Privacy

DRAFT for Tom’s review: not yet checked by a lawyer.

Last updated 10 October 2026.

This page explains what I Want I Need does with your information, in plain English. We’ve tried to say what really happens, including the bits that aren’t finished yet.

The short version

We keep what you give us so the app works: your account, your lists and what’s on them, and which gifts friends have claimed.
A list’s owner doesn’t see who is getting what, or when, while the surprise is on. They can tell an item has been bought because it leaves their list, but not who bought it. (Like anyone with the link, an owner who opens their own shared list while signed out sees how many of each thing are taken, never by whom: that is what stops two friends buying the same thing.) After the event they can tick off the gifts that have arrived, and see who gave those ones, and only those.
In a Secret Santa, nobody, not even the organiser, can see who has drawn whom. You see only the person you’ve got.
We don’t sell or rent your data. There are no adverts and no analytics at the moment. If that changes, we’ll ask you first and update this page.
“Buy” buttons on shared lists are affiliate links. The click goes through us (we count it, without recording who you are), then through our affiliate network Skimlinks, to the shop, and we may earn a small commission if you buy. It costs you nothing extra and the list’s owner is never told who clicked. See “Affiliate links”.
When you add a product from a link, our servers read the shop’s page. If a shop turns our server away, our website’s server (on Cloudflare) tries once for us. Only if they can’t find the details, an AI (Claude, from Anthropic) reads a cut-down copy of that page. It never gets your name, email or lists.
If you add a product from a screenshot, the whole picture goes to our server and on to an AI (Claude, from Anthropic) to be read. We don’t keep the screenshot. The only picture we keep is the product photo cut out of it, which you see before you add the item. Keep anything private off the screen first.
The browser extension reads a page only when you click its heart, and sends us only the product’s name, price, photo address and shop, plus the page’s address.
You can download a copy of your data, or delete your account and all of it, yourself from the Profile page (“Your data”). The download leaves out what would spoil someone’s surprise and the sign-in records our sign-in provider keeps; email us for those. If you can’t sign in, email hello@iwantineed.co.uk.

Who we are

I Want I Need is a free wishlist app for the UK, at app.iwantineed.co.uk. We decide how your information is used, which makes us the “controller” under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who is responsible for your data: [legal name and postal address to be added before launch].

Questions, requests and complaints about privacy: hello@iwantineed.co.uk.

What we collect and why

Your account

Your email address and password. To sign you in. Our sign-in provider stores the password as a one-way scramble (a hash), so nobody at I Want I Need can read it.
Your name, and a username. Your name is what you type when you sign up. We make your username from it, and you can change both. Other signed-in people who find you (by your exact email address, or the start of your username) see your name, username and photo so they can send you a friend request. They never see your email address. Anyone who searches for an address does learn whether it has an account.
A photo (optional). It’s shrunk to 256 pixels in your browser before it’s uploaded, and kept in a public file store under a long random name. Anyone who has its exact web address can open it.
Your birthday (optional). Day and month only, never the year. We save it. Nobody else sees it unless you tick “Remind my friends when my birthday is coming up” on your profile (it is off until you do). Then your friends (people whose friend request you accepted, or who accepted yours) get a notification, and an email if they have reminder emails on, 14 days and 3 days before. That tells them the day and month, never the year. You can untick it at any time.
Your choices. Whether you ticked “Email me gift ideas, tips and the odd offer” when you signed up, and whether you want friend emails and gift update emails.
Sign-in records. Our sign-in provider keeps technical records of when and how an account signs in (such as the time, the IP address and the browser) to keep accounts secure.

Lists, items and sharing

Your lists (name, occasion, date, emoji) and the items on them (name, shop link, photo, price, how many, notes, and whether it’s ★ Most wanted). Every list starts private, so only you can see it. You can share a list with your friends, with anyone who has its link, or by a link that shows only the items you tick.

A list shared by link shows its name, your name and its items to anyone who has the link, signed in or not. Links can be forwarded, so share them with care. We tell search engines not to list these pages, but that’s a request, not a lock.
A list shared by a link that shows only the items you tick works the same way, but the link shows just the items you have ticked, together with the list’s name, occasion, date and picture and your name: the other items on the list are not sent to anyone who opens it. You can tick and untick items at any time. Unticking an item stops anyone new claiming or buying it through the link at once; someone who has already claimed it keeps seeing it (without its shop link, and with any later changes to it) and still gets the emails described below, until their claim ends. To take an item away completely, delete it or make the list private. Items you ticked stay ticked if you switch the list to another choice and back.
For a list shared by link (the whole list), you can also tick a box to show it in your friends’ Friends tab and “What’s new”, as well as to the people you send the link to. A list shared with only some items never appears there.
When a link is shared in a chat, a preview picture of the list (its name and top items) is drawn for it. Anyone with the link can ask for that picture.
The link you save with an item is kept as it was in your browser (we remove common tracking parameters when you add a product from a link). On shared lists, anyone who can see the item gets a “Buy” button for it that goes through us and our affiliate network before it reaches the shop (see “Buy buttons and clicks” below and “Affiliate links”). You see your own link directly on your own pages.

Giving gifts in secret

When a friend says “I’ll get this”, we record which item, who (their account, or a guest’s details, below), how many, whether it’s reserved (for 14 days) or bought, and when it was made, bought or cancelled.

The list’s owner is not shown this while the surprise is on. It’s enforced in the database itself: the owner’s account has no way to read claims on its own lists. The owner can tell that units have been bought because they come off the list, and nothing more, until they check in their gifts (next point). An owner who opens their own list’s link signed out sees what any visitor sees (next but one).
After the event, the owner can check in their gifts. From the day after the date on a shared list (or whenever they choose), the owner sees what has been bought, with no names, and ticks the gifts that have arrived. For the ones they tick, and only those, they then see who gave them: an account’s name, or the name a guest typed, never an email address, and never anything about reservations. Gifts they don’t tick stay hidden. An owner can also write a short thank-you note (up to 300 characters). It goes to the people with an account who gave something they ticked, as a notification and an email (see “Notifications and emails” below); guests aren’t sent it, because we don’t email addresses that someone typed in without an account. Putting a gift back hides its givers again, though a thank-you that has already gone stays sent.
Other people looking at a shared list see only that something is partly or fully taken, so two friends don’t buy the same thing. They never see who. A guest’s claim only counts once they have confirmed it from the email we send them (see the next section), so nobody can mark a list as taken with someone else’s address. As a further limit, a list takes at most 20 claims an hour from guests (60 across all of one person’s lists), counting those that haven’t been confirmed.
Those of us who run I Want I Need can read claims in the database, but only to fix problems or investigate abuse.
If an owner changes an item that’s been claimed, or deletes it or the list it’s on, we email the giver to say so (see “Notifications and emails” below). When an item is deleted, the claims on it are deleted too, after we’ve noted who to tell. The owner is never told that we sent the email.

Guests who claim a gift

You don’t need an account to claim a gift from a shared list. A guest types their name and email address. We keep them with the claim and use them for three things only:

To email the guest one “Confirm your gift” message for each claim. The claim only counts once the guest presses “Confirm my gift” on the page that email opens (the page only shows a button, so a security scanner that opens the link confirms nothing). After that the same link manages the claim from any device, and, if the owner later changes or deletes that gift, a short email says so.
To keep the limits below.
To help if something goes wrong with a claim: you can email us, and we can find it from the address used.

The guest’s name is not shown to anyone else, and the owner sees it only if they tick that gift as received after the event (see above), never the address. A guest address can be emailed at most 5 times a day (we ignore capital letters and “+tags”, so a+1@example.com counts as a@example.com, and for Gmail also the dots and googlemail.com, which Gmail ignores too). Every one of those emails has a “Stop emails like this” link. Using it adds the address to a block list, so we never email it again. Because a guest types the address themselves, it might not be theirs: if you got one of these emails by mistake, ignore it (nothing is claimed unless you press the button, and the request lapses after 24 hours), or use that link to stop them, or email us and we’ll remove the claim. If the day’s limit of emails has been reached, a guest’s claim isn’t made until it resets. An address that asked not to be emailed, or has already had its five for the day, is never emailed: a claim typed with it simply can’t be confirmed.

While a claim waits for its confirmation it counts for nothing: nobody else sees it, it isn’t taken off the list, and the owner is told nothing. It lasts 24 hours, and we delete it within about three days. If two guests ask for the last one, the first to confirm gets it and the other is told it was taken.

Two random codes belong to each guest claim: one is kept in a cookie on the guest’s device (see Cookies) so the device can show the claim, and a different one is in the email link, which is what confirms it (so pressing a button on the device that typed an address can’t confirm it). Once a claim is confirmed, the device that confirmed it keeps that second code in its cookie too, so it can manage the claim. We store only a scrambled copy of each code, so we can’t work them out ourselves.

Friends and invites

Friend requests and friendships: who asked whom, whether it was accepted, and when. Friends can see the lists you share with friends, and what you’ve added lately in their “What’s new”.
Your personal invite link (app.iwantineed.co.uk/invite/…) shows your name and photo to anyone who opens it, signed in or not. A person who joins through it becomes your friend once they confirm their email address. We keep a note of who invited whom, and how many friends joined through your link.

Secret Santa

If you make or join a Secret Santa group (a group of up to 25 people who swap gifts), we keep:

The group: its name, an optional budget and date, who organises it, its invite code and who has joined. If the organiser says two people shouldn’t draw each other (couples, say), we keep that pair. Each person can be in one pair; everyone in the group sees how many pairs there are, and only the organiser sees who.
The draw: who is buying for whom. The database picks it at random. It is kept so that you can open your own giftee, and no one else’s: nobody, including the organiser, can see it in the app, and the database refuses every other way of asking. Those of us who run I Want I Need can read it in the database, but only to fix problems or investigate abuse, as with claims.
Questions and answers between a Santa and the person they’ve got (up to 500 characters each, 30 each way). A question reaches the giftee as “your Santa”, with no name, and the notification and email for it hold no name or text.

Joining means whoever draws you can see your lists that are shared by link or with friends, read-only, even if you aren’t friends (the join page says so before you join). Private and archived lists stay hidden. They can’t reserve anything: it is only so they can choose a gift, and their Buy links work like anyone’s (see “Buy buttons and clicks”). When the names are drawn everyone in the group gets a notification, and an email unless they switched reminder emails off. Once the names are drawn, nobody can join or leave. Until anyone has looked at who they’ve got, the organiser can draw again with the same people (up to 10 times); after that the draw is final. A group needs at least 4 people (5 if any pair is kept apart), because in smaller groups people could work out who drew whom. Even so, a small group narrows it down: in a group of 4, your Santa is one of two people. If someone deletes their account after the draw, whoever was buying for them gets their giftee instead, and the questions between those two are deleted.

Notifications and emails

In the app: a bell and a Notifications page for friend requests, accepted requests, friends joining through your invite, the reminders and Secret Santa updates below, and thank-you notes.
Emails about your account (confirming your address, magic sign-in links, password resets) always come. Friend emails (the same three events) come unless you switch them off in Profile → Emails, or use the “Unsubscribe” link in any of them, which works in one click.
Reminders: five kinds, each in the bell and, unless you switch reminder emails off in Profile → Emails or use the “Unsubscribe” link in any of them, by email. A friend’s birthday, 14 days and 3 days before, only if they turned that on (see “What we collect and why”). One of your lists whose date is 14 days away and which has fewer than five things on it. A reservation of yours that ends in about three days and isn’t bought (for people with an account: a guest’s first email, with its link, is their reminder). The morning after the date on one of your shared lists that has something bought, a prompt to check in your gifts (it says nothing about who gave what, and you can ignore it or check in whenever you like). And Secret Santa updates: the names are drawn, your Santa has asked you something, your giftee has answered (none says who drew whom or what was asked). Each morning (about 9 in the UK) we work out which are due. They share the day’s email limit with every other email, and one that is out of date by then (the reservation was bought, the check-in was done, or the friend turned reminders off) is not sent. We keep nothing extra for them: they are ordinary notifications (see “How long we keep things”).
Thank-you notes: when an owner checks in a gift you gave and writes a note, you get it as a notification and an email, with the owner’s name, the name of the first gift they ticked of yours and how many there were. It goes to people with an account only, and comes under the same switch as gift updates (Profile → Emails, “Gifts you’ve claimed”) and the “Unsubscribe” link in the email. The note is an ordinary notification (see “How long we keep things”). Web addresses in a note are made unclickable in the email, so nobody can be sent to a site or tracked by one from our email.
Gift updates: if the owner of a list changes the name, price, notes, link or number wanted of something you’ve claimed, moves it to another list, or deletes it (or the list), we email you, as long as the list is still shared with you. This goes to people with an account and to guests, at the address they typed. The email says what changed but not what it changed to, links to the list, and says when your claim has gone. To keep it to one email, we wait about a minute after the last change, and we send at most one email about a change to the same gift an hour (a removal is always sent). There is a daily limit on how many of these we send. Accounts can switch them off in Profile → Emails or with the “Unsubscribe” link in any of them. Guests get the same “Stop emails like this” link as in their first email. To send these we keep a short-lived note of who to tell, with the item and list names, the owner’s name and what kind of change it was (see “How long we keep things”). The owner is never told that we sent one.
Gift ideas, tips and offers: we save your choice from sign-up, and we haven’t sent any of these emails yet. If we do, it will be only to people who ticked the box, with an unsubscribe link in every email.
Emails are sent from hello@iwantineed.co.uk through Resend (see “Who helps us”).

Buy buttons and clicks

What we note when someone clicks a “Buy” button: which item it was (this is cleared if the item is deleted), the name of the shop’s website (such as argos.co.uk), the affiliate network, and the time. Nothing about the person: no name, account, IP address, browser details, cookie or page they came from.
Nobody can read these notes through the app or the website, including the list’s owner, who is never told who clicked what. They are there so we can count how often links are used and spot abuse.
We note at most 20 clicks an hour on one item and 3,000 a day in all. Past that, the button still works and the click just isn’t noted.
Buy buttons only work for items on a list that is shared with the person clicking, and the shop’s address comes only from our database.

Adding a product from a link

When you paste a link on the Add page, it goes to our server. The server asks the shop for that page (the shop sees our server’s address, not yours) and reads the product’s name, price and photo.
If a shop turns our server away, we try three more things, in this order. First, our website’s server on Cloudflare (which has different addresses) fetches that one page once and passes a trimmed copy of it straight back to our own function: the page’s text and its product data, without the scripts, styles and pictures. That copy isn’t stored and nothing in it is about you. (Before our server fetches any shop page or photo, it also looks up the shop’s website name, and nothing else, to check that it points to an ordinary public address.) The shop sees Cloudflare’s address, not yours. Second, for a few shops (ASOS at the moment) our server asks the shop’s own public price service for the product’s price, using the product number from the link (and the link itself, as a browser would send it, which the shop has already seen from our first try). Third, if we still have no name, we work one out from the words in the link itself, and the form tells you so and asks you to check it.
It downloads the photo and keeps a 600-pixel copy in a public file store, under a name made from the picture’s web address and the shop’s website name, so anyone with its exact address can open it.
AI, as a last resort. If the server can’t find the name, price or photo in the page, it sends Claude Haiku (from Anthropic) a cut-down summary of the shop’s page: its web address, title, meta tags, headings, price-like text, picture addresses and a stretch of the page’s own text starting at the product’s name, at most about two thousand words in all. Only what the shop published goes. Your name, email and lists never do. Anthropic replies with the product details. Under its commercial terms it deletes requests automatically after a short time and doesn’t use them to train its models. The AI is used only inside our server functions, never in your browser. The browser extension doesn’t use it when it has read the product from the page itself, but if the extension can’t read a page, our server reads the link as it does here, and may use the AI.
Sharing from your phone. You can also send a link to the Add page from your phone’s Share menu: on Android once the app is installed, or on an iPhone with a Shortcut (see Add from your phone). What you share (the web link, and any words that came with it, such as “Check out this kettle on Argos”) goes to the Add page in the address your browser opens, and the link is then read exactly as if you had pasted it. The words are only used to suggest a name when the shop’s page gives none. Nothing you share is kept unless you then add the item. If you’re logged out, the page you were heading to (which may hold what you shared) is remembered in a cookie until you log in (see Cookies).
We remember what we read from a link and reuse it for 24 hours if someone adds the same link. It holds only what the shop’s page says publicly.
We count how many links each account asks us to read each day, to stop abuse and to keep our costs under control.

Adding a product from a screenshot

On the Add page you can choose a screenshot instead of pasting a link (for a shop that won’t let us read its page, or something you saw in an app). Your browser first redraws it smaller, which also leaves out any hidden details a picture can carry, such as where or when a photo was taken, and then sends it to our server.
Our server sends the whole picture to Claude Haiku (from Anthropic), which reads the product’s name, price and shop off it and says where the product’s photo is in the picture. Everything that was on your screen goes with it, such as notifications, your name or an email address, so please crop out or close anything private first. Anthropic replies with the details. Under its commercial terms it deletes requests automatically after a short time and doesn’t use them to train its models. The AI is used only inside our server functions, never in your browser.
We don’t keep the screenshot. Our server holds it only while it is being read, and doesn’t save it. Our logs record only numbers and words such as its size, how long the read took and whether it worked, never the picture or what was read from it.
We cut the product’s photo out of the screenshot, shrink it to 600 pixels and keep it in the same public file store as other product photos, under a name made from the picture itself, so anyone with its exact address can open it. You see it before you add the item and can remove it. If you don’t add the item, the photo stays in the file store, but nothing points to it.
A screenshot counts against the same daily limit as a link that needs the AI, and we count how many each account asks us to read each day, to stop abuse and to keep our costs under control. What the AI reads can be wrong, so the form tells you to check the name and price.

The browser extension

The I Want I Need extension for Chrome and Edge adds the product you’re looking at to one of your lists. Here is everything it does with your information.

It reads a page only when you click its heart. It asks the browser for temporary access to the tab you’re on, at that moment, and to no other tab. It can’t see your browsing history, and it doesn’t run in the background.
What it reads: the product’s name, price, photo addresses, the shop’s name and the page’s “canonical” link, from the page’s hidden product data, its tags, or what the page shows. It doesn’t send the page’s text or HTML (only the product’s name and price, picked out of it), and it doesn’t read what you’ve typed into forms, your passwords or your cookies.
What it sends us: that product information and the page’s web address, together with your signed-in session. This happens as soon as you click the heart, before you choose to add anything, so it happens even if you then close the popup without saving. Our server then downloads the main photo from the shop’s address and stores a copy, as above. The web address, name, price and photo go on the item you save.
Signing in: your email and password go to our sign-in provider, exactly as on the website. The extension doesn’t keep your password.
What stays in your browser: your sign-in session (a pair of sign-in tokens and your email address) and the list you last chose, in the extension’s own storage, which websites can’t read. “Sign out” in the extension deletes the session, and so does uninstalling it.
What it never does: no analytics, no adverts, no tracking, no code loaded from elsewhere. We don’t sell or share what it sends. We use it only to add that product to your list, and to keep the service secure and running.

Cookies

We set these cookies, each one needed for something you asked for. We don’t use analytics or advertising cookies.

Sign-in cookie (its name starts sb- and ends -auth-token)
Keeps you signed in. Set when you sign in and removed when you sign out. If you never sign out, your browser may keep it for up to about 13 months. Set by Supabase’s sign-in tools in our app.
Sign-in security codes (names start sb- and end -code-verifier)
Our sign-in tools set these when they send you an email link: to confirm a new account, to sign in with a magic link, or to reset a password. Each holds a random code and nothing about you. Your browser may keep them for up to about 13 months, and signing out removes them. Set by Supabase’s sign-in tools in our app.
iwin_next
Remembers the page you were trying to open in the app when you had to log in first (for example, the Add page after you shared a link from your phone), so you land on it after logging in. If that was a shared link, the cookie holds the link and the words that came with it, in a coded form that isn’t a secret. It’s kept for up to an hour and deleted as soon as you log in.
iwin_ref
Remembers which invite link you opened, so your friendship is set up when you sign up. Kept for 30 days.
iwin_claims
Remembers the gifts a guest has claimed on this device, so they can manage them. Kept for a year. It holds random codes, not names or email addresses.

Shared lists, the invite page and the app load no third-party scripts, so nobody else sets cookies through them. Clicking a “Buy” button sets no cookie of ours (if you’re signed in, your sign-in cookie above may be refreshed, as on any page). The one thing to know is that you then leave our site, and the affiliate network (Skimlinks) and the shop may set their own cookies on their own websites, as any website you visit may (see “Affiliate links”). If we add analytics, or anything else that sets a cookie we don’t strictly need, we’ll ask first.

How long we keep things

We’d rather be straight about this: apart from a few short timers and one clean-up that runs each night, nothing is cleared out automatically yet.

Your account, lists, items, friends and notifications: until you delete them, or delete your account (Profile, “Your data”), which removes your sign-in, profile and photo, your lists and everything on them, your friends and friend requests, your notifications and the claims you made on other people’s lists, straight away. A gift you had marked as bought goes back on its list as still needed. You can also delete any list or item yourself at any time, and replace or remove your photo. Notifications are deleted by the nightly clean-up once they are a year old. Nothing else of yours is cleared out automatically, and there is no rule yet for accounts that go unused. The companies that run the service for us (see “Who helps us, and where your data lives”) may keep their own short-lived logs or backups for a while, on their own schedules.
Claims: kept with the item, so we can help if something goes wrong. A cancelled claim is deleted by the nightly clean-up a week after it was cancelled. A reservation stops counting after 14 days, but its record stays. Deleting an item deletes the claims on it (after its givers have been noted for an email). A claim an owner has checked in keeps the time it was revealed to them. Deleting an account deletes the claims it made and, with its lists, the claims others made on them; nobody is emailed about that.
A guest’s claim that was never confirmed (name, address and what they asked for): it can’t be confirmed after 24 hours, and it is deleted two days after that, at the latest by the nightly clean-up.
The log of guest emails (the address and when it was emailed, used for the daily limit, and including gift update emails): removed once it is more than two days old, at the latest by the nightly clean-up.
Secret Santa groups (with their draws, exclusions and messages): until the organiser deletes the group, or the nightly clean-up deletes it 90 days after its date (or after it was made, if it has no date). Deleting an account deletes the groups it organises, for everyone in them, and removes the person from the others (whoever was buying for them gets their giftee instead).
Notes of who to tell about a changed or deleted gift (the address or account, the item and list names, the owner’s name, and what kind of change): one that still hasn’t been sent after two days is never sent. A note for a guest’s address is deleted two days after it’s made, sent or not. One for an account is kept for 30 days after it’s made, sent or not, because the “Unsubscribe” link in the email looks it up, and then deleted, at the latest by the nightly clean-up. Deleting your account deletes the notes that carry your name.
Notes of “Buy” button clicks (the item, the shop’s website name, the network and the time): deleted after 60 days, at the latest by the nightly clean-up. If an item is deleted, its clicks stay for those 60 days with the item removed from them.
The “stop emails” block list: kept for good, because it is the record that lets us honour the request. We remove an address from it if the owner asks.
Product photos: not deleted when an item is deleted (several items can share one picture). They’re public, with no names or accounts on them. Profile photos are deleted when you replace or remove them.
What we read from shop pages: reused for 24 hours, and deleted by the nightly clean-up once they are over two days old. They hold only what the shop publishes. The trimmed copy of a page that Cloudflare passes to our function is not stored: it is gone when the read ends.
Screenshots: not kept. The photo cut out of one is kept like any other product photo (see “Product photos” above).
Daily counts of links and screenshots read: kept for 35 days by the nightly clean-up (and with your account until then).
Hourly counts of friend searches, and of gift update emails an owner’s changes set off: used only for the limits, and deleted after a day.
Logs and backups at Supabase, Cloudflare and Resend: kept for the short periods each of them sets. What our own code writes to its logs is which shop’s website was read, not who asked.

Your rights

Under UK data protection law you can ask us to:

tell you what we hold about you, and give you a copy (and a copy you can move elsewhere);
correct anything that’s wrong (you can also edit your profile and lists yourself);
delete your data;
stop or limit using it, or object to how we use it;
stop any emails we send because you said yes (every one has an unsubscribe link).

You can download a copy of your data (a file you can keep or move elsewhere) and delete your account yourself, any time, on the Profile page under “Your data”. Deleting needs your password, can’t be undone, and takes effect at once. For anything else, or if you can’t sign in, email hello@iwantineed.co.uk from the address on your account. We’ll reply within one month. For a guest’s claim, tell us the address you typed.

Our reasons for using your data. To run the service you asked for: your account, lists, claims, friends, the emails that make them work, and adding products. To keep it safe and fair, and to prevent abuse: the limits, the block list, and security records. With your consent: marketing emails if you ticked the box (you can change your mind whenever you like), and any non-essential cookies in future.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Affiliate links

I Want I Need is free. We earn a small commission when someone buys something after clicking a “Buy” button on a shared list, at no extra cost to them. The price is the same, and it never changes who sees what on a list. Every shared list with “Buy” buttons says so above its first item.

How it works

A “Buy” button opens an address on our site (app.iwantineed.co.uk/go/…). Our server finds the item’s shop link in our database, notes the click (see “Buy buttons and clicks”), and sends your browser on, through our affiliate network Skimlinks, to the shop. The network records that you came from us, so the shop can pay us if you buy.
What Skimlinks sees when you click: the same things any website you visit sees (your IP address and browser details), the address of the shop page you’re going to, our site’s ID with Skimlinks, and a label saying whether the list was shared by link (which includes a link that shows only some items) or with friends. We don’t send it your name, email address, account, or the address of the list. Skimlinks decides for itself how it uses what it sees, and its own privacy policy applies to that. It may set cookies on its own website, and so may the shop. We set none.
The shop sees you arrive, as it would from any link, and, if you buy, the sale. We don’t tell it anything about the list or who the gift is for.
Not every shop pays commission (Amazon links don’t earn anything at the moment), and they work the same way. If a privacy tool or ad blocker stops a “Buy” button reaching the shop, email us and we’ll help.
The list’s owner is never told that anyone clicked a “Buy” button, or who. The notes we keep can’t be read by them (or by anyone through the app).

Children

I Want I Need is for people aged 16 and over. We don’t knowingly collect information about younger children. If you think a child has given us their details, email us and we’ll delete them. If we build something for families, it will have its own protections and its own explanation here.

Changes to this page

We’ll change this page when what we do with your data changes, and update the date at the top. For a big change (such as adding analytics or adverts), we’ll also tell people who have an account, before it starts.

Make your own list or log in.

The short version

Who we are

What we collect and why

Your account

Lists, items and sharing

Giving gifts in secret

Guests who claim a gift

Friends and invites

Secret Santa

Notifications and emails

Buy buttons and clicks

Adding a product from a link

Adding a product from a screenshot

The browser extension

Cookies

Sign-in cookie (its name starts sb- and ends -auth-token)

Sign-in security codes (names start sb- and end -code-verifier)

iwin_next

iwin_ref

iwin_claims

Who helps us, and where your data lives

Supabase

Cloudflare