Privacy Policy

The controller responsible for WeOK Together and its related services is Stefan Mayr, a sole proprietor operating under the eeoom brand.

Stefan Mayr · eeoom
Wittenbauerstraße 61
8010 Graz
Austria

Privacy questions and requests: [email protected]
Business contact: [email protected]

• Account and device data: a generated user/device identifier, display name, device platform and name, authentication credentials, and recovery information used to provide and restore access.
• Circle data: circle names, memberships, owner roles, invitations, circle-specific display names, profile pictures, and notification preferences.
• Check-ins: the status you select, the circle and sender, the time of the check-in, and identifiers used to prevent duplicate submissions.
• Optional location: coordinates and available accuracy and capture-time information, only when you choose to attach your current location to a check-in.
• Status requests: who asks whom to check in, the circle, and creation, expiry and closure times.
• Push and technical data: push registration tokens, delivery information, IP addresses, request times, and operational logs needed to run, secure and troubleshoot the service.
• Support correspondence: information you send us when you contact us.

You do not need to supply an email address or phone number to create your app identity. Profile pictures and location sharing are optional.

We process account, device, circle and check-in data to provide the service you request, including authentication, circle communication, notifications and restoration of access. Where the GDPR applies, this processing is based on performance of a contract (Article 6(1)(b)).

Optional location sharing is initiated by your deliberate action and requires device permission. Where consent is the applicable legal basis, we rely on Article 6(1)(a). You can stop sharing location and revoke the device permission at any time; this does not remove locations already shared.

Operational logs and abuse-prevention checks serve our legitimate interests in maintaining a reliable service, preventing misuse and protecting access (Article 6(1)(f)). We process data to meet applicable legal obligations where required (Article 6(1)(c)).

A normal tap sends a check-in without requesting a new location. Holding a status button allows you to include your current location with that check-in. WeOK does not continuously track your movements or request background location access for this feature. Several check-ins may each contain a separately shared location.

The location is shared with the selected circle and can be viewed on a map. It follows the same retention rules as the associated check-in. You can remove it by deleting that check-in.

Maps load tiles from OpenStreetMap Foundation services. When you open a map, the tile provider receives your IP address, technical request information and the requested map area, which may reveal the approximate area of the shared location. See the OpenStreetMap privacy policy.

If you choose to open an external maps app for directions, the destination coordinates are passed to that app. Its provider processes this information under its own privacy policy.

You can choose a profile picture and display name for a circle. Other active members of that circle can see that profile. Where a general profile is used as a fallback, it can be visible in the circles that use it. Uploaded profile images are resized and re-encoded for display; the uploaded image file is not retained in its original form.

Leaving a circle, or being removed by its owner, makes your membership inactive. Membership and profile information are retained to support restoration. Your check-ins are hidden from that circle while the membership is inactive and continue to expire under the normal retention rules.

If you rejoin or restore your membership, check-ins that have not expired or been deleted can become visible again. Leaving a circle is therefore different from deleting your check-ins or requesting deletion of your data.

We use Google Firebase Cloud Messaging and, on iOS, Apple Push Notification service to deliver notifications. These providers process registration tokens and notification payloads, which may include circle and sender names, status information and identifiers. We do not include the location coordinates attached to a check-in in its push notification payload.

You can control notification categories in the app and permissions in your device settings. Status-request notifications can be disabled for each circle. Responding to a request is voluntary, and a response is a normal check-in shared with the circle.

Widgets and Live Activities may display circle names and your current status on your device, including the lock screen. Their visibility depends on your device settings. Credentials needed to send from a widget are stored using the platform's protected storage. Recovery credentials are not shared with the widget extension.

See Firebase privacy information and Apple's privacy policy.

Check-ins and attached locations are shared with active members of the circle you choose. Invitations and recovery links or codes should only be shared with people you intend to give access to. Recipients may keep screenshots or copies outside WeOK; deleting a check-in cannot remove those copies or notifications already delivered to their devices.

Our hosting and infrastructure providers process data to operate the service. Authorized administrators may access data when necessary for support, maintenance, abuse prevention or legal obligations. We may disclose data where required by law.

In addition to push and map services, the app may download fonts from Google, and the website loads presentation resources from external content-delivery services, including the Tailwind CSS CDN and jsDelivr. Such requests expose your IP address and technical request information to the respective provider.

Some external providers may process data outside the European Economic Area. Where applicable, international transfers require an appropriate legal mechanism, such as an adequacy decision or standard contractual clauses. Contact us for information about the arrangements relevant to your data.

• Check-ins and attached locations: by default, the newest check-in per person and circle is available for up to 7 days and older check-ins for up to 24 hours after sending. A circle administrator can choose a different duration for new check-ins: 1, 3, 6, 12 or 24 hours, or 7 days. The same duration applies to the attached location. Changing this setting does not extend the lifetime of earlier check-ins. A status remains prominent in the current-status area for one hour.
• Expired check-ins: they are excluded from app responses. Regular cleanup removes their content and attached location; an empty latest-event marker may remain temporarily to prevent an older status becoming current again. Physical cleanup may occur after the visibility period ends.
• Manual deletion: deleting your own check-in removes its status content and attached location from the active server record. A minimal deletion marker may remain until cleanup to prevent duplicate retries or an older status becoming current again.
• Status requests: unanswered requests expire after one hour. Request records are removed by cleanup once they have been expired for more than 24 hours.
• Temporary circles: circles are permanent unless an administrator sets an automatic deletion time. After that time, the circle is no longer available. Background cleanup removes its memberships, invitations, check-ins, locations, status requests and circle-specific profile pictures. Accounts, global profile pictures and other circles remain. A circle's deletion time takes precedence over an individual check-in's remaining lifetime.
• Profile pictures: the current image is retained while it is associated with your profile or membership. Replacing or removing an uploaded image removes the superseded image from active image storage.
• Account, membership and recovery data: retained to maintain your identity and allow restoration, including inactive memberships, until deletion is requested and processed or continued retention is no longer necessary.

Signing out or resetting the app's device access revokes that device's access and disables its push tokens; it does not by itself delete your entire account, circle memberships or server-held data. To request deletion of these data, contact [email protected].

Operational logs and backups have separate lifecycles. Older copies can remain in restricted backups until those backups are replaced or removed. The app's check-in expiry periods are not a promise of simultaneous deletion from every backup. Legal obligations or the handling of a dispute may also require retention of relevant records.

You can choose not to upload a profile picture, send check-ins without location, revoke location permission, change notification preferences, delete your own check-ins, and leave a circle.

Where applicable, you may request access, correction, erasure, restriction of processing or data portability, object to processing based on legitimate interests, and withdraw consent. Contact [email protected]. We may need information sufficient to verify that a request concerns your account, without asking you to disclose your secret access or recovery credentials.

You may also complain to the data-protection authority in your country. Withdrawing consent does not affect the lawfulness of processing before withdrawal. We do not use your check-ins for automated decisions that produce legal or similarly significant effects on you.

We use protected device storage, authenticated API access and access checks for circle data and uploaded profile images. Access by operational personnel is limited to what is needed for their work. No method of transmission or storage can guarantee absolute security.

WeOK is a communication app for families and other groups, not a child-tracking service. Younger users may use the service only where permitted by applicable law and with parental authorization where required. If you believe a child's personal data has been processed without the required authorization, please contact us.

We may update this policy to reflect changes to the service or data processing. The current version is available on this page and through the app's Privacy Policy link. Where required, we will provide additional notice or request consent for a relevant change.

Questions and privacy requests: [email protected].