Privacy Policy

Last updated: March 15, 2026

1. What Data We Collect

• Account data: Email address used for sign-up (stored by Firebase)
• People profiles: Aliases and relationship data you enter (never real names unless you choose to use them)
• Voice transcripts: Text transcriptions of your voice notes (audio is never stored — only the text)
• Insights and feedback: AI-generated suggestions and your ✓/✗ feedback
• Daily stress level: A number from 1–10 you optionally enter each day

2. How We Use Your Data

• To generate personalised relationship insights for you
• To improve the accuracy of the insight engine using your own feedback (your data trains your own model — not a shared global model)
• To sync your data across devices via your account

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data under the following lawful bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the core service you signed up for
• Legitimate interests (Art. 6(1)(f)): Improving insight accuracy using your own feedback; security and fraud prevention
• Consent (Art. 6(1)(a)): Voice transcription and microphone access (you can withdraw at any time in device settings)

3. What We Do NOT Do

• We do not sell your personal data to third parties
• We do not use your data to train shared AI models
• We do not store raw audio recordings — voice notes are transcribed and the audio is discarded
• We do not share your data with advertisers

4. Third-Party Services

• Firebase (firebase.google.com) — encrypted database and authentication
• OpenAI Whisper API / Groq — voice-to-text transcription only; audio is not stored by these providers after transcription
• Google Gemini API — generates relationship insights; only anonymised context is sent
• Sentry (sentry.io) — crash reporting; no personal data is included in crash reports

5. Data Storage & Security

All data is stored on Firebase (Google Cloud) servers with AES-256 encryption at rest and TLS in transit. Your data is associated with your account and is not accessible to other users.

5a. Data Retention

We retain your personal data for as long as your account is active. If you delete your account or use the “Delete All My Data” feature, all your data is permanently erased from our servers within 30 days. Anonymised, aggregated usage statistics (no personal data) may be retained for service improvement.

6. Your Rights

• Access (Art. 15 GDPR): You can view all your data in the app at any time
• Deletion / Erasure (Art. 17 GDPR): Use “Delete All My Data” in Profile → Privacy to permanently erase all your data. Your account and all associated data will be deleted immediately.
• Rectification (Art. 16 GDPR): You can edit your profile and relationship data directly in the app
• Portability (Art. 20 GDPR): Contact us to request a machine-readable export of your data
• Restriction (Art. 18 GDPR): You can request restriction of processing by contacting us
• Objection (Art. 21 GDPR): You can object to processing based on legitimate interests by contacting us
• Withdraw consent: For microphone/voice features, withdraw in your device's app settings at any time
• Lodge a complaint: You have the right to lodge a complaint with your local data protection authority (e.g. your national DPA in the EU)

To exercise any of these rights, contact us at privacy@woven.app. We will respond within 30 days.

7. Children's Privacy

Woven is not directed at children under 13. We do not knowingly collect personal data from children under 13.

8. Changes to This Policy

We may update this policy occasionally. We will notify you in the app when we make significant changes.