Privacy Policy

woow.one ("we", "us", or "our") operates an invitation-only private messaging network accessible via the woow.one iOS application. This Privacy Policy describes how we collect, use, and protect your information when you use our service.

By creating an account and using woow.one, you agree to the practices described in this policy.

1. Information we collect

We collect only the minimum information necessary to operate the service:

• Email address — used to create your account, send verification codes, and communicate service-related updates.
• Purchase receipt — used to verify your App Store membership purchase. We do not store full payment details.
• Matrix username — automatically generated from your email address at account creation.
• Device information — collected at login for security purposes (device type, approximate location based on IP address, timestamp). This is shown to you in the verification email so you can identify unauthorized access attempts.
• IP address — processed to deliver messages and for fraud prevention and security logging.

2. Message content & encryption

woow.one is built on the Matrix protocol with end-to-end encryption. We cannot read your messages. Message content is encrypted on your device before transmission and can only be decrypted on the devices of the intended recipients. On our servers, your messages exist only as encrypted ciphertext that we are unable to decrypt.

Your recovery key never reaches our servers. Your encrypted message history is protected by a personal recovery key. This key is stored exclusively in your iCloud Keychain, where Apple keeps it end-to-end encrypted and syncs it privately across your own Apple devices. We never transmit, receive, or store this key — so neither we nor anyone who might compromise our servers can decrypt your message history.

If you disable iCloud Keychain and have not separately saved your recovery key, your message history cannot be restored on a new device. This is an inherent trade-off of genuine end-to-end encryption: the same protection that stops us from reading your messages also prevents us from recovering them for you.

Push notifications contain no message content. A notification only signals that new activity is available; your device then fetches and decrypts the content locally. Apple's Push Notification service and our push gateway never see the contents of your messages.

We do not store, analyze, sell, or share the content of any private conversations.

3. How we use your information

• To create and manage your account
• To verify your identity during login
• To process your membership via Apple's App Store
• To send you verification emails and security alerts
• To maintain the security and integrity of the network
• To display anonymized aggregate statistics (total member count) on our website

We do not use your information for advertising, behavioral tracking, or profiling.

4. Data sharing

We do not sell, rent, or share your personal information with third parties, except:

• Apple Inc. — to process in-app purchases via the App Store, and to deliver push notifications. Apple's privacy policy governs their handling of this information.
• Email delivery provider — your email address is used solely to send transactional emails (verification codes, security alerts). No marketing emails are sent without explicit consent.
• Legal requirements — we may disclose information if required by law or to protect the rights and safety of our users.

5. Data retention

We retain your account data for as long as your membership is active. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law.

Verification tokens expire automatically after 15 minutes and are permanently deleted after use.

6. Security

We take the security of your data seriously. Measures include:

• All data transmitted over HTTPS/TLS encryption
• End-to-end encryption for all message content
• Recovery keys are stored only in your device's iCloud Keychain, never on our servers
• Email-based two-factor verification for every login
• Passwords are never stored in plain text
• Login attempts include device and location information sent to you for verification

7. Your rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Withdraw consent at any time by canceling your membership

To exercise any of these rights, contact us at privacy@woow.one.

8. Analytics

Our website (woow.one) uses Plausible Analytics, a privacy-respecting analytics tool. Plausible does not use cookies, does not collect personal data, and is fully GDPR compliant. No consent banner is required.

The woow.one iOS app does not contain any analytics SDK or tracking library.

9. Children

woow.one is intended for adults aged 18 and older. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us immediately.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions or requests, contact us at:

privacy@woow.one
woow.one
woow.one