WishNow — Privacy Policy

Who is responsible for your data

This privacy policy explains how WishNow collects, uses and protects your personal data. The data controller is:

This policy applies only to WishNow. Our other apps have their own policies, available at rochalabs.pro.

Data we collect

WishNow collects only what it needs to work:

What we do NOT collect

• No government identifiers — we never ask for CPF, RG, passport or any ID document.
• No access to your contacts, camera, microphone, photos or location.
• No credit card numbers — payments are processed entirely by Apple, Google or our payment processor; card data never reaches our servers.
• No browsing history or data from other apps.

Where your data is stored

Your data is stored on Supabase infrastructure in the South America (São Paulo) — sa-east-1 region, encrypted in transit (TLS) and at rest.

Keeping the data in Brazil reduces international transfers; where any incidental transfer occurs (for example, for infrastructure operations), it is covered by contractual safeguards consistent with LGPD arts. 33–36.

Third parties

WishNow relies on a small number of service providers ("operators" under the LGPD), each processing data only under our instructions:

We share your data with the providers listed above only so that the app can work. We do not share it with anyone else for their own purposes without your explicit consent, except when required by law or court order.

We may also produce aggregated statistics that do not identify you and cannot be linked back to you. Because such statistics are no longer personal data, we may use and share them freely.

How long we keep your data

• When you delete your account, your data is deleted immediately from the production database.
• Encrypted backups are purged on a rolling basis within 30 days.
• Billing and tax records are kept for the periods required by Brazilian tax law, even after account deletion.
• Access logs are kept for 6 months, as required by the Marco Civil da Internet (art. 15), then deleted.

Advertising

WishNow shows ads served by Google AdMob in its free version; subscribing to the paid plan removes them.

To serve and measure ads, Google may process technical identifiers of your device (such as the advertising identifier). On iOS, cross-app tracking only happens if you allow it in the App Tracking Transparency prompt; on Android, you can reset or delete your advertising ID in the system settings. If you decline, ads are still shown, just less personalized. We do not give Google your name, your email or the content you keep in the app.

If you are in the European Economic Area, the United Kingdom or Switzerland, the app asks for your consent before showing personalized ads, using a consent management platform certified by Google. You can review or change that choice at any time in the app settings.

Google explains how it uses data from apps and sites that show its ads at policies.google.com/technologies/ads, and its privacy policy is at policies.google.com/privacy.

Your rights

Under the LGPD (Lei Geral de Proteção de Dados, Lei nº 13.709/2018), you have the right to:

• confirm whether we process your personal data;
• access the data we hold about you;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary or excessive data;
• receive your data in a portable format;
• delete personal data processed with your consent;
• know which third parties we share data with;
• revoke consent, where processing is based on consent;
• lodge a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).

To exercise any of these rights, email hello@rochalabs.pro. We respond within the timeframes set by the LGPD.

If you are in the European Economic Area or the United Kingdom, you have equivalent rights under the GDPR/UK GDPR, including the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority. The legal bases described above (contract, legal obligation, legitimate interests) apply equally under the GDPR.

Deleting your account

You can delete your account at any time inside the app: Settings › Account › Delete account. Deletion is immediate and permanent — your content is removed from our production systems right away and from backups within 30 days, as described above.

If you no longer have the app installed or cannot sign in, you can request deletion at any time from our public request page — rochalabs.pro/apps/wishnow/delete-account/ — or by emailing hello@rochalabs.pro from the address linked to your account. We complete the deletion within 3 business days.

Children

WishNow is not directed at children under 13, and we do not knowingly collect personal data from children. If you believe a child has created an account or provided us personal data, contact hello@rochalabs.pro and we will delete it.

Security

We apply technical and organizational measures appropriate to the data we process: encryption in transit and at rest, access controls, isolated environments and the principle of least privilege. No system is perfectly secure; if we become aware of an incident that may create risk or damage to you, we will notify you and the ANPD as required by LGPD art. 48.

Changes to this policy

We may update this policy to reflect changes in the app or in the law. The "Updated" date at the top always shows the current version. For material changes, we will notify you in the app or by email at least 15 days before they take effect. Continued use of WishNow after that date means you are aware of the updated policy.

Contact

Questions about privacy or this policy: hello@rochalabs.pro. Please mention "WishNow" in the subject so we can route your message faster.