Family Wishlist / Independent open source
Family gifts.
Minus the guesswork.
Family Wishlist is independent open-source software maintained by Jon Reed. Development tooling is funded by Furls Digital Ltd, but each family hosts its own copy in its own Cloudflare account.
This is self-hosted software, not a Furls hosted service.
Why it exists
Gift ideas, without the accidental spoilers.
Everyone in an invited family can keep a wishlist and help edit the others. They can also claim a present while its intended owner remains blissfully unaware. That last detail is doing quite a lot of work.
The application is designed around one independent deployment per invited family. Cloudflare Access admits exact email addresses using a one-time PIN, so there is no application password database to run.
Each family controls its own deployment and data. There is no central Furls account holding everyone’s Christmas secrets.
Privacy in the design
The owner cannot peek at their own claims.
The interface is only the visible part. Identity, queries, and types all reinforce the same rule underneath it.
- Admission
- Cloudflare Access checks an exact email allow-list and signs the family member in with a one-time PIN.
- Identity
- The Worker verifies the Access assertion before it trusts an identity or reads family data.
- Owner view
- An owner’s query does not return their claims. The TypeScript owner type has no claim field either.
- One claim
- The item ID is the claim’s primary key in the database, enforcing one active claim for each wish.
- Read-only sharing
- Revocable links expose one wishlist through a separate query that never selects claims.
Adding a wish
Paste a link. Keep the final say.
The application can turn a product link into an editable draft. It begins with reliable metadata published by the shop and keeps the original link attached.
If an ordinary request finds a blocked or empty page, Cloudflare’s browser rendering gets one carefully limited attempt. Workers AI is restricted to missing fields and checked against reduced page evidence.
It can help with a missing name or price, or choose a likely image from validated candidates. It cannot save the wish. People still decide what goes on the list, which feels only fair.
Quietly resilient
No JavaScript? Still a wishlist.
Core list and claim actions use server-rendered pages and ordinary forms. Enhancements make selected journeys smoother, but the essential job does not depend on them.
Reading, adding, editing, and claiming still work without browser JavaScript. Small self-hosted scripts make selected journeys more convenient.
Private pages use defensive response headers and load no third-party scripts or fonts. Family HTML and data are served with private, no-store caching.
A family member can create a revocable, read-only link for someone outside the private space. Its dedicated data path contains no claim information.
The repository publishes its architecture, tests, and an AI-assisted adversarial source review, including the original findings, fixes, and the review’s stated limits.
Ownership and stewardship
Open source. Family operated.
Cloudflare Family Wishlist is an independent open-source project maintained by Jon Reed. Development tooling was funded by Furls Digital Ltd, with that relationship documented in the repository.
The source is MIT licensed. Each family operates its own deployment and keeps its wishlist data in its chosen Cloudflare account. It is not hosted by Furls.
The source and installation guide are available now. Check the repository for current release progress and deployment guidance before setting up your own copy.
Source available now
Run it for your family.
Read the documentation, inspect the code, and deploy an independent copy in your own Cloudflare account.
View on GitHub↗