Privacy Policy

MiWish is operated by MiWish Pty Ltd (ACN 701 521 164, ABN 65 701 521 164), an Australian company based in Victoria, Australia (“MiWish”, “we”, “us” or “our”).

This Privacy Policy applies to the MiWish website and platform at miwish.com (the Platform), including the read-only memorial portal and contribution pages that invited visitors can reach through a private link. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Account information. When you create an account we collect your name and email address, and a password which is stored only in a securely hashed form — we never see or store your actual password.

Your memorial content. The heart of the Platform is content you choose to add: your biography and life story, photographs, music, videos and voice recordings, your speech or eulogy, your celebration of life plan, and the arrangement of your presentation. Some of this may reveal sensitive things about you — for example your health, religion, or cultural background. We only ever use it to provide the service to you, as described in section 4.

Final wishes and estate information. You may optionally record practical information for your executor: the location of your will, banking and superannuation details, insurance policies, and key contacts. This information is encrypted before it is stored (see section 8) and is only ever shown to an executor you have personally nominated.

Information from invited visitors. People you invite can interact with the Platform without an account: family and friends can submit a message or photograph through a private contribution link, and memorial visitors can sign the guestbook with their name and message. We collect what they submit, and it is only published after it has been approved (by you for contributions, or by your nominated executor for guestbook entries).

Launch notifications. Before launch, you can leave your email address on our coming-soon page to be told when MiWish opens. We store that address and the date you gave it to us, and use it for that one announcement only. Reply to any email we send to be removed from the list.

Technical information. Like almost every online service, our systems record limited technical data needed to run and protect the Platform — such as IP addresses used for rate limiting and abuse prevention, and standard server logs. We do not use advertising or cross-site tracking technologies. See our Cookie Policy for the short list of cookies we use.

Some features involve you giving us personal information about people other than yourself:

• Your guest list — names, email addresses, phone numbers, RSVP status and notes about the people you’d like at your celebration.
• Your next of kin and executors — the names, email addresses and relationships of the people you nominate to receive your presentation.
• Key contacts in your final wishes — such as your solicitor or accountant.

We only use this information to provide the service to you — for example, to send an invitation you have asked us to send, or to show your guest list to the recipients of your presentation (see section 6). Before adding someone’s details, please make sure you are comfortable sharing them for these purposes. If someone whose details have been added contacts us, we will handle their request under this policy, including removing their details where appropriate.

We collect, hold and use your information to:

• provide the Platform — storing, organising and presenting the content you create;
• share your presentation and information with the specific people you nominate, and only them;
• generate AI-assisted drafts when you ask for them (see section 5);
• send service emails, such as account and password emails, and invitations you ask us to send;
• keep the Platform secure — preventing abuse, enforcing rate limits and investigating problems;
• comply with our legal obligations.

We do not sell personal information, share it with advertisers, or use your memorial content for marketing. We will not use your information for any purpose unrelated to the ones above without asking you first.

The Platform offers optional AI assistance — for example, helping you draft your biography or speech, improving a piece of text, or arranging your uploaded content into a presentation. When you use one of these features, the text you provide for that request (such as your answers to guided questions, or the text you asked us to improve) is sent to our AI provider, OpenAI, to generate the draft.

• AI features only run when you ask them to — nothing is sent automatically.
• Under the terms of the API service we use, content submitted this way is not used by the provider to train its AI models.
• Your photos, music, videos and final wishes are never sent to the AI provider. For presentation building, only text such as captions and titles is shared — never the files themselves.
• Every AI draft is just that — a draft. Nothing is saved to your presentation until you accept it, and you can edit or discard it entirely.

Your content is private to your account by default. Nothing is public. There are exactly three ways anything you add can reach another person, and every one of them starts with you:

• Recipients you nominate. When you share your presentation, each nominated next of kin receives a private link secured by a long random code. Anyone you nominate can view your memorial content — your presentation, life story, photographs, and your guest list including its contact details — and download the keepsake PDF. Their access is read-only: no recipient can ever edit your content.
• Executors. Estate information — your final wishes and any uploaded will or estate documents — is shown only to recipients you have specifically marked as an executor. Other recipients cannot see it and are not told it exists.
• Contributors and guestbook signers. A contribution link lets an invited person submit a message or photo for your approval; it does not let them see your presentation. Guestbook entries are visible on the memorial portal only after your executor approves them.

You can revoke a recipient’s access or a contribution link at any time from your account, and revocation takes effect immediately. Please treat access links with care — anyone in possession of a link you or your recipients pass on will have the same access as the person it was sent to.

We use a small number of specialist providers to run the Platform. Each one only receives what it needs to perform its role for us:

• Supabase — our database, authentication and file storage provider. Your account data and content are stored in Supabase’s United States (US East) region.
• Vercel — hosts the Platform’s application servers, primarily in the United States.
• OpenAI (United States) — processes text you submit to the optional AI features (section 5).
• Resend (United States) — delivers invitation emails you ask us to send, account emails, and the launch-notification list.
• Upstash (United States) — supports rate limiting, holding short-lived technical identifiers such as IP addresses.
• Cloudflare (United States) — runs the automated check that tells a person from a bot on our sign-up, sign-in and password-reset forms (Turnstile). It sees the technical details of that request, such as your IP address and browser, and nothing you have written in MiWish.
• Sentry (United States) — error monitoring. When something on the Platform breaks, a technical report of the error is sent so we can fix it. These reports are about the software, not about you: we do not use session recording, and private access links are redacted before a report leaves your browser or our servers.

This means your personal information is stored and processed in the United States. We take reasonable steps to ensure these providers handle it consistently with the Australian Privacy Principles, including using providers with strong security practices and contractual commitments about data handling. If you are not comfortable with your information being stored overseas, please do not use the Platform.

We may also disclose personal information where required or authorised by law — for example, to comply with a court order.

• All connections to the Platform are encrypted in transit (HTTPS/TLS), and our storage providers encrypt data at rest.
• Your final wishes and estate information receive an additional layer: every free-text field is encrypted at the application level (AES-256-GCM) before it reaches the database, so it cannot be read from the database alone.
• Photographs, music, videos and documents are held in private storage. They are never publicly accessible; each viewing session uses short-lived, signed links.
• Every database record is protected by row-level access rules tied to your account, and memorial access links use long random codes that are infeasible to guess.
• Revoking a recipient’s access is immediate and permanent — a revoked link can never be reactivated, only replaced with a fresh nomination.

No online service can promise absolute security, but we design the Platform so that a single failure — a lost device, a leaked link, even a database breach — exposes as little as possible. If a data breach occurs that is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

Because the Platform exists to preserve your story for the people you leave it to, we keep your content for as long as your account exists — including after your death, so that the recipients you nominated can continue to view what you prepared for them.

You can delete your account at any time from your account settings. Deletion is scheduled, not instant: your account is locked and every access link you have issued stops working immediately, and after 30 days your account and all of your content — including photographs, music, videos, final wishes and uploaded documents — is permanently removed. During those 30 days you can sign in and restore your account. We do not keep a copy after removal. Individual memorials you delete from your dashboard are held for the same 30 days and can be restored from there.

Limited technical records (such as server logs) are retained for short periods for security purposes and then deleted in the ordinary course.

You can view and change almost all of the information we hold about you directly within your account. You may also contact us at admin@miwish.com to request access to, or correction of, your personal information. We will respond within a reasonable period, and we will not charge you for making a request.

If you believe we have mishandled your personal information, please contact us first and we will do our best to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by phone on 1300 363 992.

The Platform is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal information from children. Photographs and stories you add may naturally include family members of all ages — that content is part of your private memorial and is handled like all of your other content under this policy.

We may update this policy from time to time — for example, if we add a feature or change a service provider. The date at the top shows when it was last changed. If a change meaningfully affects how we handle your personal information, we will let you know through the Platform or by email before it takes effect.

Privacy questions, requests and complaints can be sent to admin@miwish.com. Please include “Privacy” in the subject line so we can prioritise it.

MiWish Pty Ltd · ACN 701 521 164 · ABN 65 701 521 164 · Victoria, Australia