Privacy policy

Last updated: 9 May 2026

This document is binding in English. Other languages are translations for convenience.

1. Introduction

Welcome to BigWishes (“BigWishes,” “we,” “our,” or “us”). This privacy policy explains what data we handle and what we do not, and how that fits with our public Anonymity policy. Where this document and the Anonymity policy describe the same practice, both are intended to say the same thing.

2. Who we are

Data controller: BigWishes LTD
Archiepiskopou Makariou III, 140 RAPTOPOULOS BUILDING, 3021, Limassol, Cyprus

BigWishes LTD is the data controller responsible for the limited personal data described below, in line with the General Data Protection Regulation (GDPR) and applicable Cyprus law.

3. What we do not collect

BigWishes is built so we never need most of the data a typical platform stores. As a gifter, we do not collect:

• Your real name.
• Your email address or phone number.
• Government ID, passport, or any KYC documents.
• Your wallet address or balance.
• Your geographic location, beyond what is implied by the network path of a request.
• Any third-party advertising or social-media profile.

We do not run Google Analytics, Meta Pixel, or any similar third-party tracker. BigWishes does not sell data to anyone, because there is essentially nothing to sell.

4. What we do collect

We hold a small set of data, only what is needed to run the service:

• AnonID hash: Your account is a 16-digit AnonID we generate on sign-up. We store only a hash of it, used to keep you signed in.
• AML report ID: When you complete a free wallet-history check at your wallet provider, you paste the report ID (e.g. TXN-0000-ABCD). We store the report ID for compliance. We do not receive your wallet address, balance, or KYC files from the provider.
• Payment records: On-chain transfers to our payment wallet are recorded with their amount, network, and timing, so we can match them to a creator's wish.
• Hashed IP and User-Agent: Server logs hash your IP address and User-Agent string to enforce rate limits. Raw values are not stored.
• Optional gift signature: If you choose to sign a gift with a custom note (under 100 characters), we store that note alongside the gift record.
• Creator identity: Creators are invitation-only and verified off-platform. For creators, we hold the legal name, age confirmation, and payout details needed to comply with our payout obligations. Gifters never see this data.

5. Cookies and similar technologies

BigWishes uses one strictly-necessary session cookie that carries the hash of your AnonID, plus one short-lived functional cookie remembering your language choice. We do not load advertising or analytics cookies. See our Cookies policy for details.

6. Legal basis for processing

We process the data above only when there is a valid legal basis under Article 6 of the GDPR:

• Account sign-in and rate limits: performance of a contract.
• Payment matching and AML records: legal obligation and performance of a contract.
• Fraud prevention and platform security: legitimate interest.

7. How we use your data

We use the data above to:

• Sign you in and out of your anonymous account.
• Match incoming on-chain transfers to a specific gift and creator.
• Comply with AML and payout obligations on the creator side.
• Enforce rate limits and detect abuse.

We do not use your data to send you marketing messages, because we do not have a way to message you. There is no email or phone number on file.

8. Data sharing

We share data only with parties strictly needed to run the service:

• Our payment processor, for processing on-chain transfers.
• Our cloud hosting provider, for server infrastructure.
• The wallet provider that issued an AML report, only if a payment from your wallet is later flagged and we need to follow up.

We do not share data with advertisers or analytics platforms.

9. International data transfers

BigWishes is a global service. The limited data described above may be processed in countries outside your own. Where transfers occur, we apply standard safeguards such as Standard Contractual Clauses (SCCs).

10. Your rights

Depending on where you live, you have rights including access, correction, deletion, restriction, and objection. Because we do not collect identifying data, most of these rights resolve very simply:

• Self-deletion: Open the account dropdown and click “Delete account”. Your AnonID and AML ID are wiped instantly.
• Access: The account dropdown shows everything we hold for your account, including past payments.
• Correction: If you change wallets, paste a new AML report ID; the old one is replaced.

11. Data retention

We keep account-bound data only while your account is active. After self-deletion, your AnonID hash and AML ID are removed. Past payment records are kept in anonymized form for the period required by financial regulations, with no link back to your account.

12. Children's privacy

BigWishes is intended for people aged 18 and over. We do not knowingly serve users under 18, and we do not market to them.

13. Security

We apply industry-standard measures including:

• TLS encryption for data in transit.
• Encrypted storage at rest.
• Strict access controls and audit logs for the small admin team.
• Regular backups and integrity checks.

14. Updates to this policy

We may update this privacy policy from time to time. Material changes will be flagged on the site, and the “Last updated” date above will change.

15. Contact

For questions or requests about your data, contact us at office@bigwishes.fans.