Privacy Policy
Last updated: 2 October 2026 · Million Wishes World, millionwishesworld.com
1. Who we are
Million Wishes World is a world map where every person can place one wish as a star. The service is run by [operator name and postal address – to be completed before public launch] ("we"). Contact for all privacy questions: wish@millionwishesworld.com.
2. Who can use the service
You must be at least 13 years old. When you create an account we ask for your month and year of birth. This is private, is never shown to anyone and can be set only once. If you are under 13, the account is not created (or is deleted at once). People aged 13–17 can add a wish, but it is shown without a name and photo and with an approximate location, and they cannot send or receive messages or comments. Parents or guardians who believe a child under 13 has an account can write to us and we will delete it.
3. What we collect
| Data | Why | Visible to others? |
|---|---|---|
| E-mail address (for e-mail sign-in, or from Google/Facebook if you use them) | Sign-in, security, notifications you switch on | Never |
| Month and year of birth | Age rules and child protection | Never |
| Your wish: text, optional story, category, optional name, place (city, rounded coordinates), language | Showing your star on the map | Yes, according to your visibility choice (everyone, signed-in users, or only you). For users under 18 no name or photo and a broader location |
| Country of your internet connection (a 2-letter code derived by our hosting provider; we do not store your IP address) | Checking that the wish place is plausible | No (only you and moderators) |
| Display name and profile photo (optional, adults only) | Shown next to your wish if you choose | Yes, if you allow it |
| Hearts, saved wishes | Features of the service | Hearts are counted anonymously |
| Public comments and private messages (adults only) | Communication between users | Comments: public. Messages: only sender and recipient (moderators see only reported messages) |
| Stories: YouTube video ID, title, description, consents | Optional "Story Behind the Wish" feature | Only after moderator approval |
| Reports and moderation records | Safety, abuse prevention, legal claims | No |
| Notification preferences and e-mails sent | Only e-mails you switched on | No |
We do not use advertising or tracking cookies, we do not sell personal data, and we do not use analytics tools. Typefaces are served from our own site. We do not use passwords: sign-in is by an e-mail code or by Google or Facebook if you choose them.
4. Why we use your data
To provide the service you asked for (account, wish, map); to keep the community safe (moderation, abuse prevention, age rules) which is our legitimate interest and, for children, a legal and protective duty; to send e-mails you switched on (your consent, which you can withdraw in Profile); and to meet legal obligations. [Legal bases to be confirmed in legal review.]
5. Services we use
| Provider | What for |
|---|---|
| Supabase (database, authentication, file storage; EU region) | Stores accounts, wishes and photos |
| Cloudflare | Website hosting, DNS, bot protection (Turnstile). Cloudflare sees your IP address when you visit |
| Forpsi (Czech Republic) | Sending e-mails |
| OpenFreeMap, NASA GIBS | Map images: your browser contacts them when the map loads |
| OpenStreetMap Nominatim | Place search: the place name or coordinates you enter or share are sent to it |
| MyMemory (translated.net) | Optional automatic translation of wishes: the text you ask to translate is sent to it |
| YouTube (privacy-enhanced mode) | Only when you check a link for a story or press play on a story video |
| Google or Facebook | Only if you choose to sign in with them; they tell us your e-mail and name, not your age |
Some providers are outside the EU/EEA; transfers rely on the safeguards those providers offer (such as standard contractual clauses). [To be confirmed in legal review.]
6. How long we keep data
- Account, wish, photo, comments, messages, stories: until you delete them or your account.
- A deleted wish is kept in a private archive for 30 days so a moderator can undo a mistake; when you delete your account the archive copy is removed immediately.
- Queued e-mails: 30 days. Moderation records: as long as needed for safety and legal claims.
- If an account fails the age check (under 13), a one-way scrambled code of the e-mail address (not the address itself) is kept for 72 hours only to stop repeated attempts.
- Backups made by our providers expire on their normal schedule.
7. Your rights
You can access, correct, export and delete your data and withdraw consents. In the website: Profile → Account has "Download my data" and "Delete my account". You can also write to wish@millionwishesworld.com. You may complain to your national data protection authority.
8. How to delete your data
- Open millionwishesworld.com and sign in (including if you signed in with Facebook or Google).
- Open Profile → Account → Delete my account and type DELETE to confirm.
- Your account, wish, photo, comments, messages, stories and hearts are deleted from the live service at once.
- If you cannot sign in, e-mail wish@millionwishesworld.com from the address you used. We will delete the data and confirm.
If you used Facebook or Google to sign in, you can also remove Million Wishes World in that service's settings (apps and websites / third-party access). We do not keep your Facebook or Google password or access token.
9. Cookies and local storage
We use browser storage only for essential things: your sign-in session, language and display choices. The Cloudflare bot check may set a technical cookie. We do not use advertising or analytics cookies. YouTube loads only after you press play.
10. Security
Access to data is limited by database rules, administration requires a password and a second factor, and connections are encrypted. No system is perfectly secure; if a breach affects you we will inform you as the law requires.
11. Changes
We will update this page when the service or the law changes and show the date at the top.
Zásady ochrany osobních údajů
Poslední aktualizace: 2. října 2026 · Million Wishes World, millionwishesworld.com. Česká verze je pomocná; rozhodující je anglická.
Kdo jsme a pro koho je služba
Provozovatel: [jméno a adresa – doplnit před spuštěním], kontakt wish@millionwishesworld.com. Služba je od 13 let. Při registraci se ptáme na měsíc a rok narození (soukromé, nikdy se nezobrazuje, nastaví se jednou). Pod 13 let se účet nevytvoří. Do 18 let se přání zobrazí bez jména a fotky s přibližnou polohou a bez zpráv a komentářů.
Co shromažďujeme
E-mail, měsíc a rok narození, tvé přání (text, příběh, kategorie, jméno, místo, jazyk), kód země tvého připojení (IP adresu neukládáme), volitelně jméno a fotku (jen dospělí), srdíčka, komentáře a soukromé zprávy (jen dospělí), příběhy (ID videa na YouTube, popis, souhlasy), nahlášení a záznamy moderace a nastavení oznámení. Nepoužíváme reklamní ani analytické cookies, osobní údaje neprodáváme a nepoužíváme hesla (přihlášení e-mailovým kódem nebo přes Google/Facebook).
Služby, které využíváme
Supabase (databáze, přihlášení, úložiště; region EU), Cloudflare (hosting, ochrana proti robotům), Forpsi (e-maily), OpenFreeMap a NASA (mapové podklady), OpenStreetMap Nominatim (hledání místa), MyMemory (volitelný automatický překlad), YouTube (jen při kontrole odkazu a po stisknutí přehrávání), Google/Facebook (jen pokud je zvolíš pro přihlášení; předají e-mail a jméno, ne věk).
Jak dlouho údaje uchováváme
Do smazání přání nebo účtu. Smazané přání je 30 dní v soukromém archivu pro případ omylu; po smazání účtu se archiv maže hned. Fronta e-mailů 30 dní. Po neúspěšné kontrole věku (pod 13) se 72 hodin uchovává jednosměrný otisk e-mailu (ne samotná adresa) jen kvůli zabránění opakovaným pokusům.
Tvoje práva a smazání dat
Přístup, oprava, export, výmaz a odvolání souhlasu: Profil → Účet („Stáhnout moje data“, „Smazat účet“) nebo e-mailem. Smazání: přihlas se → Profil → Účet → Smazat účet → napiš DELETE. Smaže se účet, přání, fotka, komentáře, zprávy, příběhy i srdíčka. Pokud se nemůžeš přihlásit, napiš z použité adresy na wish@millionwishesworld.com. Máš také právo podat stížnost u Úřadu pro ochranu osobních údajů.
Právní základy a přenosy mimo EU budou doplněny po právní kontrole.