Woosh ("we", "us") is operated by ViVeCo BV (enterprise number BE 0797.030.687, Belgium). This policy explains what personal data we collect, why, and how it is used.

• Phone number. Used to authenticate your account and deliver a one-time login code over WhatsApp or SMS, and — if no Woosh app is installed on your phone — to send notifications and occasional reminders as text messages. On a private event — one that isn't public, shown to people nearby, open to anyone with its link or shared into a public group — everyone who joined the guest list while it was private sees the phone numbers of the others who did, as in a messaging group. The same holds in a private group with no share link switched on: everyone who joined while it was like that sees the numbers of the others who did. In a direct chat, or a chat started with people picked one by one, its members see each other’s numbers. On any other event or group, your number reaches only your friends, whoever added you by it and a group’s admins.

• Your date of birth. Asked when you sign up, to check you are old enough for Woosh. Nobody else sees the date. Unless you switch off “Share my birthday with friends” under Privacy, your friends see the day of your birthday in their list of upcoming birthdays and in their calendar — including a calendar feed they have added to another calendar app — and get a reminder on the day, and two weeks before if they ask for it. The day only, never the year or your age. A child account that a parent manages is never announced. The date is deleted with your account.

• Contacts you choose to import. If you grant permission — from your device address book or by connecting Google Contacts — the contact details themselves (names, email addresses, phone numbers, and photos) stay on your device. To show you which of your contacts are already on Woosh, we send their phone numbers to our server, which keeps only a salted, irreversible hash of each number — never the raw number, name, email address, or photo. We also use those hashes to tell which Woosh users are in your contacts, for the privacy settings that open you up to the people in your contacts: finding you by number, adding you to a group or event, and seeing your name and picture. When you ask Woosh to send someone an invite by email or text — to an event, to a group, or to be your friend — we store that person's email address or phone number, which invite it was for and when it went out, so we can deliver it, send one reminder if they have neither opened it nor joined (sooner if you ask for it), offer that address or number when they sign up through it, limit how often anyone is contacted, and stop if they ask us to. When you type a number to add someone to a group, an event or a chat and their own settings do not allow it, we keep a request — who asked, who is asked and what for — so they can accept or decline; for a chat and a number with no account, we keep a keyed, irreversible code of the number instead, so the request can reach them if they sign up. A request lapses after 14 days and is deleted 30 days after it was answered or lapsed. So you can see your own invites to an event or a group, we also keep a short hint of it — the last three digits of a number, or the first letter and the domain of an address — for 30 days, then delete it. Once it has none of those uses left — straight away for an invite that never went out, otherwise 90 days after it was sent or when the event is over, whichever is later — we replace it with an irreversible code that only lets us keep to those limits. When you remove someone from the people we suggest or offer to invite, we keep a note of it so they stay removed on your other devices: for someone on Woosh, their account; for a phone number, the same kind of keyed code we use to match your contacts; for a contact you can reach only by email, a code your device makes from the address with a key that belongs to your account alone, so the address itself never reaches us. Putting them back under Removed people, or deleting your account, deletes that note. When you send an event invite through WhatsApp or a text message to a contact who is not on Woosh, we store that contact's phone number with the event, so the event knows who it is waiting for and the number joins it if they sign up. On a private event its guests see the number, each phone naming it from its own address book — the name you saved for them is never sent; on any other event, only you see it. We delete it when they join, when the event is over, or 90 days after the invite, whichever comes first. When you invite someone who is not on Woosh — whether we text the invite or you send it from your own WhatsApp or text messages — we also keep a friend request from you to their phone number, so it is waiting if they sign up with that number. It shows among your sent requests once they sign up, and stays until it is answered, you withdraw it, or you delete your account.

• Calendar events you choose to share. If you connect Google Calendar (web) or grant calendar access (mobile), Woosh reads upcoming events from your primary calendar so it can suggest plans you might want to share with a group. Calendar read data is processed on your device and is not stored on our servers; only events you explicitly attach to a Woosh event are saved server-side. If you also turn on automatic calendar sync, we store a long-lived authorisation token from Google on our servers so we can keep your calendar in step with your RSVPs — details below. A calendar you add under Calendars is different: see "Calendars you add".

• Calendars you add. Under Calendars you can add a calendar by its link, or your Google calendar (see Google user data below). We read it when you add it and about every hour after that, and keep its appointments from a month ago to a year ahead: their times, and their titles and places encrypted at rest. The link is stored encrypted and is never shown again, to you or anyone. A calendar you add there is yours: nobody sees it until you share it into a group, either in full (titles, places and the calendar's name) or as busy only (just the times, and nothing the calendar marks as free). A link you add from a group's calendars is that group's: every member sees its appointments and that you added it. Reading a link means our server fetches the address in it, so whoever runs that address sees a request from Woosh, nothing about you. Removing a calendar deletes our copy; leaving a group withdraws what you shared there; deleting your account deletes the calendars that are yours (a group's calendar stays with the group). A group's calendar can be marked as being about one member — a child's Smartschool school agenda, for example — so it shows under them in the agenda; every member of the group sees that. From a Smartschool link we keep, as from any link, only each appointment's times, title and place — never its description, where the school may list who takes part.

• Calendar links you subscribe to. Each member gets their own private links to a group's agenda (its appointments and task due days — or only those that concern them) and its week menu, for the calendar app on their phone. Anyone holding such a link can read what it shows without signing in, so keep it to yourself; you can reset it at any time, and it stops working the moment you leave the group, after which we delete it. You can also have one personal link, under Calendars, carrying the appointments you go to or are about and the dated tasks that are yours across all your private groups and your own space; it follows the same rules, and leaving a group takes that group out of it at once.

• Your work days. Under Work days you can note where or when you work — a place's name and usual hours, the weekdays and dates. They are shown only in the groups where you switch them on, to that group's members, and never to anyone you have blocked or who has blocked you. They create no tasks or reminders. You can remove them at any time, and they are deleted with your account.

• Arrival replies. Around an event's start you can tell its chat you are on your way, running late or can't make it. If you turn on “Send automatically”, our servers use your location updates to send the first two for you: they note how far you are from the event when its start nears, send “On my way” once you are clearly heading there and “Running late” if you are still away at the start, and note when you arrive. Only the message goes to the event's chat; your position itself is not shared. While you are on your way, the event's guests see that and, when you turned this on or said how late you are, a rough arrival time — except anyone you hide your presence from. If you share your location with the event until you arrive, we also use it to notice your arrival and end that share. Otherwise, saying you are on your way by hand uses no location. We keep the distance, the times and the estimate on your answer to that event, clear them when you decline, and delete them with your answer or your account. Automatic sending is off unless you turn it on, for one event or all of them.

• Questions to a host. Once you have signed in, you can ask an event's hosts a question from its page. That opens a private chat between you and them: they see your name, your picture and what you write, and you see theirs, except on an event whose page does not show who hosts it, where they answer as the event; neither side sees the other's phone number unless you are friends, and nobody else can be added to the chat. Either of you can leave it or report a message, as in any chat, and block the other unless the hosts answer as the event. It is deleted with the event. A host can turn questions off in the event's settings.

• Your notes In a group's Out of my head you can jot down what's on your mind — typed, spoken or as a photo. A note is seen only by you unless you share it, with members you choose or with the whole group. They can read it, photo included, and turn it into a task or a shopping item; only you can change it, change who sees it or delete it. Making it private again hides it from them at once, and it is never shown to someone who has left the group, or to anyone you have blocked or who has blocked you. Notes are deleted with your account.

• Pictures and videos you share. We keep them in HD: a picture at most 2048 pixels on its longest side, a video at 720p. When a picture or video you share in a chat, an event or a group reaches us larger, we replace it with its HD copy and delete the full-size file. Animated pictures, very large files and videos we cannot convert are kept as sent. If your plan includes original quality and you chose it under Upload quality, we keep what you send as it is. Something sent as a file is always kept as sent.

• Who took a picture. When you post a picture or video in a group or an event, you can say who took it, if that was someone else in that group or event. Everyone who can see the picture then sees that person's name on it, the same name the app already shows them elsewhere; the picture stays yours. Only you can set or change it, except on pictures an iPhone copies in from a shared album: there we keep the album's name, whose phone syncs it and who took its pictures, so the people in that group or event can see where they come from, and that credit applies to every picture the album added; whoever syncs the album, or whoever runs the group or event, can set or change it. That record goes when whoever syncs the album disconnects it, when the group or event is deleted, or when the account of whoever syncs it is deleted. The person you named can remove their name at any time, and it goes when their account is deleted.

• Who added a shared album's pictures. When an iCloud shared album is linked to a group or an event, Apple's public album page names who added each picture. We keep that name with the picture's place in the list so the people in that group or event can see who took it, and we match it to one of them when exactly one has that name; whoever linked the album, or whoever runs the group or event, can change the match, and the person matched can remove their name. The person named may not be on Woosh. Only the group or event sees these names, they are never written to our logs, and they are deleted with the link.

• Photos on tasks When a task in a group is ticked off, anyone who can see the task may add a photo to it — a tidied room, say. Everyone who can see the task sees the photo; a task kept to yourself keeps it to you. The photo stays with the task, which belongs to the group, so deleting your account does not remove it. Removing the photo, unticking the task or deleting the task deletes the photo.

• Photos from your events During and after an event you go to, the app can look on your phone for the photos you took there, by when and where each one was taken. This happens on your phone and sends nothing. It looks only if you have already given the app access to all your photos, and it never asks for that access itself. If it finds photos, it offers them all in a notification, and nothing is uploaded until you choose the photos to add. Our servers store only that your phone made this offer for that event, so that you are not sent a second reminder. After the event that record says nothing about whether it found photos; during the event it is kept only when it found some, never how many. That record is deleted with the event or with your account.

• Children's badges In a group, a child earns badges from the tasks they finish there. We store which badges a child earned in that group, and when. The child sees their own; so do the group's other members, except other children. They are deleted with the child's account or with the group. If the child leaves the group, the badges are kept but no longer shown to anyone.

• Somebody invited by text A host can put somebody they texted an invitation to a group or event on that group's or event's shared expenses or gift draw before that person has a Woosh account. For that person we keep which group or event it is, a keyed hash of their phone number (never the number itself), and a name given when they were added or else the number's last three digits. People who can open the ledger or the draw see that name, the person's share and their place in the draw; the digits are shown only to whoever added the person, and everybody else sees who added them. We tell the person by text message that they were added, or that the names in the draw are out, under the same limits as an invitation: the text names the ledger or the draw and who added them, never an amount or who anybody drew. We keep this until that number creates an account; everything it held then becomes the account's, and the name and digits are deleted.

• Your own space In To-do you can keep your own tasks, shopping list and other lists in a space only you can open. What is in it is seen only by you unless you share it — the shopping list, one of your other lists, or one task — with friends you choose or with one group you are in. They can read it and tick it off; only you can change it, change who sees it or delete it. Making it private again hides it from them at once. A share with friends holds while you are still friends, and a share with a group while you are both still in it; nothing is ever shown to someone you have blocked or who has blocked you. Your space is deleted with your account. An AI assistant you connect with permission for your own To-do, and Ask Woosh, can read and change it for you, as described under AI assistants.

• Recommendations In a private group, members can recommend a public place or a business by name, such as a plumber or a bike shop, with a category and one line saying why, and vouch for each other's. We store the recommendation, who added it and who vouches for it, and the group's members see them. The author's name is shown only to members who can see them in the group's member list, and a recommendation by somebody you blocked, or who blocked you, is not shown to you. A recommendation is for a business or a public place, never a private person: there is no field for anyone's phone number, address or email. The member who added it can change it; they or one of the group's admins can remove it, and deleting the group removes them all. If its author deletes their account, the recommendation stays in the group without their name, and their vouches are deleted.

• Approximate and precise location. If you grant permission, we use your location so friends can see you on the map. You can revoke this in your device settings at any time. If you share your location outside Woosh, from the map's location control, we store the spot your phone reports at that moment, with its street name, encrypted, and a map picture of it. Anyone who has the link can see that spot and the time on a web page, without an account, and the app you send it through keeps the preview it shows. The spot never updates. We delete it and its picture after 30 days, or with your account; replacing your invite link stops the link from opening. When you shout, the shout names the public place Woosh has matched you to, such as a bar or a restaurant, unless you remove it before posting. A shout from a place you are at also checks you in there, the same as tapping Check in: the place counts your visit, and the people allowed to see your check-ins see you on its board. This never happens if you have switched off sharing or recording your location. An event with a place but no picture shows a map of that place on the Events tab: to draw it, our servers send Google Maps the place's position and nothing else about you or the event, and keep the map picture.

• Check-ins If you stay a few minutes at a café, bar, restaurant or a similar public place, Woosh checks you in there, unless you switch off “Check in automatically” under Location privacy. A check-in records the place and the day. Friends who can see your location there see it on your profile and on the place's ranking, and can join you there; people who aren't your friends see it on rankings only if you switch on public place rankings. While you're checked in at a place and there, the others checked in there at the same moment, friends or not, see your first name and profile picture, or only your first name, as you choose under “People here”; with Nobody they don't see you and you don't see them. They never see where exactly you are, and nobody under 18 is shown to anyone but friends. Nobody is checked in automatically while hidden from everyone or sharing or recording no location at all, nor on a child account. You can remove your check-ins at a place, and they are deleted with your account.

• Recorded activities and health data. A run, ride, walk or hike you record in Woosh is stored with its route. Only you see the whole route; a post shows it with the part near your own places cut off, unless you turn that off. If you allow it, Woosh saves the activities you record to Apple Health or Health Connect, and reads the workouts another app or your watch recorded there, with their route and heart rate, to save them to your activities: one you pick, or every new one once you turn that on. Your heart rate is shown only to you. Deleting an activity deletes what we stored for it; the copy in your health app stays until you delete it there. Health data is never used for advertising. If you share a posted activity by its link, anyone who has the link sees that post with the activity's numbers and the cut route on a web page, without an account, until you turn the link off or delete the post.

• Trips. A trip keeps its name, dates and cover, the entries the travellers add with their pictures and places, and the route of each traveller who turns recording on. If you share your part of a trip by its link, anyone who has the link sees, on a web page and without an account, the trip's name, dates and cover, your own entries and your own route, with the part near your own places cut off. The last day of the route is never shown, and an entry pinned near one of your own places shows without its place. Nothing another traveller added is in it. While you have chosen never to share or never to record your location, it shows your entries without your route. Turning the link off, leaving the trip or the trip being deleted stops it from opening. A traveller can also invite people with a link: whoever opens it sees the trip's name and who sent it, and joining puts them on the trip as invited and connects them as friends with the sender.

• Polls. A poll you make on its own keeps its question, its answers and who picked each one. Anyone you send its link to sees the question, the answers and how many picked each, on a web page and without an account. Answering needs an account, and only you see who answered what. When you answer someone else's poll, the person who made it sees your first name and profile picture, unless you have narrowed who sees them. Deleting the poll deletes its answers, and its link stops working. Deleting your account deletes your polls and every answer you gave.

• What you're listening to. If you switch on Now playing, Woosh reads the song you're listening to (its title, artist and album, and which music app plays it) and shows it with your status to the people you choose. Someone who can't see whether you're around never sees it either. On Android this needs notification access, which you grant on a system screen: Woosh reads only the player of Spotify, YouTube Music, Apple Music, Deezer, SoundCloud, Tidal and Amazon Music, and never the content of a notification. On iPhone it reads what plays in the Music app, only while Woosh is open, once you allow Apple Music access. For a song from Apple Music, its title and artist, with your country, are looked up in Apple's iTunes catalog to show its cover. We keep only the song playing now, never a history: each song replaces the last, and it disappears a few minutes after the music stops. Podcast episodes from Spotify are never shared. If you connect your Spotify account, our servers ask Spotify about once a minute, while Now playing is on, which song you're playing. Spotify gives us access to that and to nothing else in your account; we keep that access encrypted and delete it when you disconnect.

• Home-screen widgets. On a phone that supports Woosh widgets, the app keeps a snapshot of what the widgets show on the phone, whether or not you have added one: what's on, live shouts, recent activity, and for the nearby widget the friends close by and your own position for its map. A widget refreshes the live shouts from our servers with your existing sign-in, and signing out clears the snapshot. The Today and Shopping list widgets read your tasks due today, or the list you picked, from our servers with that same sign-in each time they refresh, and show nothing of yours once you sign out; tapping a row's circle ticks it off, just as it would in the app. The Group widget reads the names and pictures of your groups from our servers with that same sign-in, to let you pick one and to show the one you picked, and shows nothing of yours once you sign out. On the iPhone Lock Screen a widget shows counts and symbols only, never a name or a picture; a control there shows the name of one of Woosh's own tools.

• Email address. Optional, and only if you give us one. Once you confirm it, we use it to send you the notifications you choose to get by email, and as a way to reach you when your phone number cannot be used — for example where we are unable to send a text message. It is never shown to other people, never sold, and you can remove it at any time from your profile.

• About you. Optional, and only what you add: a one-line bio, up to ten interests and a cover picture, shown on your profile together with the month you joined Woosh. You choose who sees each of them under “On your profile” in Profile & contact; the month you joined is shown to your friends only until you change that. A child account that a parent manages shows them to its friends only. Removing one takes it off your profile, and all of them are deleted with your account.

• Technical data. Standard request logs (IP, user agent, timestamps) for security and abuse prevention.

• Usage statistics. When you use Woosh, our servers record each request the app makes for you and a few moments such as opening the app or signing in: which kind of address in our service it went to (such as "an event" — never which event, and never its content), when, how long it took, whether it worked, and which platform and app version made it. While you are signed in, the app also tells them which kind of screen you open (such as "an event" — never which one, and nothing shown on it). For notifications, they record which channel carried each one, which kind of notification it was, its language and length, and whether it arrived and was opened or tapped — never its text — and, when we do not send one, why (for example because you muted the sender or switched that kind off). These records carry your account id — never your name, phone number, location or messages — and are used only to understand how Woosh is used and to keep it fast and reliable. They also feed a per-account summary: your sign-up day, how many friends you have, the day you were first in a group, first had a friend, first added a picture and first created or joined an event (the day only — never which group, friend, picture or event), whether an invite brought you, and how you found us. Request and screen records are deleted automatically after a year, notification records after 180 days. When you delete your account, these records stay until then but no longer lead back to you — the id they carry matches nothing any more — and the per-account summary is removed at its next daily update.

• Device diagnostics. To find out how much battery Woosh's location tracking really uses, the app records — at the moment it sends a location update — your battery percentage, whether the device is charging, whether it is in a power-saving mode, and which tracking-accuracy setting is active. This is never linked to a position, is kept for 90 days, and is used only to improve the app.

• How you found us. If you arrive on our website through a link that says where it came from — one tagged for a campaign, an ad or a newsletter, or simply a link on another site — we note that campaign's tags (its source, medium, name, content and term), which ad platform the link came from (never the ad click's own identifier), which kind of page you landed on, and the name of the site that linked to you (never the address of its page). This is held only in the open page and in the sign-up links on it — nothing is stored on your device for it, beyond those links' addresses in your browser's own history — and it is saved with your account only if you create one during that visit, so we can see which campaigns bring people who stay. It is never sold or shared with advertisers, and it is deleted with your account (from our internal statistics at their next daily update). If you install the app from Google Play through such a link, Google Play passes the same tags to the app, which sends them, with when the app was installed, when you create your account. Nothing is stored on your phone for it.

We use this data to provide the service: log you in, match you with friends from your contacts, show real-time presence, and operate the app securely. We do not sell your data.

Woosh uses WhatsApp — through Meta’s WhatsApp Business Platform and our messaging provider Twilio — for two things. First, to deliver one-time login codes to the phone number you enter on the sign-in screen: by entering your number and tapping "Send Code" you consent to receive that message. Second, if no Woosh app is installed on your phone, to deliver a notification that has nowhere else to go — an invitation to an event, a message someone sent you — rather than the more expensive text message we would otherwise send. To deliver either, Meta and Twilio receive your phone number and the content of the message. We do not send marketing or promotional WhatsApp messages, and you can stop the notifications at any time by replying STOP, which stops text messages too, or by switching them off in Settings under Notifications.

If no Woosh app is installed on your phone, a notification that has nowhere else to go may be sent to your phone number as a text message, through Twilio, when we cannot reach you on WhatsApp — and so may reminders we send on our own initiative, including a single one, once ever, if you made an account and never installed the app. To deliver it, Twilio receives your phone number and the text of the message, which for a notification can include a sender's name, a preview of what they sent, or where a friend is. These sends are limited: we cap how many you can receive in a day, we do not send during night hours in the timezone we have on record for you (UTC if we have none), and we never send to someone who has switched them off — in Settings under Notifications, or by replying STOP. We keep a record of each message: when it was sent, what kind it was, and the provider's reference, which is what lets us enforce those limits, see whether delivery worked, and understand how notifications are delivered overall; we do not keep the message text. Safety alerts are exempt from the daily limit and the night window, as they are in the app.

Woosh sends email only for your account and the things you take part in — confirming an address you gave us, and the notifications you choose to get by email (event updates and group invitations are on to start with). You choose which notifications arrive by email in Settings → Notifications, and every one of those emails has a link to stop them. Those messages go through Resend, which receives your email address and the content of the message, and processes them on servers in the European Union. We do not send marketing email, and you can remove your address at any time from your profile.

You can connect Woosh to an AI assistant that supports connectors (MCP), so you can ask it about your plans, chats and groups, or have it act for you. You start the connection and sign in with your phone number, and the consent screen lists which of the permissions below it is asking for: you allow them or refuse. It then acts as you: it can see and do only what you could in the app, under the same privacy settings, including your friends' settings about what you may see of them.

What each permission lets it read and do:

• Chats. Read: your chat list, the messages in a chat, polls, who reacted or voted, and who has read a message you sent. Write: send, forward, edit and delete your messages, pin a place you name in a chat, react, vote, start, join, leave or clear a chat, sort your chats into your own lists, and archive, pin, mute or mark a chat unread. Manage: rename a chat you run or change how it works, add people to it or remove them, and delete a group's chat. It can also have a chat ask its members for pictures now or on a schedule, and react to a single picture of a message. It cannot open a view-once picture.

• Events. Read: your events, saved events, shouts, event files, photos and discovery, who reacted to an event, and look up a venue. Write: RSVP, say who you bring, answer a date poll, react to or mute an event, choose whether it goes in your calendar, leave a waitlist, save an event or a catalogue listing, turn a listing into an event, create an event, create or cancel a shout, join a friend where they are, add an act to a line-up, and react to or comment on photos. Manage, for events you host: edit, cancel, delete or restore them, invite people, answer join requests, change or remove participants, change the event's settings (including who sees the guest list and whether its link is open), hide it from people until it starts, run a date poll, and manage the waitlist. It can also read a video's subtitles, and add or remove them on a video you added. It can also attach one of your plans to a bigger event or make an event part of one, show an event in a group or take it out of its group, start a chat with friends about an event, say you are on your way or running late, say in your own words where you join an online event from, read your door pass and replace it, get a link that adds it to Apple Wallet or Google Wallet, see whether an event sells tickets (it cannot buy one or set a price), for events you host or check the door at, read the door list and check guests in, and, for events you host, edit the venue's points and accept a suggested move. For a shout, it can also edit yours, invite more friends to it, choose who can still find it and withdraw it, and pass on a friend's shout to your own friends or take that back. When it creates or edits an event it can also put it in your groups, present it as organised by a group you manage, attach it to another event, reuse the settings of one you host, keep it from named people, add translations of its title and description, and make it an agenda appointment that repeats. For places, it can also open a place's page, find places worth going to around a point you name, add a public place Woosh does not have yet, and search for places by what is on their menu; a menu search is kept in your recent searches. With pictures, it can also make a gallery picture the cover of an event you may edit, add a picture you sent in a chat to an event, reshare pictures from a public event, and have an event ask its guests for pictures now or on a schedule.

• Groups. Read: your groups, their chats, events, albums and photos, and their tasks, shopping list and other lists, wishlists, agenda, week menu, notes in Out of my head and shared calendars. Write: create, join or leave a group, react to or comment on its photos, add, edit, tick off, skip, react to and delete its tasks, add, rename or remove the areas they are filed under, link a task to the event it led to, add to, edit and tick off its shopping list and its other lists, say you're going shopping, add a wish to your own list or to that of a child account you manage, filled in from a product link you give it, plan and clear its meals and put them on the shopping list, start, rename and delete further lists, add an event to its agenda and set who an appointment is for, and add, share or delete your own notes in Out of my head. Manage, for groups you run: edit the group and its settings, invite people, answer join requests, change members' roles or remove them, and delete the group. It can also read a video's subtitles, and add or remove them on a video you added. It can also see who is tagged in a group's or an event's pictures and tag your friends in pictures you posted, create, rename, arrange and delete a group's albums and records, put one on the group's public page, link or unlink an outside shared album, and say who in the group or event took its pictures, and see the albums members' iPhones sync into a group or an event and say who took their pictures, and, in a group you administer or an event you host, stop someone's iPhone syncing one. It can also read a household's balance and its kids' badge boards, give your weekly check-in and your view of who carries what, change the balance's settings and pause it. It can also set up a household's first areas, stop a repeating shopping item, claim a wish for you, add or remove a menu wish, arrange your notes, take one day out of a repeating appointment, show your work days or one of your calendars in a group, mute a group, invite people to a group by email, and read, react to and comment on a group's or an event's files. It can also make a gallery picture the group's picture, reshare pictures from a public group, and start, change or stop an album that asks the group for pictures on a schedule, or take you off it. It can also read a group's recommendations, recommend a place or business there, vouch for one, and change or remove one you added. For a group you administer, it can also replace the share link with a new one, and create, link or unlink the group's public brand page.

• Profile and friends. Read: your profile, friends and their upcoming birthdays (the day only), friend requests and suggestions, mutual friends, people search, notifications, unread counts, your activity feed and your themes, what a friend's profile shows you (about, pictures, files, events, albums, shared groups, favourite places by name), your own profile pictures, saved places, achievements and what you are listening to, requests you sent and picture asks, your own updates and their archive, and roughly how far away friends are (see below). Write: edit your profile, set or clear your status, post an update and react to or comment on one, edit, re-address, pin, archive or delete your updates and their comments, pass a friend's update on, answer friend requests and take back ones you sent, mute, favourite, follow or remove a friend, send a friend an emoji or ask them for a picture, answer a request to add you somewhere, order or delete your profile pictures and pick one as your main picture, save places and choose which show on your profile, hide from the achievements board, share what you are listening to or stop, mark notifications and your feed read, and create, edit, copy, share or delete themes. It can also look up hashtags, see who viewed your updates and shouts, react to and comment on a friend's moment, and put a picture you are tagged in on your profile. It can also list your circles and create, rename or delete one. It can also read the tips you and your friends left on a place, write or delete your own tip, see a place's check-in board, and delete your check-ins there. It cannot check you in by itself, but a shout it creates for you at a place checks you in there, as any shout that names a place does. It can also list who you have blocked and block or unblock a person or a brand page, read moderation decisions about you and appeal one, resend your email confirmation, see what stands in the way of deleting your account, and see whether Strava, Spotify, Google Calendar and Polarsteps are linked, switch their automatic posting on or off, choose who a followed trip's steps go to, and disconnect them. It cannot link one, and it cannot report someone.

• Shared expenses. Read: your shared expense ledgers and who owes what. Write: add an expense and record a payment. It can also start a ledger, mark it ready to settle or reopen it, propose a correction to a payment someone else recorded, and approve, decline or withdraw such a proposal.

• Your own To-do. Read: your To-do (your own tasks, shopping list and other lists, and what every group has for you), what friends shared with you, your work places and work days, and the calendars you added. Write: add to, edit, tick off, skip and delete your own tasks and the areas they are filed under, add to and tick off your own lists, tick off what was shared with you, and add or remove work places and work days. It can also see and change who your To-do or one of its lists is shared with, move one of your tasks into one of your groups, and rename one of your calendars.

• Trips. Read: your trips and the trips your friends show you, with their entries, plans and packing lists, and the figures of a trip's route. Write: start, edit and delete your trips, add, edit and delete entries, plan items and packing items (an entry or a plan item can carry a place you name, with its position), invite friends, accept or decline an invitation, leave a trip, take someone off a trip you started, and follow a trip.

• Workouts. Read: your workouts and their figures, your totals, and your workout privacy zone. Write: add a workout from a route you give it, delete a workout, and change your workout privacy zone.

• Files you give it. Write: add a picture, a video, music or a document you gave the assistant to a group's or an event's pictures or files, and set the picture of a group or an event you run. The assistant sends the file straight to our storage; from then on it is kept, shown and deleted like one you added in the app. It can also say who took a picture you posted, when it was someone else in that group or event, and change or remove that.

• Gift draws. Read: your gift draws, who is in them, your wishes, the anonymous questions, and who you are giving to. Write: set up, change, run and delete a draw, add or remove people and your children, set who may not draw whom, write your wishes, and send or close anonymous questions.

• Polls. Read: the polls you made on their own and the ones you answered, and who answered the ones you made. Write: make, answer, close and delete such a poll. It never receives a poll's link.

• Your children's accounts. Read: the child accounts you manage, the devices they are signed in on, and the requests waiting for you. Write: approve or decline a request, change a child's name, and sign a child's device out. It cannot create a child account, pair a device, switch location sharing, or see where a child is, and a child's date of birth is never given to it.

• Where you have been. Read: the places Woosh recorded you at, your day and month recaps, which countries you were recorded in and when, and how much of the map you and your friends have uncovered per country. Write: remove a place from your history, choose whether hotels and other lodging show in it, and mark a recap as seen. A connection gets this only if it asks for it by name. It gets names and numbers; the route you took on a day leaves only with the separate permission for exact coordinates.

Where the results go. Whatever the assistant reads through Woosh, such as message text, names and event details, is sent to the company that runs the assistant and becomes part of your conversation with it, including its transcript. From then on it is handled under that company's privacy policy and your settings there, not ours, and deleting something in Woosh does not remove it from a conversation that already contains it.

What it never receives. Phone numbers, yours or anyone else's. Map coordinates of you or anyone else, including the route of a workout or a trip and the position of a place on a trip (it can hand a route or a place to Woosh for you, and gets none back): where your friends are reaches it only as the name of a place or a city, or as a rough distance such as "1 to 2 km", and only where the app already shows it to you. Where a photo in an album or an event's photos was taken (a picture in a shout or an update keeps the place name its poster chose to show with it, as it does in the app). The payment details people share to be paid back. Any chat you have locked, and the messages in end-to-end encrypted chats, which our servers cannot read either. One exception, and only if you choose it: when you connect an assistant you can tick a separate permission for exact coordinates, which is off unless you tick it. With it, the assistant receives the coordinates of your own places, your own trip and workout routes, the places you have been and the route you took on a day (when it may read those), and of your own and public events. Where another person is or was is never part of it.

What we record. For each change an assistant makes or tries to make for you, we record which action it was, what it acted on (an id, never the content), whether it worked, and when, so a connection that misbehaves can be traced. We keep no record of what it reads beyond the usage statistics described above, which never include content. This record is deleted with your account, and you can ask us for it at the address under Contact.

Disconnecting. Every connected assistant is listed, with when it was last active, in Settings → AI assistants. Disconnect it there at any time and its access stops within a few minutes. You can connect it again later.

Ask Woosh, at the bottom of the menu behind your picture, is a chat with Woosh itself: ask it something or tell it what to do, typed or spoken. It works through the same tools as a connected assistant (above): it sees only what you can see in the app, never receives what an assistant never receives, and can make the everyday changes listed there. Some changes stay in the app only: deleting a group, an event, a message or a task, skipping a task, changing the areas tasks are filed under, removing people, managing roles, money, who can see something, and your profile and privacy settings. Nothing changes until you confirm it, with the button on Woosh's message or by replying yes. Your recent messages in that chat, what it looks up to answer them, your first name, your language and your time zone are sent to Claude, an AI model made by Anthropic, through Anthropic or through Google Cloud's Vertex AI, which sends back the answer. The chat is kept like any other chat on Woosh, encrypted on our servers: you can delete messages or clear the chat at any time, Woosh no longer reads what you cleared or deleted, and the chat is deleted with your account. A spoken question is turned into text by your phone's or browser's own speech recognition, which may use Apple's or Google's service, and the answer to it is read aloud by your device's own voice. Asked through Siri, the question is heard by Siri and Woosh's answer is shown and spoken by Siri, which Apple's privacy policy covers, in full only once your iPhone is unlocked, or while it is connected to CarPlay. On any other locked iPhone Woosh can only add something to your own lists, a task or a shopping item for example, and Siri speaks only what is being added and where, or a fixed line. The question and the answer are also kept in your Woosh chat. It is not offered on an account a parent manages.

Some features read what you give them so you don't have to type it out — for example a receipt on a shared expense, a photo of a shopping list or of a note in Out of my head, or a letter, screenshot, PDF or spoken note you turn into a plan for a group. What you give is sent to Claude, an AI model made by Anthropic, through Anthropic or through Google Cloud's Vertex AI, which sends back the text or the suggested items. To suggest who a plan is for and where it belongs, the first names of the group's members you can see are sent with it, with the children's accounts marked as children, and the names of the group's shared areas. We use the answer only for your request, and nothing is added to a group until you choose it. A photo or PDF read for a shopping list or a plan is deleted from our storage once it has been read; a receipt stays with its expense, and a note's photo with the note, until you delete them. We don't log what was read. Speech you dictate is turned into text by the speech recognition built into your phone or browser, under its maker's terms, before it reaches us. To count your monthly AI budget, we record when you use one of these features, a suggested week of meals or Ask Woosh, and which one, never what you sent. Those records are deleted once they are older than 30 days, the next time you use one, and all of them with your account.

When you ask for a suggested week of meals, the household's diet notes as written, how many people are eating, your favourite dishes and the dishes you've had lately are sent to Claude in the same way, and it sends back proposed dishes. We never send who the people are, and nothing is planned until you accept it.

When someone reports a message, a picture or other content, its text, up to four of its pictures, and the reason and note the reporter gave may be sent to Claude, in the same way, to help decide whether it breaks our rules. Nothing is read this way before someone reports it. Claude's answer can close a report it finds harmless (never a child-safety report) or hold a message until a person has looked at it. It never removes content for good or acts against an account: a person makes those calls. We don't log the content; only Claude's verdict and a short explanation, which it is asked not to quote the content in, are kept with the report.

When you buy a ticket for an event, or a team buys an organisation plan on our website, the payment is handled by Stripe: your card details go to Stripe, never to us. We keep what was bought, when, for how much, and Stripe's references to the payment. A host who sells tickets sets up their payout account on Stripe's own pages, where Stripe checks their identity; we keep that account's Stripe reference, its country, what it is owed, and whether it can take payments and be paid out. When you ask for a quote for an organisation plan, we keep what you enter about the organisation (its name, VAT number and billing address, what it needs and anything you add in your own words) and the email address you give, to send the quote and to put the organisation's details on the invoice at Stripe; they are deleted when the group is. A personal subscription is bought through the App Store, Google Play or, on our website, RevenueCat (with Stripe underneath); an organisation plan bought in our apps goes through the App Store or Google Play too. RevenueCat knows you by your Woosh account id and tells us which plan you hold. When you delete your account, payment records stay for our bookkeeping but are no longer linked to your Woosh account; Stripe keeps its own record of the payment.

If you add a door pass to Apple Wallet or Google Wallet, the pass holds the event's name, start time and venue and the code the door scans, and an Apple Wallet pass also shows how many people you bring — never your name, phone number or picture. If you stop going, the pass is voided and keeps only the event's name. An Apple Wallet pass is made and signed by us and kept on your phone. When you add it, your phone gives us an identifier for that device and a push address from Apple, which we keep until you remove the pass or replace it with a new one, until a month after the event is deleted, or until you delete your account, so we can tell the pass when something on it changes. Removing an Apple Wallet pass stops the updates. A Google Wallet pass is stored by Google: we send Google the event's name, start time and venue and the code, and update them there when the event changes, the code is replaced or you stop going, and Google's privacy policy covers what it does with them. Google does not tell us when you remove its pass, so we keep sending it these updates.

A wish can hold a link to a shop, and we keep that link exactly as you saved it. When it goes to a shop we are a partner of (today Amazon.com.be, and Action's webshop through the Awin network), the link is opened with our partner id added to the address, and the app says so beside the link. The shop then knows the visit came from Woosh, and may pay us a commission if something is bought. That id is the same for everybody: it does not say who you are, which group you are in or which wish you opened. The link opens in the shop's own app or in your browser, never inside Woosh, and from there the shop's own privacy policy applies. An Action link first passes through Awin, the network that runs Action's partner programme, which records the visit for the shop. With the button that looks a wish up at Amazon, the words you typed are part of the address you open there, and do not pass through our servers. For a shop whose product list we keep a copy of (today Action), what you type as a wish's name is sent to our servers a moment after you stop typing, to search that copy; the shop is not asked, and the words are not stored with your account or the wish. Picking a product fills in the wish's name, link and price, and our server copies the product's picture from the shop into the wish. When you save a short Amazon link, our server asks Amazon once where it leads and keeps the answer with the wish, so that link can be opened with our id as well; only the link itself is sent. Amazon may recognise you from its own cookies. When you paste a link into a wish, our server opens that page once to read the product's name, price and picture, fills them in where the wish has none yet, and copies the picture into the wish; only the link itself is sent, and an Amazon page is never read. A link to a product in a shop's list we keep a copy of is filled from that copy, without asking the shop. The shop tells us what was bought through our links, not who bought it.

When you choose to connect your Google account, Woosh requests access to specific Google APIs to power features you have explicitly enabled.

• Google Contacts (contacts.readonly scope). If you connect Google Contacts, we read your contact list — names, phone numbers, email addresses, and profile photos — to (a) suggest which of your contacts are already on Woosh, (b) let you invite friends by email, (c) surface mutual connections within your groups, and (d) display each contact's photo as their avatar in the friend-picker so you can recognise them at a glance. The contact details stay on your device. To match against existing members, we send phone numbers to our server (hosted in the European Union), which stores only a salted, irreversible hash of each number — never the raw number, name, email address, or photo. You can delete the stored hashes at any time from Settings → Apps & integrations → Google connections, or by deleting your Woosh account. When you ask Woosh to send someone an invite by email or text — to an event, to a group, or to be your friend — we store that person's email address or phone number, which invite it was for and when it went out, so we can deliver it, send one reminder if they have neither opened it nor joined (sooner if you ask for it), offer that address or number when they sign up through it, limit how often anyone is contacted, and stop if they ask us to. So you can see your own invites to an event or a group, we also keep a short hint of it — the last three digits of a number, or the first letter and the domain of an address — for 30 days, then delete it. Once it has none of those uses left — straight away for an invite that never went out, otherwise 90 days after it was sent or when the event is over, whichever is later — we replace it with an irreversible code that only lets us keep to those limits. When you remove someone from the people we suggest or offer to invite, we keep a note of it so they stay removed on your other devices: for someone on Woosh, their account; for a phone number, the same kind of keyed code we use to match your contacts; for a contact you can reach only by email, a code your device makes from the address with a key that belongs to your account alone, so the address itself never reaches us. Putting them back under Removed people, or deleting your account, deletes that note.

• Google Calendar (calendar.events and calendar.app.created scopes). If you connect Google Calendar, we read upcoming events from your primary calendar so we can suggest plans you might want to share with a Woosh group. That read happens in your browser, and we do not store its result on our servers — it is held only in your browser session and is discarded when you close the tab. When you RSVP "going" to a Woosh event or decline it, we create a corresponding event on your Google Calendar, marked as declined if you are not going; if you later withdraw your answer or change it to maybe, we delete that event. Apart from a Google calendar you add under Calendars and a group calendar you sync both ways (both below), we do not read, modify, or delete any other events on your calendar.

• Automatic calendar sync (optional). If you turn on automatic calendar sync, Woosh keeps your Google Calendar in step with your RSVPs even while the app is closed. To do that we store a long-lived authorisation token from Google on our servers (hosted in the European Union), encrypted at rest, and our servers use it to create, update, and delete only the calendar entries for Woosh events you have replied to. Unless you also add your Google calendar under Calendars or sync a group's calendar both ways (both below), our servers never read your calendar — they make no request to Google to see what is on it, and they only ever change entries Woosh itself created. You can switch this off at any time from Settings → Apps & integrations → Google connections: we then withdraw the token with Google and delete it, together with our record of which calendar entry belongs to which Woosh event. Entries already on your calendar are left in place, so nothing disappears from your schedule without you asking.

• Your Google calendar in Woosh (optional). If you add your Google calendar under Calendars, our servers use the authorisation you gave for automatic calendar sync to read the entries of your main calendar, from a month ago to a year ahead, about every hour: their titles, places and times, and whether they are cancelled or marked free. Entries Woosh itself put there are left out. We store them as described under "Calendars you add", and use them only to show them in the groups you share that calendar with — never for advertising and never to train AI models. Remove it under Calendars at any time; disconnecting Google, or Google telling us your authorisation has ended, also deletes our copy.

• A group's calendar, synced both ways (optional). If you turn on “Sync both ways” on a group's Calendars screen, Woosh makes a calendar for that group in your Google account and keeps the appointments its agenda shows you in it — their titles, descriptions, places and times. An appointment that repeats is left out. About every 15 minutes our servers read what changed in that one calendar, using the same authorisation as automatic calendar sync. A change to an appointment you may edit is saved in Woosh and reaches everyone in the group; a change you may not make is put back. Anything you add to that calendar becomes an appointment in the group, visible to its members — so add only what you want the group to see. We store which entry belongs to which appointment, and read no other calendar of yours. Turn it off on the same screen at any time: we stop reading and writing, delete that record, and leave the calendar in your account. Leaving the group, deleting the calendar in Google, or disconnecting Google does the same. While the sync is on, an appointment that calendar carries is taken off your main calendar, and put back when you turn it off.

Limited Use disclosure. Woosh's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not use Google user data to serve advertisements.

• We do not sell Google user data.

• We do not transfer Google user data to third parties except as necessary to provide or improve the features above (e.g. our hosting providers), for security purposes, or to comply with applicable law.

• We do not allow humans to read Google user data, except (a) with your affirmative consent for specific messages, (b) for security purposes (such as investigating abuse), (c) to comply with applicable law, or (d) where the data is aggregated and used for internal operations in accordance with applicable privacy and other laws.

• We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models.

Revoking access. You can revoke Woosh's access to your Google account at any time at myaccount.google.com/permissions. Revoking access on Google's side does not automatically delete data already imported into Woosh — use Settings → Apps & integrations → Google connections to delete imported contacts or to switch off automatic calendar sync, use Calendars to remove a calendar you added, or delete your Woosh account to remove everything.

A parent can create an account for a child who has no phone number. For that account we store the child's first name, an optional last name, the date of birth, any profile photo, and what the child posts and sends in Woosh. The child's location isn't shared with anyone or stored with the account, unless a parent turns on seeing where the child is. Then we store the latest position the child's device reported, and nothing older, and only the child's parents can see it. The child's app says that it is on. The position is deleted when a parent turns this off and when the account becomes the child's own. We also keep a record of the parent's consent: which parent gave it, when, and under which version of the Terms, and which parent later added another one or turned on seeing the child's location.

The child's parents see the account's name and age, the devices it is signed in on, the requests waiting for their approval and, when a parent turned it on, where the child is now. They don't see the child's messages in chats they aren't in themselves. Nobody else can find the account. Other people only see the child in the groups and friendships a parent approved, where they see what any friend or group member sees. To delete a child's account, a parent can email us at the address under Contact. At 16, the child adds their own phone number and the account becomes theirs.

Data is stored on Supabase (PostgreSQL) inside the EU. Authentication tokens are stored on your device in the platform secure storage (Keychain on iOS, EncryptedSharedPreferences on Android). Transport is TLS-encrypted end-to-end between your device and our servers. Usage statistics are kept separately in Google BigQuery, also inside the EU (Belgium).

You may request access, correction, or deletion of your personal data at any time by writing to hello@woosh.social. Deleting your account removes your user record and all imported contacts.

You can delete your account and all associated data at any time from the app, or read the full steps on our account deletion page.

ViVeCo BV Rozenhoed 46, 9921 Lievegem, Belgium Enterprise number: BE 0797.030.687 Email: hello@woosh.social