Privacy policy
GruvWishlist is an independent, non-commercial project that helps movie collectors track prices and stock on Universal Pictures Home Entertainment's retail site gruv.com. We are not affiliated with Gruv or Universal Pictures Home Entertainment.
This policy explains what data the site collects, why, who we share it with, and what you can do about it. It is written for a real human; if anything is unclear please reach out.
The short version
- You sign in with Microsoft, Google, or Facebook. We never see your password.
- We store your email, your wishlist, your notification preferences, and a log of notifications we've sent you.
- We send you email about price drops and restocks only if you opt in.
- We don't run analytics cookies, ad-tracking pixels, or third-party advertising on our pages.
- When you click a "Buy" link, you're redirected through the CommissionJunction affiliate network so we can earn a small commission. CJ may set their own cookies on their own domain.
- You can disconnect a sign-in provider or permanently delete your account at any time from your account page. Deletion also removes your wishlist and notification history.
Information we collect
When you sign in
Authentication is handled by Microsoft, Google, or Facebook. When you sign in with one of these providers, they share the following with us:
- Your email address
- A unique provider-issued identifier (so we can match you to your account on subsequent sign-ins)
- A display name, if the provider returns one
We do not receive your password, and we never store one — sign-in is external-only. If you choose to link a second provider to the same account, we additionally store the second provider's identifier so either can sign you in.
When you use the site
- Your wishlist: the products you've added and any price thresholds.
- Your notification preferences: whether you want emails for price drops or restocks, and an optional alternate email if you prefer notifications go somewhere other than your sign-in address.
- Your notification history: a log of when we sent you each notification, so we can enforce a 24-hour cooldown on duplicate alerts.
- Standard request logs: our hosting provider (Microsoft Azure) records IP addresses, user-agent strings, and request paths for the usual operational reasons (debugging, abuse prevention, capacity planning).
What we do not collect
- Payment information of any kind — the site doesn't sell anything directly.
- Browsing activity outside GruvWishlist.
- Analytics cookies, advertising IDs, or third-party tracking pixels on our pages.
How we use your information
- To run your account: sign you in, show your wishlist, accept changes to it.
- To send the notifications you asked for: we check current prices against your wishlist and send the alerts you opted in to.
- To prevent abuse and keep the site running: standard logs help us detect crawlers, debug crashes, and rate-limit misuse.
- To earn a small affiliate commission: when you click "Buy" on a product, the outbound link is decorated with our affiliate ID so CommissionJunction can credit us if you buy something. This is what funds the site's hosting.
Who we share information with
We don't sell your data. We share data only with the third parties strictly required to operate the site:
- Sign-in providers (Microsoft, Google, Facebook) — receive the sign-in request when you click their button. Their own privacy policies apply during that exchange.
- Email delivery (Mailgun) — receives your email address and the notification body so it can deliver email on our behalf. Only used for notifications you opted in to.
- Affiliate network (CommissionJunction) — when you click a "Buy" link we redirect through CJ. CJ sees the click and may set cookies on their own domain (cj.com, kqzyfj.com, jdoqocy.com, and similar) to attribute any subsequent purchase to us. We never send your email or wishlist to CJ.
- Hosting (Microsoft Azure) — runs the site, the database, and the image cache. Azure can see request logs and database contents in the normal course of providing the service.
We may also disclose data when legally required (subpoena, court order). We are based in the United States and operate under US law.
Cookies
We use only the minimum cookies needed for the site to work:
- An authentication cookie that keeps you signed in.
- An anti-forgery cookie that protects POST requests from cross-site forgery attacks.
Both are first-party (set on the GruvWishlist domain), HTTPS-only, and not used for analytics. We do not use any third-party analytics or advertising cookies on our own pages.
Note that the outbound CJ affiliate redirect goes to a CJ-controlled domain, where CJ may set its own cookies — those are subject to CJ's privacy policy, not ours.
Your rights and controls
You can, at any time:
- See which sign-in providers are linked and add or remove them, at /account.
- Edit or clear your wishlist from your wishlist.
- Unsubscribe from notifications using the link in any notification email, or from your account page.
- Delete your account permanently at /account → Danger Zone. Deletion is immediate and removes your account, your wishlist, your notification preferences, and your notification history. It cannot be undone.
If you are in the EU, UK, or California and want to exercise additional rights (such as a copy of your data or a deletion request you can't perform through the site), please contact us using the email at the bottom of this page.
Data retention
- Account data, wishlist, notification preferences: kept until you delete your account.
- Notification history: kept for the lifetime of your account, because it powers the duplicate-alert cooldown. Deleted with your account.
- Server logs: retained per our hosting provider's defaults (typically 30–90 days).
Children
GruvWishlist is not directed at children under 13. We do not knowingly collect information from anyone under 13. If you believe we have, please contact us and we'll delete it.
Changes to this policy
If we change this policy in any material way, we'll update the date at the top. For minor edits (clarifications, typo fixes) we won't bother updating it.
Contact
Questions, requests, or anything else: email web@gruvwishlist.com.