Editorial note — not ready for publication
Unpublished draft. Before release, confirm the names of the hosting and email service providers; retention periods for active accounts and wish archives without a deletion request, and operational implementation of the agreed backup and log policy; the legal basis and parental authorisation process for children’s data; and the deployed account/child deletion workflow. Confirm the actual store build and any shopping or push integrations. The repository does not establish these operational facts.
Self-hosted Appwrite and EU processing
Karré IT Consulting operates Appwrite on a server within the European Union. All data processed as part of the app service we operate is processed within the EU. Appwrite is self-hosted; the service does not use Appwrite Cloud.
For privacy questions, access or deletion requests, contact Patrick-Peter Karré directly at
Controller and contact
Patrick-Peter Karré · Karré IT Consulting
Am Simontalgraben 21/2
89129 Langenau · Deutschland / Germany
E-Mail:
Telefon / Phone: +49 172 6844181
Scope and purpose
This notice applies to Wishora Christmas, part of the Wishora app family. This app lets children use their family-linked wish lists. Adults manage the family through Wishora Family. The apps share a self-hosted Appwrite backend. Data is not confined to the device: authorised family members can access the data permitted by their role.
Data and access
Depending on the functions used, the service processes adult account and login information, family memberships and roles, child profile identifiers and display names, device links, wishes and events, invitations, reservations, gift status, adult notes and privacy requests. Content entered by adults about a child comes from those adults; wishes and activity updates can also come from the linked child app.
Children do not need their own email address or real name to pair a device. Child access excludes adult reservations, purchases, budgets, private notes and exact hiding coordinates. Use a nickname where possible and avoid entering health information or other unnecessary sensitive details. Adult account sessions are stored using the device’s protected Keychain or Keystore. Server requests are checked against family membership and roles.
Optional camera access for pairing
You can connect the device with a short-lived code provided by an adult. Manual entry is available. If you choose “Scan QR code”, the app requests camera permission and decodes the code locally. Camera images are neither saved nor uploaded. The scanner stops after recognition, cancellation or when the app enters the background. No microphone, photo-library, storage or location permission is needed for scanning. Pairing itself sends the code to the Appwrite backend. A code expires after ten minutes and can be used successfully once.
External services and disabled features
The documented configuration uses self-hosted Appwrite. Google/Apple sign-in and push delivery are disabled in the reviewed implementation. They are not treated as active services in this draft. The child apps are not intended to offer adult purchasing or affiliate features.
No advertising identifiers or usage analytics are described for the reviewed app configuration. Downloading from an app store and using the operating system involve the respective providers’ separate processing. Hosting, email delivery and infrastructure logs still need a verified provider inventory before publication.
Legal basis and provision of data
Adult account and requested family-management functions are intended to be provided under Article 6(1)(b) GDPR where necessary to perform the user contract. Processing of children’s data needs a separately confirmed legal basis and, where required, verified authorisation from a holder of parental responsibility before launch. A camera permission is a technical permission and does not by itself settle that legal basis. Account and family-link data are needed for the cloud functions; optional camera access can be declined because manual code entry is available.
Security logging and the specific service providers must be documented for the actual deployment before this notice is finalised. The operator has confirmed processing within the EU.
Retention, account deletion and child data
Agreed policy, 15 October 2026: Authorised, confirmed account and child-profile deletion requests have no grace or recovery period. Deletion is intended to start without a deliberately imposed delay. The rules apply across Wishora Family, Christmas, Wishes and Easter within the relevant environment.
Implementation status: The deletion worker and 24-hour backup policy are prepared in the current source code but, according to the repository, have not been activated or accepted on the server. The parent app still records a deletion request. A request, an access block and completed deletion are distinct states. This draft therefore does not promise that immediate deletion is already operational.
Scope of deletion
For a child profile, the policy covers the profile, device links and identities across seasonal apps, pairing codes, wish lists including archives, wishes and associated notes, reservations, statuses, notifications and found-item reports. Siblings, other families and shared content not exclusively associated with that child remain protected.
For a parent account, deletion covers its memberships, notes, reservations, invitations and other personal references, as well as the authentication account and sessions. Where a family belongs exclusively to that account, its children and events are also included. Shared families require separate handling of ownership transfer and other members’ rights; other people’s content is not deleted indiscriminately.
Backups, logs and recovery
The agreed technical target is a maximum of 24 hours from the start of the backed-up state for personal-data backups. This includes versions, replicas, exports, relevant database logs and snapshots. Copying does not restart the retention period. The actual backup operation and deletion verification still require integration and acceptance.
Identifiable operational logs are to be minimised and, where technically possible, removed within the same 24-hour window. Remaining provider copies prevent an unqualified statement of complete deletion. A minimal, separately protected deletion register is retained only while affected backups or ongoing restores exist. Data deleted since a backup was created must be removed again before a restored service is reopened.
Technical failures are not reported as successful deletion. Complete removal is confirmed only after application data, authentication and external copies have been checked. Content already copied or displayed on other people’s devices cannot reliably be deleted remotely. Statutory retention or a specific legal dispute is assessed individually, limited to what is necessary and explained.
Requests and remaining retention decisions
Uninstalling the app does not delete server-side data. A request can be submitted through Wishora Family or, without the app installed, by emailing
Automatic archive and inactivity deletion remain disabled. Retention rules for active accounts and wish archives without a deletion request still require a separate decision. The backup period does not replace those rules. Final store release requires confirmed server activation and successful deletion and recovery tests.
Your rights
Where we process your personal data, you may request access, rectification, erasure, restriction of processing and, where the statutory conditions apply, data portability. You may withdraw consent at any time with future effect. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may complain to a data protection supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. For our establishment, the competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
Please contact us using the details above. Do not send passwords or complete personal files with an initial enquiry.
Support and scope
If you contact us voluntarily, we process your contact details and the information you supply to respond to your request. Contract-related enquiries are handled under Article 6(1)(b) GDPR; other enquiries under Article 6(1)(f) GDPR, based on our interest in answering enquiries and resolving technical issues. Information is retained only while needed to handle the matter or meet applicable legal obligations. Avoid including other people’s data unless necessary.
This notice describes the app. Visiting this website, downloading the app from a store and using the operating system may involve separate processing by the respective providers. The app does not use automated decision-making with legal or similarly significant effects.