OpenWish Privacy Notice

1. Scope

This notice explains how OpenWish collects, uses, shares, retains, and protects personal data when people visit the website, create an account, publish or help with a wish, communicate, upload files, receive notifications, or contact us.

OpenWish is an adults-only connection platform. It does not process cash, card, or bank payments, and does not offer shipping, escrow, or guarantees. Members may optionally connect an NHBCoin (NHB) wallet to send or receive direct support for a wish; those transfers settle directly on NHBChain, between members' own wallets — OpenWish does not hold or move the funds itself.

2. Data we collect

Depending on how you use OpenWish, we collect:

• •Account data: email address, authentication-provider identifiers, the provider-supplied name (kept private) and profile photo (used as your public avatar until you change it), generated public alias, alias history, age/eligibility confirmation, and account settings.
• •Profile data: bio, country, generalised city, public visibility choice, and verification status.
• •Wish data: original submission, approved AI-formatted version, category, urgency, sensitivity, status, generalised location, media, revision history, views, offers, and fulfilment records.
• •Communications: messages, replies, typing/delivery/read events, attachments, consented contact-detail sharing, blocks, mutes, and reports.
• •Verification/supporting data: verification-provider results and privately uploaded supporting documents. Public badges show limited status only.
• •Technical data: IP address, device/browser information, timestamps, cookies or similar identifiers, logs, security events, crash data, and approximate location inferred from network information where used.
• •Campaign attribution data: referring domain, visited path, referral code, campaign source, medium, name, term, and content. When an advertising platform supplies a click identifier, OpenWish stores a one-way hash rather than the full identifier. Campaign records use a rotating one-way visitor hash and do not retain the raw IP address in that record.
• •Notification data: email and push subscription information, delivery status, and preferences.
• •Moderation data: automated classifications, risk signals, detected policy categories, model inputs/outputs, decisions, appeals, and enforcement history.
• •Support data: correspondence and information supplied when seeking help from OpenWish.
• •NHBCoin connection data: whether an NHBCoin wallet is connected, the connected wallet's public address, the scopes you approved, and a record of contributions sent or received through a wish. OpenWish never receives your NHBCoin PIN or private key.

Do not put precise addresses, financial credentials, government identifiers, or private medical records in public wishes.

3. Public information

Published wishes, chosen display name, avatar, general location, category, status, verification badges, and selected profile information are public. They may be indexed by search engines, included in sitemaps and social previews, copied by visitors, or remain in third-party caches after deletion.

OpenWish also uses public content (“Public Content” in the Terms) itself, under Section 4 of the Terms. We may feature it on our website, in emails, and on social media, turn it into images and posts, and earn revenue from it, for example through advertising, sponsorship, partnerships, and by licensing public content to partners. This applies to the content and to the alias, first name, or profile details you chose to show. We do not use health-support wishes, wishes our systems rate as highly sensitive, or anything that appears to identify a child, in advertising, sponsorship, partner materials, or licences to others. It does not apply to your email address, private messages, supporting documents, sign-in provider details (other than a profile photo you use as your avatar), or other private information. A wish published as “Anonymous” is never presented with your alias or identity; comments you write are shown with your alias. For content posted before October 3, 2026, these uses begin 30 days after we notify you (Terms Section 4.6).

New accounts receive a generated public alias. If you sign in with Google or another provider, the profile photo from that provider is used as your public avatar until you change it; provider names and email-derived names are not made public automatically. The alias is the default identity on wishes and in chat. Users can change their alias/avatar or deliberately select First Name or Public Profile. Choosing “Anonymous” prevents public display of the alias or identity on that wish. OpenWish still knows the account connected to the content and may disclose it as described in this notice.

4. Why we use data

We use personal data to:

• •create accounts, authenticate users, and maintain sessions;
• •generate and validate privacy-preserving public aliases and avatars, prevent collisions and impersonation, and retain limited alias history for safety;
• •format, publish, discover, edit, and manage wishes;
• •provide private chat, attachments, notifications, fulfilment tracking, and consent-based sharing;
• •personalise and rank discovery results;
• •moderate content, detect scams and prohibited payment requests, investigate reports, prevent abuse, and protect users;
• •let you optionally connect an NHBCoin wallet and send or receive direct contributions for a wish;
• •verify identity or supporting information where enabled;
• •operate, secure, debug, measure, and improve the service;
• •feature, promote, and distribute public content, and earn revenue from it, as described in Section 3 and Section 4 of the Terms;
• •attribute visits to referral partners and advertising campaigns, measure campaign performance, and prevent duplicate campaign counts;
• •communicate service, safety, support, and policy updates;
• •establish, exercise, or defend legal claims; and
• •comply with legal obligations and lawful requests.

Where applicable, our legal bases are performance of our agreement with you, our legitimate interests in operating and securing OpenWish, your consent, compliance with legal obligations, and protection of vital interests. For featuring and promoting public content and earning revenue from it, we rely on our legitimate interests in running and funding OpenWish; you can object at any time at privacy@openwish.org and we will stop new uses. Where applicable law requires consent for a particular activity, we will ask for it before that activity begins.

5. AI and automated processing

OpenWish sends relevant wish text, chats, images, attachments, reports, and context to automated systems to rewrite wishes, suggest categories, identify personal information, detect prohibited conduct, prioritise safety review, and support enforcement. We also use automated tools to summarise, tag, translate, caption, and format public content for pages, search, and social posts.

AI can be inaccurate. A user approves wish rewrites before publication. Automated moderation may block or flag activity. Where required by law, OpenWish will provide information about significant automated decisions and a way to request human review. OpenWish does not use user content to train its own general-purpose model without a separate disclosed legal basis or consent.

Voice input

Typing a wish is always available. If you choose to dictate one, OpenWish uses the speech recognition built into your own browser. Your microphone is only accessed after you press the speak control, and recording stops when you close the wish form.

Your recorded audio is never sent to OpenWish and is never stored by us. We receive only the text your browser produces, which you can edit or delete before your wish is submitted.

Be aware that browser speech recognition is not always performed on your device. Most browsers send the audio to their own vendor — for example Google for Chrome or Apple for Safari — and that processing is governed by that vendor's privacy policy, not this one. If you would rather not have your voice leave your device, type your wish instead.

6. How we share data

We share data only as needed:

• •With other users: public content and information you explicitly choose to share in a conversation.
• •With processors: hosting, storage, authentication, email, push, security, analytics, AI, support, and future identity-verification vendors under appropriate contracts.
• •With partners and platforms: public content only, to sponsors, advertisers, licensees, search engines, and social platforms, as described in Section 3 and the Terms.
• •With NHBChain: if you choose to connect an NHBCoin wallet, we share only what's needed to establish and maintain that connection — your account identifier and the scopes you approved — with NHBChain, the operator of NHBCoin. NHBChain, not OpenWish, holds your wallet, keys, and PIN.
• •For safety and law: with authorities, advisers, or affected parties when reasonably necessary to comply with law, prevent serious harm, investigate abuse, enforce terms, or protect rights.
• •Business changes: during a merger, financing, reorganisation, insolvency, or sale, subject to appropriate confidentiality and notice requirements.
• •At your direction: when you consent or ask us to share information.

OpenWish does not sell personal data, other than licensing public content as described below, and does not use personal data for cross-context behavioural advertising. In particular, we do not sell your private information, such as your email address, private messages and attachments, supporting documents, verification information, sign-in provider details, and wallet connection details. If this practice changes, we will update this notice and provide any consent or opt-out controls required by law before the new practice begins.

Public content is different. Your public wishes, comments, alias, avatar, and general location are public by design, and OpenWish may license, feature, and earn revenue from them, including with partners and sponsors, as described in Section 3 and Section 4 of the Terms. Some laws treat this kind of licensing as a “sale” or “sharing” of personal information. To the extent they do, you have these controls: publish as “Anonymous”, edit or delete your content, close your account, or write to privacy@openwish.org and we will stop new commercial licensing of your public content where the law requires. Copies that have already been shared may remain, as described in the Terms.

7. International transfers

OpenWish is global and providers may process data outside your country. Where required, OpenWish will use an approved transfer mechanism, contractual safeguards, and supplementary security measures. Information may be processed in the United States and in other countries where our service providers operate, which may have different data-protection laws from your country.

8. Retention

OpenWish retains account, wish, chat, upload, and moderation data for as long as an account is active and may retain it indefinitely afterward where needed to maintain safety and enforcement history, resolve disputes, prevent repeat abuse, preserve the integrity of fulfilment records, or comply with law.

When a valid deletion request applies, we delete or de-identify covered data unless continued retention is permitted or required for security, fraud prevention, legal claims, legal holds, tax or accounting obligations, or other legal requirements. Copies may remain temporarily in backups and disaster-recovery systems until they are overwritten under normal cycles. Public content may also remain in independent search-engine or third-party caches that OpenWish does not control, and copies already shared or published in our own materials may remain as described in Section 4.5 of the Terms.

9. Security

OpenWish uses measures designed for the nature of the data, including access controls, encryption in transit, restricted private storage, secret management, logging, backups, abuse controls, and service-provider review. No system is perfectly secure, and OpenWish cannot guarantee that unauthorised access or loss will never occur.

Users should use secure authentication, protect devices, and report suspicious activity promptly.

10. Your choices and rights

Product controls allow users to edit profiles, select public identity, manage notifications, close wishes, block or mute users, leave conversations, and request account closure.

Depending on location, users may also have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, appeal certain automated decisions, and complain to a regulator. Requests may be sent to privacy@openwish.org. OpenWish may verify identity and may retain limited records where legally permitted.

OpenWish will not discriminate against a user for exercising a privacy right. Country-specific notices and appeal/authorised-agent procedures must be added where required.

11. Cookies and local storage

OpenWish uses strictly necessary storage for authentication, security, user choices, and core functionality. Signing in with Google also uses cookies and storage that Google and Firebase set for that purpose. We do not currently use advertising cookies. Campaign attribution is measured from link parameters without setting a campaign-tracking cookie. If we introduce optional analytics, personalisation, or advertising technologies, we will provide the notices and consent or opt-out controls required by applicable law.

12. Children

OpenWish is not intended for anyone under 18. We do not knowingly permit minors to create accounts. If we learn that a minor has provided personal data, we will restrict the account and take appropriate deletion or preservation steps consistent with safety and law. Concerns may be reported to privacy@openwish.org.

13. Changes

We may update this notice to reflect service, legal, or operational changes. The current version will show an effective date. Material changes will be communicated by reasonable means, and consent will be requested where required.

14. Contact and complaints

Nwudu Inc
1653 Evergreen Way
Essex, Maryland 21221
United States
privacy@openwish.org

Users may also complain to the privacy or data-protection authority available in their jurisdiction. Maryland residents may contact the Consumer Protection Division of the Maryland Office of the Attorney General.