Your privacy.

The short version

Wyshing helps you save products you like and try them at home before you pay. You send us an Instagram post or reel, a product link, or a photo from your phone. We use what you send to help you choose pieces and save your finds to your Wyshlist so you can find it later. When you request a trial, we also need your delivery address, a phone number the courier can call, and a record of what you pay and what we refund. This policy explains what we collect, why, and the choices you have.

We do not sell your personal data.

Who can use Wyshing

Wyshing is intended for people 13 and older. We do not knowingly collect personal data from anyone under 13; if you believe someone under 13 has given us their data, contact us and we will delete it.

If you are under 18, you may use Wyshing only with the consent of a parent or guardian. Where the law requires it, including under India's DPDP Act, which treats everyone under 18 as a child, that consent must be verifiable, and we will not use a child's data for tracking, behavioural monitoring, or targeted advertising.

What we collect

1. Account information You sign in with a one-time code we send to your email, or with Google. We keep your email address so we can sign you in and send you emails about your account and your trials. If you sign in with Google, we receive your Google account ID and email address. We don't receive your Google password, name, or profile photo. You may also add your name. If you join through a referral, we record who referred you.

If you join the waitlist, we collect the contact you give us, your answers to the signup questions, and your referral code.

2. Your Instagram connection To send us posts by direct message, you connect your Instagram account. You tell us your Instagram username, the app gives you a short code, and you send the code to us from that account. We ask Instagram for the sending account's username to check it matches, and then link that Instagram account to Wyshing. We keep the Instagram account ID and username needed to recognise your messages. The check's working data is deleted within minutes of the code expiring. If you message us before you connect, we hold those messages and add them to your account once you do. We keep messages from an Instagram account that never connects until you connect, or ask us to delete them.

3. Content you send us to choose pieces This is the core of the app. When you:

• Send a post or reel from Instagram by direct message, we receive the message, the link, and any media in it. We use it only to help you choose the piece shown. We do not log into your social accounts or access your followers or other private account data. We see only the messages you choose to send us.
• Send a direct product link, we receive that link to help you choose the piece you mean.
• Upload a photo from your gallery, we receive that image to help you choose the piece shown. We access only the photos you specifically pick; we don't browse your camera roll.

4. Your Wyshlist The pieces and finds you save, plus any tags, notes, or organization you add, including the original photos you uploaded (see "Your photos" below).

5. Trials and deliveries When you request a trial, we collect:

• the delivery address you choose: the recipient's name, address lines, locality, state, postal code, and country. Addresses you save are kept in your address book;
• a phone number the delivery partner can call. This is your own contact number; we don't collect the courier's number;
• the pieces, sizes, and prices you requested, and a copy of the delivery address and phone number as they were at request, so an open trial always goes where you asked;
• your keep and return choices, any reasons and notes you add, and any item condition photos (see "Trial item condition photos" below); and
• delivery, pickup, and return records for each piece.

6. Payments and refunds When you pay us or we refund you, we keep:

• for a payment, the Razorpay order and payment IDs, the amount, the currency, and the payment's status; and
• for a refund, the amount, the account we sent it to, and the refund's reference.

You pay only through Razorpay, after your trial, for the pieces you keep.

You enter card, UPI, or bank details on Razorpay's own checkout, never on Wyshing. Wyshing never receives your card number, UPI PIN, or bank login. Razorpay handles those details under its own privacy policy.

7. Emails and support conversations We send you emails that are part of the service: your sign-in code, waitlist and welcome emails, and emails about your trial (request received, order placed, on the way, delivered, trial ended, return pickup, order not placed, payment received). If you write to us by email, WhatsApp, or Instagram, we keep the conversation so we can help you.

8. Automatically collected technical data Device type, app version, general location (from IP, not GPS), crash logs, and how you use the app (e.g. which features you tap). We use this to keep the app working and improve it.

When you are signed in, we record a small set of usage events: which screen you viewed, how far you scrolled on long pages (in coarse steps), when you request and complete sign-in (and whether you used email or Google), when you submit a request to join, when you save an item, and which step of a trial flow you reached. Each event records only the kind of action and the screen it happened on, never what you typed, searched, photographed, or saved. These events are linked to your account, and we use them for exactly two things: debugging sign-in and device-specific failures, and measuring which features are being adopted. We keep them for 12 months and then delete them automatically. When you use the app or website without being signed in, we record the same kinds of usage events without any account linked to them.

When you start a session, we also record basic context about your device (device type, operating system and browser family, app version, and the country/region derived from your IP address, never GPS) so that we can tell whether a sign-in problem is specific to a kind of device. These session context records are kept for 12 months, and the raw technical values behind them (your exact IP address and your browser's full identification string) are deleted after 90 days, leaving only the general categories above.

We also use PostHog to measure how the app is used and to report app errors. When you are signed in, PostHog receives your Wyshing account ID and your email address, so that a report can be matched to your account when we investigate a problem.

We do not use any of this for advertising, profiling, personalized recommendations, or to train AI models. If we ever want to use it for a new purpose, we will name that purpose in this policy first.

On our website, we also collect technical performance measurements: how fast pages load and respond, how smoothly the landing animations play, and reports of technical errors (the kind of error and the part of the site it happened in, never anything you typed or the content of your screen). So that measurements from the same visit can be grouped together, your browser sends a random temporary visit identifier that exists only in your browser's memory for that page visit; it is not saved on your device, and we do not link it to your account. We use these measurements only to keep the website fast and reliable.

Cookies and similar technologies

On our website we use cookies and similar technologies (like local storage) only to sign you in, keep your session active, remember your preferences, and understand how the site is used so we can improve it. We do not use advertising cookies, and we do not track your browsing on other websites. Your browser lets you clear or block cookies; blocking the strictly necessary ones may stop sign-in from working.

How we use what we collect

• To help you choose pieces using the content you send and save your finds to your Wyshlist.
• To sign you in and keep your account secure.
• To run your trials: order your pieces, have them delivered, arrange pickups and returns, work out what you owe, check your payments, and send refunds.
• To send you emails about your account and your trials.
• To run features like referrals and your Wyshlist.
• To improve how we help you choose pieces, fix bugs, and provide support, which may involve authorised staff reviewing your saved content and activity in a read-only capacity; such review is logged.
• To measure and keep the website fast, stable, and reliable.
• To debug sign-in and device-specific problems and measure which features are being adopted.
• To contact you about your account or important service updates.

We rely on your consent (given when you send us content or upload a photo), on our need to provide the service you asked for, including the trials you request, and on our legal duty to keep records of payments.

Providers that receive the content you send

We share the content you send with these service providers for the purposes below:

• Google Gemini (Google) receives images and content you send to help us recognise the pieces you choose.
• SerpApi receives product requests and the photos you send, including for image search, to help us offer the pieces you choose.
• Bright Data receives the product links you send to provide information about the pieces you choose.

These providers process your content only to return a result to us. We use them on terms under which they do not use your content to train their own models.

Your photos

We use the photos you upload to help you choose pieces, and we keep each photo attached to the saved find in your Wyshlist so you can see it later and so we can improve how we help you choose pieces.

• Your photos are private to your account by default. We don't show them to other users unless you include them in a piece you choose to share (see "Sharing" below).
• We do not use your photos to train anyone's AI models.
• You can delete any photo or saved item at any time from the app, and it is removed from our systems.
• You can revoke Wyshing's access to your photo library at any time in your phone's settings.

Trial item condition photos

When you return an item during a trial, you attach condition photographs of the item, and your return cannot be submitted without them. For fit-related returns the app asks for a photo of you wearing the item; otherwise it asks for photos showing the item's condition.

We collect and process trial item condition photos solely for present-tense operational, dispute resolution, and bill correctness purposes:

• Condition evidence: To establish the condition of the item as delivered or returned, providing you with evidence if a merchant queries or contests a return.
• Fraud deterrence and bill correctness: To ensure that billing obligations reflect only items kept or legitimately returned, protecting you against unjustified charges.

Strict principles governing trial photos:

• No automated proof: No algorithm, automated process, or AI model treats a photo as proof, and no billing outcome is ever derived automatically from a photo. Any disputed return or condition claim is settled through human review that fails safe toward the user: an unresolved merchant dispute excludes the item from your bill rather than charging you on contested evidence.
• Strictly private: Trial condition photos are stored under dedicated access controls. They are private to your account and authorized operational staff resolving the trial, are never displayed publicly, are never used for marketing or advertising, and are never used to train artificial intelligence models.
• Retention window: Trial item condition photos are retained for up to 24 months (63,072,000 seconds) following the closure of the trial to resolve merchant return disputes, audits, and reconciliation, after which they are permanently purged by automated retention sweeps.
• Earlier deletion: There is no per-photo delete — a retake adds a new photo while the earlier one stays as evidence. Deleting your account deletes your trial photos with it, within about 30 days as described below.

Sharing

Your Wyshlist is private by default. Nothing is shared unless you choose to share it. When you share a piece, we create a share link. Anyone who has that link and is signed in to Wyshing can view what you shared (the piece details, notes, and any photos attached to it), including people the link gets forwarded to. Viewing requires a Wyshing account, but the link itself can travel: you control who you first send it to, not where it gets forwarded after that.

A shared piece link opens that piece's page, which stays available while the piece is in our catalogue. You can't take a link back once you've shared it, and we can't undo copies or screenshots others make.

Who we share data with

We share personal data only with:

• Anyone holding a share link you created, for the pieces you chose to share (see "Sharing" above).
• Stores and delivery partners, for your trials. When we order your pieces, we give the store and its delivery partner the recipient's name, the delivery address, and the phone number, so they can deliver. When we arrange a return pickup, the courier or store collecting it receives the same.
• Razorpay, when you choose to pay through it. Razorpay collects your payment details directly.
• Service providers who run the app for us, under terms that limit them to that work (listed below).

Our service providers are:

• Google Cloud, which hosts the service and its database in Mumbai, India.
• Cloudflare, which stores and serves photos and media.
• Resend, which sends our emails through Amazon Web Services' email service in Ireland.
• Zoho, which hosts the mailbox that receives the emails you send us.
• Meta, for Instagram direct messages and for WhatsApp, which we use for support.
• PostHog, for usage measurement and app error reports.
• Google Gemini, SerpApi, and Bright Data, for the content-processing purposes described above.

We also share data in these cases:

• Legal/safety, if required by law or to protect users and the service. Where the law allows, we will tell you before sharing your data in response to a legal demand, so you have a chance to challenge it, and we will push back on requests we believe are improper.
• A future buyer of the business, if Wyshing is ever sold or merged. We will notify you in advance of any such transfer, so you can delete your account before your data changes hands if you prefer.

Some of these providers are located outside India, so your data may be processed in other countries. We do not sell your personal data or share it for cross-context advertising.

How long we keep it

We keep your account, your Wyshlist, and your uploaded photos until you delete them or close your account. Your delivery addresses and courier phone number are kept until you close your account. Removing an address from your address book hides it from you, but we keep the record until your account is deleted.

Technical logs (including website performance measurements) are kept for a limited period (about 12 months). App usage events and session device-context records are kept for 12 months, with the raw technical values behind session context (exact IP address and full browser identification string) deleted after 90 days; all of it is then deleted automatically. Trial item condition photos attached to trial returns are kept for up to 24 months after trial closure and then permanently purged by automated retention sweeps.

When you write to us or call us for help, we keep a note of the conversation. If we link it to your Wyshing account, it is deleted when your account is deleted. If we never link it to an account, it is deleted 180 days after we resolve your request, or as soon as you ask us to delete it.

Records of trials, payments, and refunds are financial records, and we keep them after you close your account, for 8 years from the end of the financial year they belong to.

Deleting your account. We can't delete your account while a trial is still open, or while we owe you a refund. We first finish the delivery, returns, and payment, and send any refund. When we delete your account, we aim to remove your personal data within about 30 days, except what we must keep:

• we delete your account details, email address, Google and Instagram links, name, addresses, phone number, Wyshlist, photos (including trial condition photos), your keep and return choices, and the messages you sent us through the app or Instagram;
• we keep trial, payment, and refund records with their amounts, dates, and Razorpay payment IDs, but we remove your account, your delivery address and phone number from them. The record of a refund still shows the account we sent it to; and
• we may also keep anything else the law requires, or that is needed for an unresolved legal claim.

We will tell you the reason if we can't complete a request.

Your rights and choices

You can, at any time:

• See, edit, or delete your saved items and photos in the app.
• Ask us to delete your account, by messaging us on WhatsApp from the Help page in the app, or by emailing privacy@wyshing.com. We delete your data as described above.
• Withdraw consent for us to process content you've sent.
• Ask us to delete the usage events linked to your account at any time, without deleting your account (email privacy@wyshing.com).
• Nominate another person to exercise your rights if you are unable to (as provided under India's DPDP Act).
• Raise a grievance with our grievance officer, Sonali, at help@wyshing.com. If unresolved, you may complain to the Data Protection Board of India.

We respond to a rights request within 30 days. We acknowledge a grievance within 24 hours and resolve it within 15 days.

If you are in the EU or UK (GDPR): you also have rights to access, correct, delete, restrict, and port your data, and to object to certain processing. Our legal bases are your consent, the performance of the service you requested, our legal duty to keep payment records, and our legitimate interest in keeping the Service secure, fast, and reliable.

If you are in California (CCPA/CPRA): you have rights to know, delete, correct, and opt out of "sale" or "sharing" of your personal information. We do not sell or share your personal information as those terms are defined.

To exercise any of these, email us at privacy@wyshing.com.

Security

We use reasonable technical and organizational measures to protect your data. No system is 100% secure, but we work to keep your information safe, and we will notify you and the relevant authority of a data breach where required by law.

Changes to this policy

We'll update this page and, for significant changes, notify you in the app or by email.

Contact

For privacy requests, email privacy@wyshing.com. For help with a trial, questions, or complaints, email help@wyshing.com. Our grievance officer is Sonali, at the same address.

Operator: Wyshing is currently a limited demo, run by Sonali from Bangalore, India. It is not yet a registered company.