Skip to main content

Privacy policy

Last updated: October 9, 2026

JoinLike (“we”, “us”, or “our”) operates joinlike.com and associated tools. This privacy policy describes how we collect, store, process, and protect your personal data when you visit our website, sign in to our dashboard, or interact with public lists.

1. Information we collect

We only collect the information necessary to provide and secure our services:

  • Account information: When you sign in using Google, we receive your name, email address, profile picture URL, and Google user ID.
  • Project and list data: Titles, descriptions, handles, slugs, questions, options (for WantList), and product wish items (for Wishlist) that you configure.
  • Shipping addresses: Names, street addresses, phone numbers, and delivery notes you save in your account. An address is shown only to people who reserve a gift that ships to it (after the reservation is confirmed), by email and on their reserved gifts page. It never appears on a public page.
  • Subscriber submissions: Names, emails, and response choices submitted by visitors to your public lists at joinlike.com/w/{handle}/{list}.
  • Payment and billing data: Subscription identifiers, plan tier, and payment status provided by our merchant of record, Dodo Payments. We do not process, store, or receive complete credit card numbers.
  • Technical and diagnostic data: IP addresses, browser user-agent, timestamps, and rate limiting tokens used strictly to maintain service security and prevent automated abuse.
  • Usage analytics: Aggregate statistics about how JoinLike is used, such as pages viewed, approximate country, device type, and how visitors arrived. See “Analytics” below.
  • Cookies and preferences: Authentication session tokens and cookie preferences stored locally in your browser. For details, refer to our cookie policy.

2. How we use your data

We process your data to operate JoinLike efficiently and lawfully:

  • To create, display, and maintain public waitlists, wantlists, and wishlists.
  • To authenticate account owners and manage access permissions.
  • To power your dashboard, record responses, and generate CSV exports.
  • To facilitate Pro subscription upgrades and customer portal access via Dodo Payments.
  • To understand, in aggregate, which parts of JoinLike are used so we can improve them.
  • To detect, investigate, and block spam, abusive automation, and unauthorized activities.
  • To send critical transactional notifications regarding your account or billing status.

3. Legal bases for processing (GDPR)

If you reside in the European Economic Area or the United Kingdom, our legal bases for processing personal data include:

  • Contractual necessity: Fulfilling our agreement with you under our terms of service.
  • Legitimate interests: Operating, securing, and improving JoinLike in ways that do not override your fundamental rights.
  • Legal obligation: Complying with accounting, tax, or mandatory reporting requirements.
  • Consent: When you explicitly consent to optional cookies or voluntary communications.

4. Data sharing and processors

We never sell, rent, or trade your personal data. We only share information with trusted third-party service providers essential for running JoinLike:

  • Google OAuth: For secure, passwordless authentication.
  • OpenStreetMap Nominatim: Only if you press “Use my location” when adding a shipping address. Your browser then sends your coordinates to this map service to find the street address. We never receive or store the coordinates.
  • Dodo Payments: For compliant global payment processing, invoicing, and sales tax compliance.
  • Google Analytics 4 (Google LLC): For aggregate usage statistics, as described in “Analytics” below.
  • Cloudflare: For network delivery, security, and cookieless Web Analytics that count overall traffic without identifying visitors.
  • Cloud and database hosting: Infrastructure providers maintaining our servers and encrypted PostgreSQL databases.
  • Project owners: If you sign up for a creator's waitlist, your submission details are accessible to that creator in their project dashboard.

Analytics

We use Google Analytics 4, provided by Google LLC, to measure aggregate usage of JoinLike. It sets the _ga and _ga_<id> cookies, which last up to 2 years.

  • Consent first in Europe: If you visit from the European Union, the European Economic Area, the United Kingdom, or Switzerland, or if we can’t determine your country, Google Analytics stores nothing until you accept analytics cookies. Elsewhere it is on by default and you can turn it off at any time.
  • Minimal data: IP addresses are anonymized, Google signals and ad personalization are turned off, and we never grant consent for advertising. We do not send names, email addresses, handles, or account IDs. Links to public lists, invites, and join pages are reported with the handle, slug, or token replaced, and sign-in and API addresses are never reported.
  • Opting out: Use on any JoinLike page, or install Google’s Google Analytics opt-out add-on.

We also use Cloudflare Web Analytics, which is cookieless and counts overall traffic without identifying you. Our legal basis for analytics is your consent where the law requires it, and our legitimate interest in improving JoinLike elsewhere.

5. Google user data

JoinLike uses Google Sign-In so you can create an account and log in without a password. This section explains exactly what we receive from Google and how we handle it.

  • Data we access: We request only the openid, email, and profile scopes. Through them, Google shares your Google account ID, email address, name, and profile picture URL. We store your Google account ID, email address, and name. We do not store the profile picture URL from Google; the only profile picture on JoinLike is one you upload yourself. We do not request access to your Gmail, contacts, calendar, Drive, or any other Google service.
  • How we use it: Only to create and authenticate your JoinLike account and to show your name and email in your account and dashboard. The Google access token is used once at sign-in to read this basic profile and is not stored.
  • What we never do: We do not use Google user data for advertising, and we do not sell it. We do not transfer it to third parties except as needed to provide JoinLike (such as our hosting providers) or when required by law. We do not use it to train artificial intelligence or machine learning models. No person at JoinLike reads it, except when you give us consent, when needed for security (such as investigating abuse), or to comply with the law.
  • Storage, retention, and deletion: Google user data is stored in our database for as long as your account is active. You can delete it at any time through our data deletion portal or by emailing privacy@joinlike.com. You can also revoke JoinLike's access to your Google account at any time at myaccount.google.com/permissions.

JoinLike's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data retention and deletion

We retain your account data and project records for as long as your account remains active. If you delete a project, associated subscriber entries are removed. You may request full account deletion at any time by contacting us.

7. Your privacy rights

Depending on your jurisdiction (such as GDPR in the EEA/UK or CCPA/CPRA in California), you have the right to access, export, correct, or request the deletion of your personal data. You can submit a deletion request anytime using our data deletion portal.

  • Access and portability: Request a copy of the data we hold about you or export your subscribers in CSV format.
  • Correction: Update inaccurate or outdated profile information in your account settings.
  • Deletion: Request permanent erasure of your account, list submissions, and personal records via data deletion.
  • Objection and restriction: Object to processing based on legitimate interests or request restrictions on data processing.

8. Security

We apply robust security measures including modern TLS encryption in transit, strict session isolation, and least-privilege database access controls to safeguard your data against unauthorized access or disclosure.

9. Children's privacy (COPPA & GDPR-K)

JoinLike is not intended for use by children under the age of 16. We do not knowingly solicit or collect personal information from minors. If a parent or guardian discovers that a minor has submitted an email address on a waitlist without consent, they can contact us immediately at privacy@joinlike.com or submit an expedited request via our data deletion portal. We will permanently expunge the records within 24 hours.

10. Company details and contact

Polyidris
Santo Domingo, Dominican Republic
Email: privacy@joinlike.com