Privacy Policy

Effective date: [EFFECTIVE DATE]

Wantasaur helps kids build a birthday or holiday wishlist inside a budget their grown-up sets. This policy explains what information Wantasaur uses, why we use it, and the choices you have. It covers the Wantasaur website, the web app, and our iPhone, iPad and Android apps (together, “Wantasaur”).

Wantasaur is run by Blue Aurora Ventures LLC (“we”, “us”, “our”). We wrote this for parents, so we kept it as plain as we can.

The short version

1. Who we are

Blue Aurora Ventures LLC is a [STATE] limited liability company. We make Wantasaur and are the only operator of Wantasaur. We are responsible for the personal information described in this policy (under UK and EU data protection law, we are the “controller”).

Address: [ADDRESS]
Phone: [PHONE NUMBER]
Privacy questions: privacy@wantasaur.com
Help with the app: support@wantasaur.com

2. Information we collect

If you use Wantasaur without an account

Wantasaur works fully without signing in. Your wishlist, budgets, settings and game progress are saved only on your device: in your browser’s storage on the web, or in the app’s storage on iPhone, iPad or Android. We don’t receive them.

A few features do talk to our servers even without an account, and only when they are used:

None of these include your list, your child’s nickname or anything else you saved. If you delete the app or clear your browser’s data for Wantasaur, the information on your device is gone. We can’t recover it for you.

If a parent creates an account

A parent account is optional. It lets you sync your family’s list between devices and subscribe to Wantasaur Plus. When you sign in, we collect:

If you subscribe to Wantasaur Plus

If you contact us

If you email us, we receive your email address and whatever you write. We use it to help you.

Basic technical information

Like any online service, when your device connects to our servers (for example, to load the website, sync your list, load a product photo or run a store search), our hosting and database providers process basic technical information such as your IP address, browser or device type, and the time of the request. This is used only to deliver Wantasaur, keep it secure and limit misuse (for example, daily search limits). We don’t use it to build profiles, to contact anyone or to track you across other websites or apps. Our own server functions log only IDs and event types, never names, email addresses, search words or card details.

Feedback and problem reports

If a grown-up uses Help and feedback (behind the parental gate), we receive what they write, the topic they choose, and an email address only if they give one for our reply. If they leave “Include technical details” ticked, we also get the app version, device type (web, iPhone or Android), screen size, language, plan (free or Plus) and whether the app was in kid or grown-up mode. We never attach the child’s list or data. If the grown-up is signed in, the report is linked to their account and family so we can look into it, it is included in Download my data, and it is deleted with the account. Reports sent without signing in aren’t linked to anyone; to have one deleted, email us the reference number the app showed you. We use reports only to answer and to fix and improve Wantasaur. Please don’t include your child’s full name, school or address.

What we don’t collect

3. How we use information

We use information only to run Wantasaur:

We don’t show ads. We don’t build profiles of children. We don’t use anyone’s information to train AI models. We don’t sell or rent personal information, and we don’t share it for targeted advertising.

4. Children’s privacy

Wantasaur is made for children to use with a parent or guardian. We follow the US Children’s Online Privacy Protection Act (COPPA) and the FTC’s COPPA Rule, and we designed Wantasaur with the UK Age Appropriate Design Code (the “Children’s Code”) in mind. This section is our notice of our practices for children’s information.

What children can do

In kid mode, children can browse a toy shop (sample items plus “family picks” a parent added), search for gift ideas, add and star wishes, write “Ask for anything” wish requests, send their list to a grown-up, and solve math, spelling and daily secret-word puzzles to earn extra budget.

The budget and earnings are just numbers inside the app. No real money is involved, and children can’t buy anything. Children are never shown offers or prices for Wantasaur Plus; when the day’s free games are used up, they are simply told to come back tomorrow. Kid mode has no ads, no chat, no public profiles, no way to contact other people, and no store links. Store links, subscriptions and account settings are only in the grown-up area, which is locked with a 4-digit passcode the grown-up chooses (the first time, a multiplication question gets the grown-up in to choose it).

What we collect about children, and how

Parental consent: how it works

Nothing about a child is stored on our servers until a parent creates an account and gives consent:

  1. The parent signs in with a one-time code sent to their email address, which shows the email belongs to them.
  2. Before anything is saved, the app shows the parent a notice of what we collect about their child, why, who handles it, how long we keep it, and their rights.
  3. The parent confirms that they are 18 or older and the child’s parent or legal guardian, agrees to our Terms of Service and this policy, and consents to us collecting and storing the child’s information to provide Wantasaur.
  4. We email the parent the same notice straight away, and a confirmation email about 24 hours later. Both explain how to take consent back. If the parent didn’t agree, or changes their mind, they can reply to either email or delete the account in the app, and we delete the child’s information.

This is the “email plus” method allowed by the COPPA Rule. We can use it because we use children’s information only inside Wantasaur and don’t disclose it to third parties.

We keep a record of each consent: the account ID, the policy version, how and when consent was given, and when the notice and confirmation were emailed. If the account is deleted, we keep the record for 3 years from the deletion, without the account ID or family ID, as proof that consent was given, and then delete it.

How we use and disclose children’s information

A parent’s rights

As a parent or guardian, you can at any time:

To protect your family, we may ask you to confirm a request from the email address on the account before we act on it.

If you believe we have information about a child without a parent’s consent, please email privacy@wantasaur.com and we will delete it.

A note for kids

Wantasaur keeps your wishlist so your grown-up can see it and help. Your grown-up can see your wishes and your game progress.

We don’t show you ads. We don’t ask for your real name, your address, your photo or where you are. Please don’t type your full name, address, school or phone number in your wishes or searches. If you do, Wantasaur will ask you to try again.

If you have a question about this, ask your grown-up.

5. Who we share information with

We don’t sell personal information. We share it only with service providers that help us run Wantasaur. Each has agreed in writing (in its data processing terms) to keep the information secure and to use it only to provide its services to us, not for its own purposes such as advertising.

ProviderWhat they do for usWhat they handle
SupabaseDatabase, sign-in and server functionsParent email address, family data (including the child’s information), consent records, feedback, search counts and basic technical information (hosted in the United States)
ResendSends sign-in codes, the parent notice and confirmation emailsParent email address and the email content
CloudflareHosts the website and web app, and forwards emails sent to our addressesBasic technical information such as IP address; emails you send us
[OUR MAILBOX PROVIDER]Our email inboxEmails you send us, and our replies
SerpApiShopping search, used only when a grown-up has turned on store gift search and our own catalog has too few resultsThe search words and country only, sent from our server (never your device’s IP address, or anything about your child or family)
StripeWeb card payments, receipts and renewal remindersParent email address, a family reference number, the creator code (if any), payment details you give Stripe, and subscription status. No child information.
Apple App Store and Google PlayIn-app subscriptions on iPhone, iPad and AndroidYour purchase, under your Apple or Google account; a creator campaign tag if you came from a creator’s link. No child information.
RevenueCatKeeps track of App Store and Google Play subscription statusA random store ID (not your family ID), purchase receipts, and the creator code and channel (if any). No names, email addresses or child information.

We may also share information:

In the grown-up area, you can search real stores such as Amazon, Walmart, Target and Argos. Children can’t reach these links. They are behind the parental gate.

7. Creator codes and links

Some parents hear about Wantasaur from creators, such as people who post about family life online. We give each creator a code and a link. If your family joins with one, the creator may earn a commission when your family pays for a qualifying plan. This doesn’t change the price you pay. Creator codes are optional. You can use Wantasaur without one.

What we record

What creators see

Creators see only totals, such as numbers of clicks, sign-ups and their commission amounts. They never see which families joined with their code, and we never tell them. We never share any child’s information, or any parent’s name or email address, with creators.

Creators must speak only to parents and other adults, never to children, and must clearly say when they earn a commission.

If you are a creator

We keep your name, email address, code and commission rate, your referral totals, your commission and payout records, and the tax and payment details you give us. You sign in to your creator dashboard with a one-time code we email you. We use this information to run the creator program, pay you and meet tax law. Your creator program terms explain the rest.

8. Cookies and device storage

9. How long we keep information

This is our written data retention policy. We keep information only as long as we need it for the purpose we collected it for, and our systems delete it automatically on the schedule below. We don’t keep children’s information indefinitely.

Children’s information (the nickname, game age, wishlist, wish requests, budgets and game progress) is collected only so the family can save, sync and use their list and games. We keep it only while a grown-up in the family still uses Wantasaur, and delete it as shown below.

InformationHow long
Data kept only on your deviceUntil you delete it (Delete everything on this device), delete the app, or clear your browser’s data. We never have it.
Parent account and family data (including the child’s information)While your account is in use. If a parent hasn’t used Wantasaur for 24 months, and the family had no paid time left in the last 30 days, we delete that parent’s account automatically.
Family data when no grown-ups are leftDeleted straight away when the last grown-up deletes their account, otherwise within 2 days.
Deleted accounts and family dataRemoved from our live database promptly, and from backups within 30 days, as our provider’s backups roll off.
Sign-ups that never set up a familyDeleted after 30 days (except creators’ dashboard logins).
Store gift search resultsUp to 2 days, filed under a hash of the search words (the words aren’t stored).
Daily search countsDeleted within 3 days.
Feedback and problem reports24 months. Reports from a signed-in grown-up are deleted sooner if they delete their account.
One-time sign-in codesWork only once and expire after a short time.
Family invite codesExpire after 2 days.
Records of attempts to use family codes and creator codes1 day (used to stop code guessing).
Parental consent recordsWhile the account exists, then 3 years after the account is deleted, without the account ID or family ID.
Parent notice emails waiting to be sentDeleted 30 days after sending (the consent record keeps the date sent).
Agreement to automatic renewal (web)While the family exists, then 3 years after it is deleted.
Billing event IDs (from Stripe and RevenueCat)13 months (used to stop duplicate or replayed payment messages).
Stripe and RevenueCat customer recordsDeleted when the family is deleted. Until both companies confirm, we keep only the customer ID in a short deletion queue.
Payment recordsWeb payment records are kept at Stripe as tax law requires (typically 7 years). Apple and Google keep their own purchase records under their own policies.
Creator link click counts25 months. The scrambled IP address (hash) is blanked after 2 days, and the daily key used to make it is deleted the next day.
Creator commission records7 years, as tax and accounting law requires. If a family is deleted, the link to that family is removed.
Creator accounts and payout detailsWhile the creator is in the program, then 7 years for tax and accounting records.
Support emailsUp to 24 months after your request is resolved.
Basic technical logsKept by our hosting and database providers for a limited time (generally days to weeks) for security and troubleshooting.

10. How we protect information

No system is perfectly secure. If a security incident affects your information, we will notify you and the authorities as the law requires.

11. Your choices and rights

For every family

We will never treat you differently, or charge you more, for using your privacy rights.

If you live in the UK (or the EEA)

Under UK data protection law (the UK GDPR), and the EU GDPR if you are in the EEA, you have the right to:

We will reply within one month. Our legal reasons (“lawful bases”) for using information are:

In line with the Children’s Code, Wantasaur is private by default: store search off, no geolocation, no profiling, no ads, no public sharing, no offers shown to children, and no prompts nudging children to share more.

If you are unhappy with how we handle your information, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or to your local data protection authority in the EEA.

If you live in California or another US state with a privacy law

In the last 12 months, we have collected these categories of personal information:

We get this information from you and your family, from your device, and from our payment and app store providers. We use it for the purposes in section 3, and disclose it for business purposes only to the service providers in section 5. We keep it as described in section 9.

We do not sell or “share” personal information (as California law defines those words), and we have not done so in the last 12 months. We do not sell or share the personal information of anyone under 16. We use sensitive information, such as your sign-in details, only to provide the service as the law allows.

Depending on where you live, you may have the right to know what personal information we have about you, to get a copy, to correct it, to delete it, and to opt out of its sale, sharing or use for targeted advertising (we don’t do these things). To make a request, email privacy@wantasaur.com or use the in-app options above. We will confirm your identity, usually by email. You can use an authorized agent if you give them signed permission. If we turn down your request, you can appeal by replying to our decision. If you are still unhappy, you can contact your state attorney general.

We don’t share personal information with anyone for their own direct marketing.

12. How to delete your data

If you have an account

Open Wantasaur, then go to Grown-ups → Privacy and your data → Delete my account. (You will answer the parental gate question to enter the grown-up area.) If you want a copy first, use Download my data on the same screen.

By email

Email privacy@wantasaur.com from the email address on your account with the subject “Delete my data”. We will confirm the request and delete your account and family data as described above.

If you don’t have an account

We don’t have your list. It is only on your device. To remove it, use Grown-ups → Privacy and your data → Delete everything on this device, delete the app, or clear this site’s data in your browser settings. To delete a feedback report you sent without signing in, email us the reference number the app showed you. If you bought Plus in the iPhone, iPad or Android app without signing in, RevenueCat keeps a record of that store purchase under a random ID; email us and we will delete it.

To remove your family’s data from one device

Sign out on that device. Signing out removes your family’s data from that device. Your account and your family’s list stay in your account.

To remove just part of your information

Edit or delete wishes, wish requests, budgets, the nickname or the town or city at any time in the app.

13. Where information is stored

We are based in the United States, and our database is hosted in the United States. Some of our service providers may process information in other countries. If you use Wantasaur from outside the US, your information will be transferred to and stored in the US.

When we transfer personal information from the UK or the EEA, we rely on recognized safeguards, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or the UK–US “data bridge” where a provider is certified under it.

14. Changes to this policy

If we change this policy, we will update the effective date at the top. If a change is important, we will tell account holders by email or in the app before it takes effect. If we ever want to collect, use or disclose children’s information in a materially different way, we will email parents a new notice and ask for their consent first, and we won’t apply the change to a family’s information until a parent agrees.

15. Contact us

Blue Aurora Ventures LLC
[ADDRESS]
Phone: [PHONE NUMBER]
Privacy: privacy@wantasaur.com
Support: support@wantasaur.com

See also our Terms of Service.

Back to top