Your wishes are yours.

Covet is operated by Earth Wide Service Limited, a company incorporated in Hong Kong. Earth Wide Service Limited is the controller of the personal data described in this policy (and the “data user” under the Hong Kong Personal Data (Privacy) Ordinance).

Legal entity

Earth Wide Service Limited

Incorporated in

Hong Kong

Company Reg. No.

79877575

Registered office

Room 511, 5/F, Ming Sang Industrial Building, 19-21 Hing Yip Street, Kwun Tong, Hong Kong

Privacy contact

[email protected]

Account data

When you create an account and use it, we store:

• your email address, username, display name, short bio and the avatar color you pick;
• your birthday, if you choose to add it (it is optional and you can remove it at any time);
• your password, stored only as a bcrypt hash — we never store or see your password in plain text;
• your plan, billing history and your notification preferences.

Session data

When you sign in we create a server-side session. We store a hashed version of the session token together with the browser’s user-agent string (so you can recognise your devices), for up to 30 days or until you sign out.

Wishlists and items

• Lists: title, description, emoji, theme, occasion, event date and visibility setting.
• Items: product link, title, image URL, price, store, your notes, priority and quantity.
• Co-owners you invite to help manage a list.

Reservations

When someone reserves an item, we record which item was reserved and by whom. Signed-in members reserve as themselves. Guests give us a name and email address; we email them a link they can use to release the reservation later. We store the guest’s email and a hashed version of that release token — never the token itself.

Social activity

Likes you give to lists and items, the people you follow and the people who follow you, and the notifications generated by that activity.

Payment data

Card payments for Plus and Family are processed by our payment provider. We receive and store only the card brand, last four digits, expiry date, cardholder name, country and postal code, so we can show you which card is on file and issue receipts. We never receive or store full card numbers or the security code (CVC).

Messages you send us

If you contact support or submit a report, we keep the message, your email address and any details you choose to include.

Technical data

We use your IP address transiently to apply rate limits that protect sign-in, sign-up, reservations and link-fetching from abuse. Rate-limit entries are kept for windows of at most one hour and are not linked to your profile. Our hosting provider may keep short-lived server logs for security and reliability.

When you add a product link, Covet’s server visits that public web page to read its title, main image and price from the page’s metadata. That request comes from our servers, not from your browser, so the store sees Covet rather than you. We do not log in to stores, and we do not read anything that isn’t publicly available on that page.

Product images are displayed through Covet’s image proxy. This means stores and image hosts do not see the IP addresses of people viewing your lists.

On Plus and Family plans, Covet periodically re-checks the prices of items you have saved so we can tell you about price drops. These checks also run from our servers and only read the public product page.

Every list has a visibility setting that you control at any time:

Your public profile shows your display name, username, bio, avatar color and your public lists. Remember that anyone you share an unlisted link with can forward it to others.

We use personal data to:

• create and secure your account, keep you signed in and let you recover access;
• store, display and share your wishlists according to the visibility you choose;
• fetch product details for the links you save and, on paid plans, track price changes;
• handle reservations, including emailing guests their release link;
• send notifications about likes, new followers, reservations (only when surprise mode is off), co-owners joining your lists and price drops, according to your notification preference;
• process subscription payments, send receipts and keep billing records;
• answer support requests and reports;
• detect, investigate and prevent fraud, spam, abuse and violations of our Terms and Acceptable Use Policy;
• comply with legal obligations.

We do not sell your personal data, share it for cross-context behavioural advertising, or use it to build advertising profiles. We do not show ads.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

We share personal data only with service providers that help us run Covet, under contracts that limit their use of it to providing services to us:

We may also disclose data:

• to other users, as described in “Who can see your lists”;
• when required by law, court order or a valid request from a public authority;
• to protect the rights, property or safety of Covet, our users or the public;
• to a successor entity in a merger, acquisition or sale of assets, subject to this policy.

Covet is operated from Hong Kong, and our hosting and email providers are located in the United States. Your data will therefore be transferred to and processed in Hong Kong and the United States, which may have different data-protection laws from your country.

Where the law requires it, we protect these transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent contractual terms. You can request more information about these safeguards at [email protected].

• Edit your profile, lists and items at any time.
• Change visibility of any list between private, unlisted and public.
• Export your data as a JSON file from Settings.
• Delete your account yourself in Settings (your password is required). This immediately deletes your profile, lists, items, reservations, likes and follows. Copies in backups are purged within 30 days.
• Notifications: choose which emails you get in Settings. Transactional emails such as receipts and security messages are always sent.

Under the GDPR and UK GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing, including processing based on legitimate interests;
• data portability (our JSON export covers this);
• withdraw consent at any time where we rely on consent;
• lodge a complaint with your local data-protection authority, such as your EU supervisory authority or the UK Information Commissioner’s Office.

Most of these you can do yourself in Settings. For anything else, email [email protected]. We respond within one month and may need to verify your identity first.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to:

• know what categories and specific pieces of personal information we collect, use and disclose;
• delete personal information we hold about you;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information — we do not sell or share personal information as those terms are defined in the CCPA;
• limit the use of sensitive personal information — we only use it to provide the Service;
• not be discriminated against for exercising these rights.

Categories we collect: identifiers (email, username), customer records (name, billing details), commercial information (plan and billing history), internet activity on Covet (lists, likes, follows), and the content you create. Sources, purposes and recipients are described above. To make a request, email [email protected]; you may use an authorised agent.

We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and its Data Protection Principles. You may request access to, and correction of, your personal data by writing to [email protected]. We may charge a fee for data access requests only where the Ordinance permits it.

We protect your data with measures appropriate to the risk, including:

• encryption in transit (HTTPS) for all traffic;
• bcrypt-hashed passwords, and hashed session and release tokens;
• httpOnly, Secure session cookies;
• rate limiting on sensitive actions;
• an image proxy so viewers’ IP addresses aren’t exposed to third-party stores.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

Covet is for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has created an account, please contact [email protected] and we will delete it.

We use a single strictly necessary cookie to keep you signed in, and no analytics or advertising cookies. See our Cookie Policy for details.

We may update this policy as Covet evolves. We will change the “Last updated” date above and, for material changes, notify you by email or in the app before they take effect.