Privacy Policy

Geographic availability

The Service is available in all countries and regions except Mainland China. Hong Kong SAR, Macao, and Taiwan are included. This Policy describes how we handle personal information and the rights available under applicable privacy laws. We do not knowingly collect personal information from, or offer the Service to, individuals located in Mainland China.

1. Information we collect

Account information. Your email address and a password (stored only as a secure hash), or, if you sign in with Apple or Google, the name and email they share with us. We send a one-time code to confirm your email address and to reset your password.

Profile information. Your first and last name. Your name is shown to the people you share a board with.

Your boards and items. The boards you create and the items on them: photos or screenshots you upload (converted to a compressed image on your phone before upload), shop links, names, prices and currencies, and which items you've marked "I own it" or "Lost interest".

Sharing information. The email addresses you enter to share a board, who has joined your boards, and the boards shared with you. When you share a board with someone who doesn't have Genie yet, we keep their email address so the board can appear when they sign up with it.

Device information. A push-notification token if you allow notifications, so we can tell you when someone shares a wishlist with you. We do not use advertising identifiers.

Payment information. We do not collect or store your card details. Subscriptions are purchased and billed through the Apple App Store or Google Play, and payment is processed entirely by Apple/Google. We only receive confirmation that a subscription is active, via RevenueCat.

Biometric data. If you turn on Face ID, Touch ID, fingerprint, or face unlock, that check happens entirely on your device using its own operating system. Airbok never receives, stores, or has access to any biometric data.

Photos and camera. Genie only accesses the photo you pick or the picture you take when you add an item. It does not scan or upload the rest of your photo library.

2. How we use your information

• To provide the Service: store your boards and items, show shared boards to the people you chose, and sync across your devices.
• To send you email: sign-in and password-reset codes, notices about your account or subscription, a download link when you ask to export your data, and - when you share a board - an invite to the email address you entered ("{First} {Last} shared their wishlist with you").
• To send push and in-app notifications when someone shares a wishlist with you, if you allow them.
• To apply your plan's limits and features.
• To respond to support requests you send us.
• To keep the Service secure and prevent abuse.

We do not sell your personal information, we do not show ads, we do not include advertising or analytics tracking tools in the app, and we do not use your photos or boards to train any AI model.

Legal basis for processing (where applicable)

Where applicable privacy law requires a legal basis, we rely on: performance of a contract (providing the Service you signed up for - your boards, items, and sharing); legitimate interests (keeping the Service secure and preventing abuse), balanced against your rights; consent (push notifications and biometric unlock, both opt-in); and legal obligation (where we must retain records for tax, accounting, or fraud-prevention purposes). You can withdraw consent at any time in the app or your phone's settings without affecting the lawfulness of processing before withdrawal.

3. Who we share it with

We use a small number of service providers to run Genie, each bound by their own privacy and security commitments:

People you share a board with see your first and last name and that board's items, photos, prices, and links. They never see your "I own it" or "Lost interest" lists, your other boards, or your email address. Someone who opens an invite link without signing in only sees your name - never the board.

We do not share your data with advertisers, and we do not sell it to data brokers.

4. Where your data lives

Your account and board data is stored on Supabase infrastructure; item photos are stored in a private Amazon S3 bucket in the EU (Stockholm) that only Genie's backend can issue access to, via short-lived links. We take reasonable technical and organizational measures to protect your data, including encryption in transit and row-level security so that only you, and the people you share a board with, can access it.

International transfers. Our service providers (Section 3) may process data in the United States and elsewhere. Where required by applicable law, we rely on Standard Contractual Clauses and/or other recognized safeguards to protect those transfers.

5. Your choices & rights (all users)

• Export your data. From Account settings → Export my data, we email you a link to download your profile, boards, and items as a file. The link works for 7 days.
• Delete your account. From Account settings → Delete account, you can permanently delete your account, boards, items, and photos. People you shared boards with lose access. You can also ask us to delete it by emailing devs@airbok.com from the address you signed up with. See how to delete your account.
• Leave a shared board at any time from the board's menu, or stop sharing by deleting the board.
• Turn off notifications or biometric unlock at any time in the app or your phone's settings.

Additional rights under applicable privacy law

Depending on where you live, applicable privacy law may give you the right to: access the personal data we hold about you; rectify inaccurate data; erase your data; restrict or object to certain processing; receive your data in a structured, machine-readable format; and withdraw consent at any time for processing based on consent. To exercise these rights, contact us (Section 8). We will respond within the period required by applicable law. You may also have the right to complain to your local data protection authority.

If you're in the United States (CCPA/CPRA and other state laws)

Depending on your state, you have the right to: know what personal information we've collected about you and why; delete personal information we hold about you; correct inaccurate personal information; and opt out of the sale or sharing of personal information. We do not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of - this right is provided as a matter of transparency. We will not discriminate against you for exercising any of these rights. To exercise them, contact us (Section 8); we may need to verify your identity before fulfilling a request.

6. Data retention

We keep your account and board data for as long as your account is active. When you delete your account, your profile, boards, items, invites, and notifications are deleted straight away and your photos are removed from storage; remaining copies in encrypted backups are overwritten on a rolling basis. A pending invite you sent to someone who never joined is deleted when you delete the board or your account. We may keep limited records where we're required to for legal, security, or fraud-prevention purposes.

7. Children's privacy

Genie is not directed to, and we do not knowingly collect personal information from, anyone under 16 (consistent with GDPR's default age of consent) or under 13 (the threshold under the US Children's Online Privacy Protection Act, "COPPA"). If we learn we've collected personal information from a child under these ages, we'll delete it. If you believe a child has provided us personal information, contact us (Section 8).

8. Contact us

Questions about this Privacy Policy or your data? Email devs@airbok.com, or see our Support page.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you in the app or by email before they take effect.