> ## Documentation Index
> Fetch the complete documentation index at: https://codebeans-wishlyst.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Data & privacy

> What Codebeans Wishlyst stores, where, for how long, and how it is deleted.

This page summarises how the app handles your store's data and your shoppers' data. For the complete statement, request the **Codebeans Wishlyst Data Handling Statement** from [support@codebeans.net](mailto:support@codebeans.net).

## What the app stores

| Data | Details |
| - | - |
| **Wishlists** | Name, public/private setting, the customer ID (logged-in shoppers) or an anonymous session ID (guests) |
| **Wishlist items** | Product and variant IDs, and when they were added |
| **Shares** | Recipient email for email shares. Share tokens are stored only as a hash. |
| **Email log** | Recipient, template, status and errors. Email bodies are not stored. |
| **Email link clicks** | Which tracked product link was clicked, and the order it led to |
| **Unsubscribes and bounces** | Email addresses that unsubscribed or bounced, so they are not emailed again |
| **Settings** | Your widget settings, templates and SMTP settings |

The app does **not** store customer names or email addresses with wishlists. It looks them up from Shopify when you view them. Product titles, prices and images are also fetched live from Shopify.

## In your shoppers' browsers

| Item | Purpose |
| - | - |
| `sessionId` (localStorage) | Identifies a guest's wishlist |
| Small caches (localStorage) | Speed up the drawer and remember recently viewed products |
| `cbwishlist_email_ref` (cookie, 48 hours) | Credits an order to a reminder email click |

## In your Shopify store

* Settings and templates are saved as app-owned shop metafields.
* Orders placed from a wishlist get the tag `cbwishlist-order`.
* Products added from a wishlist carry hidden cart line properties (starting with `_`), which customers do not see at checkout.
* A web pixel reports completed checkouts that followed a reminder-email click, so the app can credit the sale.

## Retention

| Data | Kept until |
| - | - |
| Signed-in customers' wishlists | The customer or you delete them, or the customer's data is erased |
| Guest wishlists | 90 days after they are created |
| Everything for your store | About 48 hours after you uninstall, when Shopify sends the shop erasure request |

## Customer data requests

The app handles Shopify's privacy webhooks:

* **Customer erasure** (`customers/redact`): deletes the customer's wishlists and shares, removes them from email logs and click tracking, and stops their campaigns.
* **Shop erasure** (`shop/redact`): deletes all of your store's data from the app.
* **Customer data request** (`customers/data_request`): contact support for a copy of a customer's wishlist data.

## Your responsibilities

* The app does not check Shopify's email marketing consent before sending reminder and alert emails. Every promotional email includes an unsubscribe link. Make sure your privacy policy covers wishlist reminder emails.
* Keep your [API key](https://codebeans-wishlyst.mintlify.site/api-reference/authentication.md) and [MCP tokens](https://codebeans-wishlyst.mintlify.site/developers/mcp-server.md) secret.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.