Privacy Policy

3.1 WWPocket

• Account. You create an account with your name, email address and a password. Passwords are stored only as a bcrypt hash, so we cannot see them.
• Your financial records. The transactions, categories, accounts, transfers, subscriptions, savings goals, plans and debts you enter are stored on servers we operate, so you can see them on any device you sign in on.
• Card and account numbers. WWPocket keeps only the last 4 digits of a card or bank account number, so you can tell your accounts apart. It never asks for or stores a full card number, expiry date or security code (CVV), and it cannot make payments.
• First-time setup. The first time you sign in, WWPocket asks our own endpoint which country your connection comes from (as seen by Cloudflare) to suggest a language and currency. Neither the country nor your IP address is stored or passed on.
• Password reset. If you ask to reset your password, we email you a one-time code through our email provider, Mailjet.
• AI suggestions and advice. Category suggestions and monthly advice may be generated with Google’s Gemini API. When they are, the data needed for the request (monthly totals, category names, plans, and the notes of the transactions being categorised) is sent to Google, which processes it under its own terms and may use it to improve its services. When the AI service is not used, WWPocket’s built-in rules produce the suggestions and nothing is sent.
• No ads; cookieless visit counts. WWPocket shows no ads and has no advertising trackers. The web app and the pages on wwpocket.com use Cloudflare Web Analytics, which counts visits without cookies and without identifying you; we see only totals such as page views, popular pages, referring sites, countries, devices and browsers.
• Export and deletion. You can export all your data to an Excel file at any time (Activity, then Backup) and delete individual records in the App. To delete your account and all its data, email us from the address you signed up with.

3.2 Quick Checklist

• Without an account. Quick Checklist works without an account, and that is the default. Your notes, checklists, images and reminders are stored in your browser’s own storage on your device and are never sent to us. Location and other camera data (EXIF) are removed from photos before they are saved, and the phrases behind quick-capture suggestions stay on your device. Because we hold no copy, we cannot recover your notes if you clear your browser data or lose your device; use Settings, then Backup, to keep a copy.
• With an account. Signing in is optional and uses Google Firebase Authentication, so we never see or store your password. We store your Firebase user ID, email address, display name (if your sign-in method provides one) and subscription status.
• Premium sync. With a Premium subscription, your notes are copied to our server so they appear on your other devices. Note content (titles, text, checklist items and the text used for search) is encrypted at rest with AES-256-GCM. We hold the key, so this is not end-to-end encryption. Some details stay unencrypted because the server needs them to sort and merge your notes: colour, pinned and archived state, labels, reminder schedule, and when each note was created and changed.
• Reminders. On Premium, reminders are sent as push notifications through Firebase Cloud Messaging, which uses a token for your device. On the free plan, reminders stay on your device.
• Payments. Premium is sold through Paddle.com, our merchant of record. Paddle processes your payment and holds your card details; we receive your email address and subscription status.
• Ads. On the free plan, Quick Checklist shows ads from Google AdSense while you are online. Google receives your IP address and sets its own cookies, which it may use to personalise ads, and decides itself how it uses that data. Premium shows no ads and does not load the ad code. We never send Google anything you write. You can manage ad personalisation at myadcenter.google.com.
• Deleted notes. Notes in Trash are deleted permanently after 30 days, and the deletion reaches our server the next time your device connects.

3.3 ARDesk.AI

ARDesk.AI is in development and not yet available to the public. This section describes how it is being built, and we will update it before launch.

• Business accounts. ARDesk.AI is used by organisations. Owners and staff sign in with Google, with an email address and password, or with a sign-in link sent by email. We store each user’s name, email address, role and organisation.
• Organisation content. Documents, data and messages that an organisation’s users give ARDesk.AI are processed to answer questions, produce summaries and reports, and carry out tasks. Each organisation’s data is kept separate from every other organisation’s, and within an organisation people see only what their role allows.
• AI processing. ARDesk.AI’s AI runs on models we host ourselves; organisation content is not sent to outside AI providers. We do not use an organisation’s content to train AI models for other customers without that organisation’s written consent.
• Who is responsible. For personal data that an organisation puts into ARDesk.AI about its staff, customers or others, the organisation is the controller and WW Collab processes that data on its behalf, following its instructions and our agreement with it. Requests about that data should go to the organisation first; we will help it respond.

3.4 This website

The WW Collab website uses no cookies, analytics or advertising. Our web server keeps standard access logs (IP address, browser, page requested and time) for security and troubleshooting, and older logs are overwritten automatically. If you email us, we use your message only to reply.

11.1 Indonesia

We process personal data in line with Law No. 27 of 2022 on Personal Data Protection and its implementing regulations. If you are not satisfied with our response to a request, you can complain to the government authority responsible for personal data protection in Indonesia.

11.2 European Economic Area, United Kingdom and Switzerland

If you are in the EEA, the UK or Switzerland, the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your personal data, on the legal bases in section 5. You can complain to the data protection authority where you live or work, or where you believe a breach happened. Transfers out of your region rely on adequacy decisions or on standard contractual clauses used by our providers.

11.3 United States, including California

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and not to be treated differently for using these rights.

• Categories we collect: identifiers (name, email address, IP address, account IDs), commercial information (subscription records), internet activity (the technical data in section 2), and the content you store in the Apps, which in WWPocket may include financial information you choose to record.
• Sources and purposes: you, your device and the providers in section 6, for the purposes in section 4.
• Selling and sharing: we do not sell personal information. On Quick Checklist’s free plan, Google’s advertising cookies may count as “sharing” for cross-context behavioural advertising; you can opt out at myadcenter.google.com, or use Premium, which loads no ads.
• Sensitive information: we use it only to provide the Apps you ask for, never to infer characteristics about you.
• Authorised agents: someone you authorise may make a request for you; we will verify your identity and their authority first.

11.4 Other countries

If you live elsewhere, for example in Brazil, Canada, Australia, Singapore or Japan, you have the rights your local law gives you. Contact us and we will help you use them.