Security

A short, honest account of how sign-in works, what a session really is, what deleting your account really deletes, and what Widdershins never asks you for — plus exactly what does and doesn’t follow you to a new phone.

Your journal lives on the server

Your collection isn’t stored on one device. Every watch and wear you save goes straight to our database, and every photo you upload is re-encoded and written to our own storage, with only its key and details kept in the database alongside your collection. So a new phone doesn’t mean a fresh start: sign in there and your watches, wears and photos are exactly where you left them.

A few things do stay with the device rather than your account. A wear you log while your phone has no connection is held in that browser’s own storage until you next open a page inside your account — your log, collection or stats, not just the front page — while online; so do that on a phone before you retire it, or log that day again on the new one. The daily wear-log reminder keeps its hour on your account, but each browser has to be allowed to receive it separately, so a new phone stays quiet until you turn it on there too from your account page. And the settings that describe a screen rather than your collection — light or dark, how the watch picker is laid out, and whether you’ve dismissed the install-the-app banner or the timezone prompt — are remembered per browser, not on your account, so you choose them once per device.

Signing in

There are no passwords and no third-party sign-in buttons here. Every sign-in is either a link emailed to you — it expires fifteen minutes after you ask for it, and works exactly once — or a passkey. The clock starts the moment you request the link, not when the mail lands, so if your email is slow you may have less than the full fifteen minutes. Asking for a fresh link starts a new window, though sign-in links are rate-limited per address and per network, so after a few in quick succession you may have to wait up to fifteen minutes before another can be sent, and after twenty from the same network in a day, up to a day.

A passkey’s private half is never sent to us and never stored by us. What we keep is its public half plus the details needed to recognise it next time: its ID, a usage counter, a device name, how it’s reached and whether it’s synced, and when it was added and last used. Where that private half lives is between you and your device — most platforms now back passkeys up and sync them across your own devices, which is exactly what makes a new phone painless — but no copy of it is ever ours. Add one from your account page once you’re signed in, and remove it the same way. Either change needs a sign-in from the last ten minutes, so someone using a session you left open can’t quietly add their own passkey or take away yours, and we email you every time a passkey is added or removed. After that, typing your email first and tapping the passkey button is all it takes — no password to remember.

Your session

Staying signed in relies on one cookie, marked HttpOnly, Secure, and SameSite=Lax, so it can’t be read by a script and won’t be sent along on a cross-site subrequest — it’s still sent when you follow a link here from elsewhere, which is what Lax is for. Every request that changes something — anything you submit or save — is also checked against the request’s own origin, which is what actually stops a forged cross-site request from acting as you. Opening a link we’ve emailed you — to sign in, or to confirm it’s you before deleting your account — is the one kind of request that can’t be checked that way, since it arrives from your mail app rather than from a page here. Those links are guarded instead: each works exactly once, a sign-in link expires fifteen minutes after it was requested, and a confirmation link expires after ten and works only in the signed-in session that asked for it.

We store only its cryptographic hash, not the cookie itself, so a database leak alone can’t be used to sign in as you. Every request re-checks that session against our database directly, and signing out deletes the underlying row — there’s no separate signed token that would keep working after that. A session lasts thirty days from sign-in and is renewed for another thirty when you use it with fewer than fifteen days left, so one you stop using runs out somewhere between fifteen and thirty days after your last visit. There’s also a hard ceiling of one year regardless of activity, so a session that’s simply old eventually stops working even if nobody ever signs out of it.

Exporting your data

Whatever you’ve logged is yours to take with you, at any time, from your export page once you’re signed in: a CSV of your wear history (one row per wear) and a CSV of your watches (one row per watch, including any you’ve never worn), a JSON file that also covers your watches, straps, service history, wishlist and account details, or a ZIP archive that adds every photo you’ve uploaded on top, up to 500 MB of photos. Past that cap the ZIP isn’t available at all — it fails rather than quietly arriving without your photos — so the CSVs and the JSON, which the cap doesn’t apply to, have to be downloaded on their own, and we’ll send you the photos directly if you ask. It’s rate-limited too — twenty exports and five full-photo archives per hour — generous enough that you’ll never notice unless something else is scraping your account.

Deleting your account

Deleting your account takes a deliberate few steps — you confirm it’s you again, with an emailed link or a passkey set up for that, then type DELETE to confirm — and it is a real deletion: your watches, wears, straps, wishlist, service history, photos, passkeys, and the account itself are all removed immediately from the live app. There’s no soft delete, no “recently deleted” folder, and no in-app recovery window — because there’s nothing left to recover from.

The one exception is a disaster-recovery backup, kept behind the scenes for up to 45 days, for recovering from our own bugs rather than your decisions — see our privacy page for the full explanation. It isn’t browsable and isn’t used for anything else. Deleting your account clears what it can of your photos from that backup straight away, but the daily database snapshots aren’t edited once they’re taken, so your data leaves them only as they expire — either way, a deletion you asked for is fully gone from the backup within that 45-day window.

What we never ask for

A price is never required to log a watch. Purchase price, sale price, and every related date are optional fields you can leave blank forever — this has always been a private journal, not a valuation tool.

Your collection has no profile and is never listed or searchable. It has no public page unless you switch on a shared collection page yourself in Account: a link that shows only the watches you choose and how often you wear them — never serial numbers, dealers, notes, sale prices or your account details, and purchase prices only if you turn them on. Turning sharing off, or making a new link, stops the old link working on the very next request.

In the browser

The site ships a strict Content Security Policy with a fresh nonce on every request, checks the request’s origin before accepting anything you submit, and rate-limits sign-in and import endpoints. None of this is unusual for a modern app; we’d rather say so than leave you to guess.

Telling us about a problem

Found something that doesn’t match what this page says, or a security problem generally? Email privacy@widdershins.watch and a human will read it.