Privacy Policy

We collect only the information you provide directly and what is necessary to operate the platform:

• Account information — your first name, email address, and a hashed (not stored in plain text) password when you register. Patients also provide an organization code that identifies their affiliated hospital or care facility.
• Wish request content — the title, category, personal story, and description you write for each wish. You may optionally include your display name, your age, your hospital affiliation, and a photo. Photos may contain personal or health-related information you choose to share.
• Volunteer activity — which wishes you have claimed, your claim notes, and the hours you log when completing a wish.
• Server logs — standard web server logs (IP address, request path, timestamp) generated automatically as you use the service.

We do not collect payment information, government identification, or formal medical records.

Your information is used only to:

• Create and authenticate your account.
• Display wish requests to approved volunteers and facilitate fulfillment through your organization.
• Allow staff moderators to review requests before they are published, in keeping with community safety guidelines.
• Detect and prevent abuse or unauthorized access.
• Comply with applicable laws and regulations.

We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes.

WishBoard relies on a small number of infrastructure providers to operate:

• Replit — cloud hosting and database infrastructure. Your data is stored on Replit-managed servers. See Replit's Privacy Policy for details.
• Apple App Store / Google Play — if you install the mobile app, those platforms may collect device analytics and crash data subject to their own privacy policies.

No third-party advertising SDKs, analytics trackers, or social media plugins are embedded in WishBoard.

Before a wish is published, it is visible only to staff moderators who review it for community guidelines.

Once a wish is published, its content — including the title, category, personal story, description, any photo, and optional fields such as display name, age, and hospital affiliation — is publicly accessible without a login. Anyone with the link or who visits the WishBoard site can read published wish content. Do not include information in your wish that you would not want to be publicly visible.

Fields like display name, age, and hospital affiliation are optional. You can also post anonymously. We encourage you to share only what you are comfortable making public.

You have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate information.
• Deletion — ask us to delete your account and associated data.
• Objection — object to processing based on our legitimate interests.

To exercise any of these rights, contact us at the address below.

WishBoard is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately so we can delete it.

We use industry-standard measures — including encrypted data transmission (HTTPS), hashed passwords, and access controls — to protect your information. No method of electronic transmission or storage is 100% secure.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of WishBoard after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: