MWISH

Effective May 2, 2026

Privacy Policy

MWISH ("we", "us") is a free tool built by Manojit Ballav ("Mono") for collecting travel item-requests from friends. The whole product is designed so that your trip data lives in your own Google Sheet— we store as little as possible. This page explains what we do collect and how it's used.

What we collect

  • Identity — your name, email, and profile photo from Google (when you sign in with Google) or just your email (when you sign in with a magic link).
  • Google authorization tokens — for trip owners only, we keep an encrypted refresh token so we can read and write the Google Sheet you create for each trip.
  • Trip lookup index— for each trip you create, we store the slug, the Sheet ID, your destinations, and the trip's open/closed status so the share link works.
  • Item requests— submitted by friends through your trip's public board. These are written into your Google Sheet, not into our database.

We do not use analytics, tracking pixels, advertising cookies, or third-party trackers. The only cookie we set is the session cookie for sign-in.

Where your data lives

  • Trip content(the actual item requests, destinations, deadlines, settings) lives in the Google Sheet that's created in your Google Drive. You own it. You can open, edit, export, or delete it directly from Drive at any time.
  • Account and trip-index records live in a Turso (libSQL) database hosted in AWS Mumbai (ap-south-1).
  • App code runs on Google Cloud Run in us-central1.

Who we share data with

MWISH uses a small number of third-party services to function. We share the minimum data each one needs:

  • Google (Sheets, Drive, OAuth) — to create and update the trip Sheet in your Drive. We use the drive.file scope, which only lets us see files MWISH created on your behalf — we cannot read the rest of your Drive.
  • Google Generative AI (Gemini API) — when a friend submits an item, the item name and destination are sent to Gemini to estimate weight, suggest a category, and screen for customs concerns. Submitter identities are not sent.
  • Resend — sends magic-link sign-in emails on our behalf. They receive the recipient email and the link.
  • Cloudflare — provides DNS for mwish.in and the Turnstile bot-detection widget on the request form.
  • Unsplash — provides destination photography. Only the destination name is sent; no personal data.

We do not sell your data. We do not share it for advertising. We do not share it with anyone outside this list.

How long we keep it

Trip records and your account stay as long as you keep them. When you delete a trip, the lookup index entry is removed and the underlying Google Sheet is moved to your Drive trash (recoverable from there for ~30 days, then permanently deleted by Google). When you delete your account (email Mono — see below), all of your records are removed from MWISH within seven days.

Your rights

You can:

  • Open, edit, export, or delete your trip Sheet directly from Google Drive at any time.
  • Delete a trip from MWISH (Settings → Danger Zone → Delete trip) — this also trashes the Sheet.
  • Revoke MWISH's access to your Google account at any time via Google Account permissions.
  • Request that we delete your account and all associated MWISH records.

Children

MWISH is not directed at children under 13. If you are a parent or guardian and believe a child has used the service, email Mono and we'll remove the records.

Changes

We may update this policy from time to time. The effective date at the top will change. For material changes that affect existing data we'll notify trip owners by email at the address on file.

Contact

Questions, deletion requests, or anything else — email manojitocto@gmail.com.