Wish list can expose personal info