Wonaby privacy policy

Wonaby is a private journal. Most of it never leaves your phone, and what you write is sealed before it goes; the few sync details we can read are listed below. This page says exactly what we hold, why, and what you can ask us to do about it.

It covers both the Wonaby app and the wonaby.com website. Where the two differ, we say which one we mean.

Who we are

Wonaby is operated by Alevit Digital Solutions L.P. (ALEVIT DIGITAL SOLUTIONS Ε.Ε., a Greek limited partnership), trading as Wonaby, registered in Greece (registered address: Ektos Oikismou 0, Kato Archanes, 70100 Heraklion, Crete, Greece; company number (GEMI): 174552327000). We decide what personal data Wonaby collects and why, which makes us the data controller under the GDPR.

We are not required to appoint a Data Protection Officer and have not appointed one. Everything on this page reaches a person at support@wonaby.com. Requests about your data go to privacy@wonaby.com; either address works.

What we hold in the app

Your journal, sealed. Your moments, photos, day notes, recaps and Ask Wonaby conversations, and the names you give your own tags, are encrypted on your phone with a key locked by your recovery code. We hold the sealed version so it can reach your other devices. We cannot read it, and neither can anyone who obtains a copy of our database. If you add a passkey, we also hold its identifier and a copy of that key sealed by the passkey, which we cannot open either; the passkey itself stays in your password manager.

Sync details, unsealed. To keep your devices in step we also hold, readable: when each moment, day note and recap was made, and their order; which tags each moment holds; the life area, the icon and a short label made from the name of each tag you add (a tag called "Therapy" is stored as therapy); and the size of each photo with a tiny blurred placeholder of it. None of it contains what you wrote in a moment.

Your account. Your email address, so you can sign in and we can reach you. Your first name and the answers you gave during setup, if you gave them; those two are sealed the same way your journal is, so we hold them without being able to read them. The one exception is usage data: if you choose to share it, your setup answers also reach our analytics provider, as described below. Your first name never does. Your profile picture, if you set one, is sealed the same way. Your theme choice is stored with your account, unsealed, so it follows you to a new phone. If you sign in with Google, Google also sends us the name and profile picture link on your Google account; we use only the email address, and the rest sits unused in our sign-in provider's records until you delete your account.

Your plan. Whether you subscribe, which plan, and when it renews. Payments are handled by Google Play; we never see your card. Two days before a free trial turns into a paid plan, we email your account address to say the trial is ending and how to cancel it, and your phone shows the same reminder; we keep a record that the email was sent. A trial you have already cancelled gets no reminder.

Plan analytics, for every account. Whether or not you share usage data, our analytics provider, PostHog, receives your account's plan details so we can count how many people start a free trial, become subscribers and leave. These are: your account id; when the account was created and last changed; whether you finished setup; your plan and its state, such as on a free trial, paying, cancelled or expired; the store and product; the renewal, cancellation, refund and expiry dates; and, if you switched usage data off, when you did. RevenueCat, which manages subscriptions, also sends PostHog an event when a trial starts, converts or is cancelled, and when a subscription is bought, renewed, cancelled or ends, with the price, the currency and the store's order numbers. None of it includes your email address, your setup answers or anything about your journal, and nothing in it decides anything about you: no price, no offer, no message. If you also share usage data, these details sit beside it in the same profile. You can object at any time; see Your rights.

Usage and crash data, only if you allow it. After you sign in, Wonaby asks on a screen of its own whether you want to share usage data. If you tap "Share usage data", we record which features you use, such as a moment being saved or a recap being opened, crash reports, and the answers you gave during setup: what you want from Wonaby, how you remember, your age range, your gender, and the areas of life you picked, except Body, Mind, Relationships, Food, Money and Free time. All of it is linked to your account and your email address. It never contains anything you wrote. If you tap "Don't share", nothing is recorded, and we ask once more six months later. You can switch it on or off at any time in Settings, and switching it off on one phone switches it off on all of them. The analytics tool stores nothing on your phone. We keep a record of each choice you make here (your account id, the date, and where you made it).

Your reminders. The time of day and the days you asked to be reminded, so the schedule follows you to a new phone. The reminders themselves are set on your phone and fire from it. We do not send notifications to your device.

What we hold on the website

Analytics, only if you accept it. If you accept analytics in the cookie banner, Google Analytics records page views, referral source, browser and device type, and approximate country. Advertising features are switched off and IP addresses are not stored. Until you accept, no analytics cookie is set.

Server logs. Our host records request metadata, including IP addresses, for security and troubleshooting.

What we hold when you email us

Email you send us. When you write to support@wonaby.com, privacy@wonaby.com or any other wonaby.com address, we keep your message, the address you sent it from, anything you attach, and our replies. If you start the email from inside the app, the app fills in its version, your phone's model and its operating system version so we can reproduce a problem; you can delete those lines before you send. We use your email only to answer you and, for a request about your data, to show that we answered it. Deleting your account does not delete email you sent us. Ask at privacy@wonaby.com and we delete it, except a request about your data and our answer, which we keep for the time set out below.

What we never hold

The on-device AI reads your entries on your phone. Nothing you write is sent to us or to any AI provider to generate your day notes, recaps or Ask Wonaby answers. Wonaby runs no cloud model. Dictation without Wonaby's voice model uses your phone's own speech service, described under Dictation below.

Settings that only affect your own phone, such as your gallery preference and your voice quality, stay on it. We never receive them.

Full-quality photo originals stay on your device. Only a smaller display copy is synced, and it is sealed like everything else.

We do not sell your data. We do not serve advertising, do not share your data with anyone for advertising, and do not track you across other websites or apps. We do not make automated decisions about you that produce legal or similarly significant effects.

Why we are allowed to hold it

Withdrawing consent does not affect anything we did lawfully before you withdrew it. Where we rely on legitimate interest, we have weighed our interest against yours, and you can ask us at privacy@wonaby.com for information on that balancing test.

About the AI

Wonaby's recaps, the daily recap at the top of each day note and Ask Wonaby answers are written with an AI model that runs on your own phone. In a recap, the AI writes the opening and short details, each from one of your entries, and the app writes the rest by fixed rules. You are interacting with an AI system whenever you read text the AI wrote, and everything it writes is generated, not written by a person. The observations in a day note and your patterns are worked out on your phone by fixed rules from what you recorded, with no AI model involved.

The model is downloaded to your device and runs there. Your entries are the input, and they never leave the phone to produce that output. AI output can be wrong or incomplete; it is not advice, and it is not a substitute for a doctor, therapist or any other professional.

Every recap the AI wrote part of, the daily recap at the top of a day note included, and every Ask Wonaby conversation carry a label saying the AI wrote them, so you always know which words are its own, and the app also tells you this the first time you open Ask Wonaby. A recap the app writes on its own, without the AI, carries no label. If an answer or a recap the AI wrote looks wrong, Report opens an email for you to write and send. Wonaby attaches nothing to it: the only part of the answer we see is the part you paste in yourself, and nothing is sent until you send it.

Dictation without the voice model

Wonaby's own voice model turns speech into text on your phone. It is part of Pro and you download it in Settings. Without it, or if you choose your phone's built-in dictation, Wonaby hands the listening to the speech service your phone provides, on most Android phones Google's. If your phone has an offline speech model for your language, the recognition happens on the phone. Otherwise that service may send the audio to its provider's servers to turn it into text. The provider handles the audio under its own terms and privacy policy, not ours: we have no agreement with it, never receive the audio and cannot see what it keeps. Wonaby receives only the finished text, which is sealed like the rest of your journal. To keep your voice on your phone, download the voice model in Settings, or turn dictation off.

Who else touches it

Each provider does one job, under a data processing agreement that meets GDPR Art. 28.

Sending data outside Europe

Some providers above operate outside the European Economic Area. Where personal data goes there, we rely on the European Commission's Standard Contractual Clauses, or on the provider's certification under the EU-US Data Privacy Framework where it holds one. PostHog stores app usage data in the EU, and its staff in the United States can access it: that access relies on PostHog's certification under the EU-US Data Privacy Framework, with the Standard Contractual Clauses as the fallback. RevenueCat processes subscription data in the United States under the Standard Contractual Clauses. You can ask us for details of the safeguards that apply to a particular provider.

How we protect it

Your journal is end-to-end encrypted on your device before it reaches us, so the strongest protection is one we cannot undo for anybody, ourselves included. On top of that: everything travels over encrypted connections, the local database on your phone is encrypted at rest, row-level security in the database means one account can only ever read its own rows, and access to production is limited to the people who need it.

How long we keep it

Deleting your account removes your account, your sealed journal and your files, and deletes your usage data, your plan analytics and your profile at our analytics provider.

Switching usage data off, in Settings on any phone or by writing to privacy@wonaby.com, stops it on every phone and deletes your past usage data. The phone you switch it off on stops at once, and each of your other phones stops the next time it opens Wonaby. Within about two hours we send our analytics provider the request to delete your past usage data, and it completes that deletion in its weekend deletion run.

Your rights

You can ask us to give you a copy of your data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict how we use it (Art. 18), hand it to you in a portable format (Art. 20), or object to our using it (Art. 21). You can withdraw consent at any time (Art. 7(3)). We answer within one month.

Getting a copy is built in. Tap your picture on the Home screen to open your Account, then Privacy and data, then Export your data. Wonaby builds a file containing your moments, photos, day notes, recaps, tags and conversations, and hands it to you. Two things to know about it:

• The file is not encrypted. Anyone who opens it can read everything in it, so keep it somewhere you trust.
• If some of your photos are not on the phone you are exporting from, Wonaby downloads them. There is a daily limit on how many it will fetch. If you hit it, the export still completes, the file lists which photos are missing, and running it again the next day collects the rest.

Deleting is built in too. Tap your picture on the Home screen to open your Account, then Manage account, then Delete account. It removes your account and everything we hold for it, right away. If you no longer have the app, wonaby.com/delete-account explains how to ask us instead.

Objecting to plan analytics. Write to privacy@wonaby.com and we stop it, with no reason needed and no argument from us. Your account is left out of what our analytics provider receives, its plan details there are removed within 24 hours, your profile and its events are deleted in our provider's weekend deletion run, and if you share usage data, that stops on every phone too.

You can also just ask us. Write to privacy@wonaby.com and we will send you everything we hold about you, free, within one month. This route has no limits of any kind, and using it is never a reason for us to charge you or turn you down.

If you think we have handled your data badly, you can complain to a supervisory authority: ours is the Hellenic Data Protection Authority (dpa.gr), and you may also complain to the authority in the EU country where you live or work. You can find yours at edpb.europa.eu.

Cookies on the website

Cookies are small text files stored on your device. The website keeps your cookie choice in your browser's local storage instead, which works much like a cookie. Manage your choice at any time through the Cookie Settings link in the site footer.

The app sets no cookies. Its analytics are asked for on a screen after sign-in, and nothing is collected or sent before you tap "Share usage data".

If you lose your recovery code

Your journal is encrypted with a key only you hold. If you lose your recovery code, have no passkey you added for Wonaby, and no phone of yours still has Wonaby unlocked, we cannot unlock your entries for you: there is no copy of that key on our side and no reset we can perform. This is the cost of the guarantee that we cannot read your journal either. Export a copy while you can still open the app.

Children's privacy

Wonaby is intended for people aged 16 and over. We do not knowingly collect personal data from anyone under 16.

European data protection law lets each country set its own minimum age for using a service like this, anywhere between 13 and 16. We apply the strictest of those ages everywhere, so the answer is the same wherever you live: 16.

On Android, where the law requires it, as in Brazil and Texas, Wonaby asks Google Play for your age range when the app opens. Google Play answers with a range, never a birthdate. Wonaby uses the range only to decide whether the app can open, keeps only that decision on your phone, and never sends the range to us or to anyone else.

If you believe someone under 16 has created an account, contact us and we will delete the account and everything in it.

Changes

When this policy changes we update this page and the date at the top. Substantial changes are announced in the app before they take effect.

Contact

support@wonaby.com, or privacy@wonaby.com for anything about your data

---