WoskWosk — Privacy Policy
Version 1.0 · Effective 26 July 2026
Published at https://wosk.web.app/privacy. The app links here from the consent screen (before your first upload), from the paywall, and from Settings → Privacy policy.
1. Who is responsible for your data
The controller of your personal data is:
Wosk, an independent app developed and operated from Poland. Email: favamvv@gmail.com
Email is the fastest way to reach us and the address every request in this policy — access, deletion, objection, complaint — can be sent to. We answer in person, usually within a couple of days.
We have not appointed a Data Protection Officer. Article 37(1) GDPR requires one only where the core activity involves large-scale regular and systematic monitoring of data subjects, or large-scale processing of Article 9 data. We do not believe Wosk meets that threshold today. If it does, we will appoint a DPO and name them here.
You can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. If you live in another EU/EEA country you may complain to your own national authority instead.
2. The short version
You upload screenshots of a conversation. We read them once, in memory, on a server in the Netherlands, extract the text, delete the images, and generate an interpretation. Phone numbers, email addresses, postal addresses and account numbers are stripped out before anything is written down. Nothing you upload trains any AI model. The text and the result are kept for 90 days and then deleted automatically, or you can delete them yourself at any moment. We do not sell data, we do not run advertising SDKs, and no human reads your conversations unless you report an analysis to us.
The rest of this document is the same thing said precisely.
3. What we process, why, and on what legal basis
| Data | Where it comes from | Why we process it | Legal basis | Kept for |
|---|---|---|---|---|
| Conversation screenshots (images) | You upload them | To extract the message text | Consent, Art. 6(1)(a); explicit consent, Art. 9(2)(a) | Deleted inside the same server call that reads them — see §6 |
| Message transcript extracted from the screenshots | Derived from the screenshots | Input to the analysis; needed for follow-up questions and reply drafts | Consent, Art. 6(1)(a); Art. 9(2)(a) | 90 days, or ~1 hour if you turn history off |
| The analysis result (verdict, score, flags, explanations) | Generated by AI from the transcript | It is the product | Consent, Art. 6(1)(a) | 90 days, or ~1 hour if you turn history off |
| Context you type (who this is, how long, your question) | You type it | Sharpens the analysis | Consent, Art. 6(1)(a) | With the analysis |
| Onboarding quiz answers | You tap them | Pre-fills the context, tailors copy | Consent, Art. 6(1)(a) | Until you delete your data |
| Age confirmation (that you said you are 18+, and when) | You tap it | Legal requirement to keep an adults-only app adults-only; proof under Art. 7(1) that the gate was passed | Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f) | Until you delete your account |
| Consent record (that you accepted, which version, when) | You tap it | Art. 7(1) — we must be able to demonstrate consent | Legal obligation, Art. 6(1)(c) | Until you delete your account |
| Anonymous account identifier (Firebase uid) | Created on first launch | Ties your analyses and your subscription to one device without asking for your name | Consent / contract, Art. 6(1)(a)–(b) | Until you delete your account |
| Subscription state (active/trial/expired, product, expiry, store) | Apple / Google via RevenueCat | To unlock Pro and stop unlocking it when you cancel | Contract, Art. 6(1)(b) | Until you delete your account |
| Rate-limit counters (how many analyses this hour and today) | Derived | Abuse and cost control | Legitimate interest, Art. 6(1)(f) | Rolling, deleted with your account |
| Reports you file about an AI output | You submit them | Google Play requires in-app reporting of AI content; we fix bad output at the source | Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f) | Kept as a compliance record, with your identifier scrubbed when you delete your account |
| Push token, if you allow notifications | Firebase Cloud Messaging | To send the notifications you enabled | Consent, Art. 6(1)(a) | Until you turn notifications off or delete your account |
| App diagnostics and crash reports; aggregate usage events | The app | Keeping the app working and knowing which screens are broken | Legitimate interest, Art. 6(1)(f) | Per the Firebase retention setting on the project — configurable, and capped at 14 months |
We do not process: your contacts, your photo library beyond the images you pick, your location, your advertising identifier, or your device's other apps. There are no third-party advertising or analytics SDKs in Wosk.
4. Conversations are sensitive data, and we treat them that way
A real conversation can reveal your sex life or sexual orientation, your health, your religious or philosophical beliefs. That makes some of what you upload special category data under Article 9 GDPR.
Our legal basis for it is your explicit consent under Article 9(2)(a), given on the consent screen before your first upload. That screen states, before the tick and not behind a link, what happens to the images, what is stripped out, and that nothing is shared or used for training. The box is not pre-ticked and the button stays disabled until you tick it.
Article 7(4) requires us to say this plainly: you cannot use the analysis feature without giving that consent, because the analysis is the feature. You can withdraw consent at any time (§9), and withdrawal is as easy as giving it.
5. The other person in the conversation
This is the part most apps do not write down, so we will.
The screenshots you upload contain personal data about someone who never agreed to any of it. He did not install Wosk, did not read this policy, and did not consent. Under GDPR that makes us a controller of his data as well as yours, and it is the single largest privacy exposure in this product. We are not going to pretend otherwise.
What we do about it:
- We never keep the image. The screenshot is read once into memory by the function that processes it and the stored object is deleted inside that same invocation — including when the processing fails. Nobody, including you, can read an uploaded image back out: the storage rules deny every read.
- We strip identifiers before anything is written down. Phone numbers, email addresses, postal addresses, IBANs and card numbers are replaced with
[removed]during extraction, and a second deterministic pass re-checks the machine-detectable ones before the transcript touches the database. First names survive, because an analysis that cannot tell you who said what is useless. Nothing else that looks like an identifier does. - Nothing you upload trains an AI model. We use Google Cloud Vertex AI under Google's Cloud Data Processing Addendum, which does not use customer data to train Google's models. We deliberately do not use the consumer Google AI Studio tier, whose data terms are different.
- No human reads it. The pipeline is automated end to end. The only time a person sees conversation content is if you use the in-app report button and attach it yourself.
- It expires. The transcript and the result are deleted after 90 days automatically, and immediately if you ask.
- Share cards blur names by default. If you export a result to share, the name-blurring toggle is on when the screen opens, and you have to deliberately turn it off.
- You promise you are in the conversation. The consent checkbox says "I understand, and I'm only uploading conversations I'm part of." Uploading somebody else's private conversation is a breach of our Terms and, depending on where you are, possibly of the law.
If you are that other person — if you believe your messages were uploaded to Wosk by someone else — see §10.
6. How long we keep things
| What | Retention | How it is enforced |
|---|---|---|
| Uploaded screenshots | Deleted inside the same server invocation that reads them, whether the analysis succeeds or fails | The delete runs in a finally block, so a crash downstream does not leave images behind. Failures to delete are logged as errors. |
| Uploaded screenshots — backstop | A bucket lifecycle rule deletes anything left under uploads/ within 24 hours. See the honest note below. | Google Cloud Storage lifecycle rule on the uploads/ prefix |
| Transcript and analysis result | 90 days from creation, then deleted automatically | Every analysis is written with a purgeAt timestamp; a scheduled job runs daily at 03:00 UTC and deletes everything past it |
| Transcript and result, when "don't save my history" is on | The transcript is never written at all; the result record is marked to expire one hour after creation and is removed by the next daily sweep | Same scheduled job |
| Follow-up questions and answers | With their analysis | Deleted recursively with the analysis |
| Reports of AI output | Kept as a compliance record. Your identifier is replaced with deleted and your free-text note is erased when you delete your account. | deleteAccount scrubs rather than deletes, so the audit trail Google Play's policy exists to create survives |
| Subscription webhook events | 30 days | Firestore TTL policy |
| Everything else about you | Until you delete your data or your account | §9 |
An honest note about the one-hour backstop. Our design target was a belt-and-braces rule that erased any orphaned screenshot within one hour. Google Cloud Storage lifecycle rules are day-granular — the platform has no "one hour" option — so the outer guarantee we can actually keep is 24 hours, not one. The real control is the in-invocation delete, which happens in seconds and covers every normal and every failed run; the lifecycle rule only ever catches an object whose invocation died before the delete line, which should be none. We would rather tell you the number we can hold to than the number we would prefer to print.
7. Who else touches your data
We use these processors. Each one processes on our instructions under a data processing agreement.
| Processor | What they do | Where |
|---|---|---|
| Google Cloud EMEA Limited / Google Ireland Limited (Google Cloud Platform and Firebase) | Vertex AI (Gemini) runs both AI calls. Cloud Storage briefly holds the upload. Cloud Firestore stores the transcript and result. Cloud Functions runs the pipeline. Firebase Authentication, App Check, Remote Config, Cloud Messaging, Analytics and Crashlytics support the app. | Firestore, Cloud Storage, Cloud Functions and Vertex AI all run in europe-west4 — Google's Netherlands region. Your conversation content is processed in the EU. |
| RevenueCat, Inc. | Subscription and entitlement state, keyed to your anonymous identifier. Receives no conversation content. | United States |
| Apple Inc. / Google Ireland Limited (Google Play) | Take the payment and run the subscription. They are independent controllers for that, under their own privacy policies, not our processors. | Per their terms |
Google Cloud's Data Processing Addendum applies, including its commitment that customer data is not used to train Google's models. We have configured Vertex AI rather than any consumer-tier API precisely because those commitments differ.
8. Transfers outside the EEA
Conversation content — screenshots, transcripts, results — is processed in the European Union (europe-west4, Netherlands) and is not transferred outside it by us.
Two categories do leave the EEA:
- Subscription state goes to RevenueCat in the United States. It contains your anonymous identifier, the product you bought, and when it expires. No conversation content. The transfer relies on the European Commission's Standard Contractual Clauses.
- Diagnostics and aggregate analytics may be processed by Google outside the EEA under Google's own SCCs and, where applicable, the EU–US Data Privacy Framework.
You can ask us for a copy of the relevant safeguards at favamvv@gmail.com.
9. Your rights, and the exact button that satisfies each one
Under GDPR you have the rights below. Most of them we have built into the app rather than made you email us for.
| Your right | In the app | By email |
|---|---|---|
| Access (Art. 15) — a copy of what we hold | Your analyses are all visible in History; the app shows you everything we store about you except internal counters | favamvv@gmail.com, answered within one month |
| Rectification (Art. 16) | Re-run an analysis with corrected context; delete a wrong one | favamvv@gmail.com |
| Erasure (Art. 17) — "be forgotten" | Settings → Delete all my data wipes every analysis, transcript, result and preference immediately and leaves your account empty. Settings → Delete my account does that and also removes the account itself and the uploads prefix. Both are two-step confirmations; account deletion requires typing DELETE. A single analysis can be deleted from its own footer or by swiping in History. | favamvv@gmail.com |
| Restriction (Art. 18) | Turn on "don't save my history" — the result is shown to you and the transcript is never stored | favamvv@gmail.com |
| Portability (Art. 20) | — | favamvv@gmail.com, machine-readable export within one month |
| Objection (Art. 21) | Turn off notifications; delete your data | favamvv@gmail.com |
| Withdraw consent (Art. 7(3)) | Delete your data or your account, and stop uploading. Withdrawal does not undo processing that already happened lawfully. | favamvv@gmail.com |
| Complain (Art. 77) | — | UODO, or your own national authority — see §1 |
Deletion is immediate, not scheduled. Article 17 permits a month; we do it in the same request. Deleting your account inside Wosk does not cancel your subscription — subscriptions live with Apple or Google and must be cancelled there. The app says so on the deletion screen.
10. If your messages ended up here and you did not put them there
You have the same rights as anyone else whose data we hold: access, erasure, objection, and complaint to a supervisory authority. Write to favamvv@gmail.com.
Two honest limitations you should know before you write:
- We probably cannot find you. We hold no name, no phone number and no email for the people who appear in uploaded conversations — identifiers are stripped on ingest by design. Under Article 11 GDPR, where a controller cannot identify a data subject from the data it holds, the access, rectification, erasure and portability rights do not apply unless you can supply information that lets us identify the record. If you can tell us who uploaded it and roughly when, we can usually locate and erase it.
- The images are already gone. The screenshot itself was deleted seconds after it arrived. What may still exist is a text transcript, for at most 90 days.
We will not tell the uploader that you contacted us unless you ask us to.
11. Security
- All traffic is TLS. Data at rest is encrypted by Google Cloud.
- Uploads are write-only. The storage rules deny reads to everybody, including the person who uploaded the file. The only reader is the server function, using administrator credentials, once.
- The database rules make analyses, entitlements and counters server-writable only. A modified client cannot grant itself a subscription or read another user's data.
- Firebase App Check (App Attest on iOS, Play Integrity on Android) is required on every server endpoint, so a scraped API key on its own does not get anyone in.
- Conversation content is never logged. Server logs carry identifiers, timings and token counts.
12. Age
Wosk is 18+. There is a blocking age gate on first run that cannot be skipped, and the answer is stored. If we learn that a user is under 18 we delete their data.
If the AI detects that an uploaded conversation involves someone under 18, the analysis is blocked: no result is produced, no credit is spent, and the transcript is not stored.
13. Automated decision-making
Wosk is entirely automated, and the output is a piece of entertainment writing about a conversation. It produces no legal effect and nothing similarly significant, so the Article 22 rules on automated individual decision-making do not apply. We do not profile you for advertising, credit, employment, insurance or any other consequential purpose. We do not sell or share personal data for advertising.
14. Changes
If we change this policy in a way that affects what we do with your data, we will raise the in-app consent version, which shows you the consent screen again before your next upload. The version and date at the top of this document always tell you which text you agreed to.
15. Contact
favamvv@gmail.com · Wosk, operated from Poland