaver.ai/sms before you sign in is kept for seven days so you can finish it on your dashboard. We send texts only for the alerts you asked for: openings found by watches you created, plus the verification code and replies to STOP or HELP. Message frequency depends on your watches. Msg & data rates may apply. Reply STOP at any time to stop all texts, or turn text alerts off on your dashboard; HELP gets you our contact details. Texts are sent through Twilio, our messaging provider, which processes your number to deliver them. The full program description is at wishweaver.ai/sms. We do not share your mobile number or text opt-in with third parties or affiliates for their marketing or promotional purposes; that information is used only to send you the alerts you asked for.

Book It. If you set up Book It, we also store the email address on your My Disney Experience account (so we can send you a Family & Friends invitation from our Disney account), the names and ages of the people in your party (so we can book them as named guests), and a Stripe card token with the card's brand and last four digits (so we can charge the fee once a reservation is confirmed). We also keep a record of each booking we made for you: what, when, the Disney confirmation number and what we charged. We never see or store your Disney password or your Disney payment card; the reservation is made from Wishweaver's own Disney account. We use your Family & Friends connection only to make the reservations you asked for, and we remove ourselves from your list when they are done.

How we use your data

To build your itinerary. To send you reminder emails at the 90, 60, 30, and 7-day marks before your trip. To respond when you email us. To improve the service (aggregate patterns, not individual customer inspection). To detect and block abuse.

We do not sell your data. We do not share it with advertisers. We do not use it to train external AI models. Anthropic (the AI provider behind Stella) processes your chat messages to generate responses, but per our agreement with them, your data is not used to train their models.

Who else touches your data

Our service providers, each handling a narrow slice: Stripe (payments), Anthropic (AI generation), Resend (email delivery), Vercel (hosting), Upstash (temporary session storage), PostHog (analytics), Sentry (error monitoring), Meta (advertising measurement, only while ads run), Notion (internal customer record keeping). Each is governed by their own privacy policy and processes data on our behalf under a data processing agreement.

What we store in your browser

While you're chatting with Stella, we save a copy of that conversation in your own browser's local storage. This is so a refresh, a closed tab, a dead battery, or a hiccup on our end doesn't make you retype everything. When you come back, we offer to pick up where you left off.

Because it's a copy of your conversation, it can include whatever you've told Stella, including your children's names, ages, and heights. So, plainly:

It stays on your device. This particular copy is never transmitted to us or to anyone else. (The conversation itself is separately sent to our servers to actually generate your plan, which is described above. This is just a local backup of it.) It is deleted automatically once you complete a purchase, since your plan then lives against your plan link instead, and any copy older than 7 days is discarded. You can remove it yourself at any time by choosing "Start fresh" when we offer to resume, or by clearing your browser's site data. If you use private or incognito browsing, or block site data, nothing is saved and the chat simply works as it always has.

We do not use this, or any other browser storage, for advertising, cross-site tracking, or building a profile of you.

How long we keep your data

Your itinerary and refinement chat: for the duration of your refinement window plus a reasonable buffer, then deleted. Emails and customer records: retained for financial and support recordkeeping (typically up to 7 years for tax purposes). Analytics data: aggregated and retained indefinitely; individual event data purged after 12 months.

Your rights

You can request a copy of the data we hold about you. You can request that we delete it (subject to legal retention requirements for tax records). You can request that we correct anything inaccurate. Email hello@wishweaver.ai to make any of these requests. We respond within 30 days.

If you're a California resident, you have additional rights under the CCPA. If you're in the EU or UK, you have rights under GDPR. Same email, same process. Tell us what you need and we'll handle it.

Children

Wishweaver is for adults planning family trips. We do not knowingly collect data directly from children under 13. When you share your kids' details with Stella, you're doing so as their parent or guardian on their behalf, and that data is treated with the same care as your own.

Changes to this policy

If we change how we handle your data, we'll update this page and, for material changes, email active customers. The "last updated" date at the top always reflects the current version.

Contact

Questions, requests, or concerns: hello@wishweaver.ai.