Privacy

Widdershins is run by Hagale Technologies. If you have a question about your data, email privacy@widdershins.watch and a human will answer.

What we collect

The minimum we need to run your account: your email address, your timezone, the watches and wears you log, and any photos you upload. If you turn on the daily wear-log reminder, we also store the push subscription your browser gives us for it — a delivery address and device credentials, not something you type in — so we know where to send that one reminder. If you create an API token, we keep its name, what it can do, when it was made and last used, and a one-way hash of it — never the token itself. If you enable service reminders, we store that choice and a delivery record so the same watch and service date do not trigger repeated emails. That’s the whole list for your account: no name, no address, no payment details. If you send us feedback or report an error in the Catalog, we also have what you wrote; see “Feedback and catalog reports” below for where that goes.

Community numbers on catalog pages

Catalog pages can show how many members own a reference and how often it has been worn this year. Those numbers are only ever shown once at least five different people are behind each one — a count derived from wear entries needs five different people logging wears, not just five owners. Nothing identifies who they are, and nothing links a number back to an individual journal.

Analytics

We use Cloudflare Web Analytics to count page visits. It’s the cookieless kind: no fingerprinting, no cross-site tracking, no profile of you being assembled anywhere. It tells us roughly how many people visited and which pages, and that’s all it tells us. There are no ad pixels, no session recorders, and no data brokers here.

Who handles your data

A short list of companies process data on our behalf. Cloudflare hosts everything on its global network: the app, the database, and your photos, and runs the bot check on the sign-in and feedback forms, which sees your IP address. Resend, a US company, delivers sign-in links, account-deletion confirmation links, passkey notices, and service reminders you enable. It sees your email address and the content of those emails. Service reminders include the watch’s name, service kind and estimated due date. Resend also carries any feedback you send us (see below). GitHub stores the daily disaster-recovery database snapshot described below — see “Retention and deletion” — as a private build artifact for up to 45 days, encrypted before it leaves Cloudflare to a key that only we hold, so GitHub stores it but cannot read it; that snapshot excludes sign-in links, but otherwise contains the same production data Cloudflare already hosts. GitHub also holds our notes on catalog corrections (see below). None of these three gets to use your data for anything except running Widdershins.

Anthropic, a US company, provides the AI model we use to research catalog error reports. It receives the text of reports an admin has reviewed and passed on, with the report’s random ID and the public catalog entry it’s about, as described below.

If you turn on the daily wear-log reminder, delivering it involves one more party: your own browser’s push service — run by whichever company makes your browser (Google, Mozilla, Microsoft, or Apple) — which your browser chose, not us. All we send it is an empty delivery request with no content and nothing about you attached; it never receives your email, your collection, or anything else in this list.

Feedback and catalog reports

When you send feedback, we email it to ourselves through Resend: your subject and message, your IP address, and, if you’re signed in, your email address so we can reply. It goes to our support inbox, and deleting your account doesn’t delete feedback you’ve already sent.

When you report an error in the Catalog, we store what you wrote with your account, and an admin reads it first. Reports the admin passes on are sent word for word to Anthropic’s AI model, which researches the claim against public sources. Your email address and account aren’t sent with it, but anything you wrote in the report is, along with the report’s random ID, which only we can link back to your account. What we checked and changed is recorded in our private code repository on GitHub and summarized in our issue tracker, Linear (a US company); both can describe what a report claimed. Deleting your account deletes your reports from Widdershins; those notes and summaries, including ones about reports that led to no change, are kept.

Short-lived operational data

To slow down abuse, we keep tiny rate-limiting records: your IP address for between a minute and a day, depending on the endpoint, and, when you request a sign-in link, your email address for fifteen minutes. On the sign-in and feedback limits an IPv6 address is kept as only its first half, which names your network rather than your device; the catalog search and browser security report limits keep the full address. They expire on their own. Sign-in links themselves also expire after fifteen minutes.

While retrying a service reminder, we temporarily keep its recipient and message. We remove that copy when the attempt finishes or when a later reminder sweep closes its retry window. We keep the watch, service date and delivery outcome until the watch or account is deleted.

Cookies

Only the functional cookies needed to sign you in: your session and whatever the bot check needs to pass its challenge. Your session is a random token stored in a cookie; we only keep its cryptographic hash, not the token itself, so a database leak alone can’t be used to sign in as you. No advertising or cross-site cookies, ever.

Photos

Every photo you upload is re-encoded on our servers before it’s stored, which strips embedded metadata (including GPS location) along the way. Data export covers your watches, wears, and account details, and the ZIP archive download includes every photo you’ve uploaded.

Retention and deletion

We keep your account data for as long as you have an account. Delete it and your watches, wears, photos, and account details go with it: removed immediately from the live app, not just hidden. There’s no in-app recovery window because there’s no soft delete to recover from.

We do keep a disaster-recovery backup behind the scenes, for one purpose only: recovering from our own bugs, not from your decisions. A daily job copies photos to a second, access-restricted storage bucket and exports a database snapshot, encrypted to a key only we hold, each retained for up to 45 days and then automatically deleted. If a bug on our end were to wrongly delete something, that backup is how we’d put it back; it isn’t browsable, isn’t used for anything else, and a deletion you asked for still fully disappears from it within that 45-day window.

The legal bits

We process your data because you asked us to: the lawful basis is performing our contract with you, providing the service. Because Cloudflare’s network is global and Resend, GitHub, Anthropic, and Linear are US companies, your data can be processed outside your own country.

Widdershins is not directed at children under 16.

We don’t sell, rent, or share your data. We don’t have an ad business to fund with it.