Weavly Privacy Policy

A plain-English summary

Weavly is built to keep your words with you.

• Your typing, dictation, notes, and personal dictionary are processed on your device. Speech-to-text and our AI "Intelligence" features run on-device — your audio and transcripts are not sent to Weavly or to anyone else to do this.
• We have no account system. You don't give us your name or a password. Your use of Weavly is anonymous to us. The one exception: if you choose to join our newsletter, you give us your email address — used only for the newsletter, with an unsubscribe link in every email.
• Your content syncs only to your own Apple iCloud account (if you turn iCloud on). We don't keep a copy on our servers.
• For the app, the only information that comes to us is anonymous app analytics and crash diagnostics through Google Firebase, so we can fix bugs and improve the app. This never includes your notes, transcripts, keystrokes, clipboard, or audio.
• Website analytics are optional. On weavly.app, Google Analytics loads only after you make an explicit analytics choice. It records page journeys and the two business events of a completed newsletter signup and an App Store redirect click. Rejecting website analytics does not affect your ability to subscribe or download the app, and you can change this choice on the website at any time.
• We don't show ads, we don't use advertising trackers, and we don't sell your data.

This summary is for convenience; the full policy below controls.

1. Who we are

Felipe Veiga Rodrigues – ME, an individual entrepreneur (empresário individual) registered under CNPJ 12.031.568/0001-59 and trading as "Vejaisso Web & Apps" ("Weavly," "we," "us"), of Rua Jerônima Dias, 260, Conj. 122, Mandaqui, São Paulo – SP, CEP 02407-000, Brazil, operates the Weavly app and is the controller of personal data processed through it.

• Privacy contact (all data-protection questions and requests): legal@weavly.app.

For all privacy matters — questions, data-subject requests, and complaints — contact us at legal@weavly.app. This is the single channel for data subjects in every jurisdiction, including the EEA, the UK, and Brazil.

We have not appointed a Data Protection Officer or encarregado because we are not required to. Under the EU/UK GDPR (Art. 37) appointment is mandatory only for public authorities or controllers whose core activities consist of large-scale systematic monitoring or large-scale processing of special-category data; Weavly does neither. Under Brazil's LGPD we operate as a small processing agent (agente de tratamento de pequeno porte; ANPD Resolução CD/ANPD nº 2/2022) and instead provide the communication channel above. The privacy contact above is sufficient for all data-protection correspondence.

This policy covers the Weavly iOS app, its keyboard extension, weavly.app, and related features. It does not cover Apple's iCloud, Google's Firebase / Google Analytics, or other third-party services except as described here — those are governed by their own privacy policies.

2. The categories of data we handle

The table lists every category. "On-device" means it stays on your device unless you enable iCloud sync, in which case it goes to your own iCloud. "To us / third parties" means it leaves your device to a service we operate or use.

What we do not collect

We do not ask for your name, password, phone number, government ID, payment-card numbers, precise location, contacts, photos (beyond saving a theme image you export), health data, or biometric identifiers. Weavly does not inspect which other apps are installed on your device or which system keyboards you have enabled. The one exception: if you choose to join our newsletter, you give us the email address you sign up with — used only to send the newsletter, with a double-opt-in confirmation and an unsubscribe link in every email. We do not build advertising profiles, and we do not track you across other companies' apps or websites.

Your responsibility for the content you enter. Notes and dictation are free-form. You are solely responsible for the information you choose to type, paste, or speak into Weavly, including any sensitive information and any information about other people. That content is processed on your device and, if you enable sync, stored in your own iCloud; we do not access or read it. If you opt in to a cloud-AI feature, the content you submit through that feature will be sent to a third-party provider as described there, and you remain responsible for what you send.

3. How we use data, and our legal basis

We rely on the following legal bases (GDPR Art. 6/9; LGPD Art. 7/11; and the equivalents in your jurisdiction):

You can withdraw consent at any time (see §6 and §10). Withdrawing consent does not affect the lawfulness of processing before withdrawal, and does not stop the parts of Weavly that run on your device.

4. On-device by design (the part that makes Weavly different)

• Dictation / speech-to-text runs on your device using Apple's on-device speech technology and a model bundled with the app. Your audio and transcripts are not sent to Weavly or any third party to transcribe them.
• "Intelligence" (titles, tags, summaries, action items, translation, tone) runs on your device using Apple's on-device AI. Your note content is not sent to any cloud AI provider to do this today.
• Autocorrect, prediction, and your personal dictionary are computed on your device.
• We apply privacy-by-design measures, including truncating the timestamps stored in your personal dictionary so the database cannot reveal when or in what order you typed, an Incognito mode that pauses learning, the ability to lock notes behind Face ID / Touch ID / a PIN, and skipping password fields when capturing clipboard content.

5. The Weavly keyboard and "Full Access"

iOS asks you to grant "Full Access" to use some keyboard features. Here is exactly what that means for Weavly:

• With Full Access off, the keyboard still works for basic typing.
• With Full Access on, the keyboard can use the shared on-device storage (your personal dictionary, snippets, emoji, and notes) and can read the clipboard for the clipboard-capture feature (Pro).
• The Weavly keyboard does not make network connections and does not send your keystrokes anywhere. It does not log what you type except to provide on-device features (like learning your dictionary), and it cannot read the contents of the app you're typing into. Analytics and iCloud sync happen only in the main Weavly app, never in the keyboard.
• The keyboard reads only that shared on-device storage — nothing else. When you save a link, the webpage preview (a page screenshot and a saved copy of the page) is fetched and stored by the main Weavly app, outside the shared storage. The keyboard cannot fetch webpages, and it cannot open or display those saved previews, your saved images, or your voice recordings.

6. Analytics, diagnostics, and audience signals (Google Firebase)

To understand how Weavly is used and to fix problems, we use Google Firebase (Analytics, Crashlytics, Remote Config, and App Check). Analytics and crash reporting are both turned off until you accept our Terms and this Privacy Policy at first launch — we collect no analytics and upload no crash reports before you consent. Through Firebase we then receive:

• Anonymous usage events — e.g., which screens and onboarding steps you reach, paywall and subscription interactions, and which features you enable. Never your notes, transcripts, keystrokes, clipboard, or audio.
• Crash and diagnostic data to fix bugs.
• Standard technical data that Firebase collects automatically — such as app version, device model, operating-system version, and coarse region/language inferred from your device and IP address.
• Anonymous identifiers — an app-generated random user ID and a Firebase install ID. The random user ID is synced through your own iCloud account, so the same anonymous ID is used across all your devices — this lets us count one person across, say, your iPhone and iPad rather than as two separate users (Google calls this the User-ID). It is not your real-world identity; you can reset it at any time, or erase it entirely (see §10).
• Audience context — your Weavly install history, device region, and App Store country, used to understand our audience and improve the app. We do not inspect or send the presence of other installed apps or your enabled system keyboards.

We use Firebase as a service provider for our own analytics. We do not use Firebase to advertise to you, we do not share this data with advertisers or data brokers, and we do not sell it. You can opt out of analytics in Weavly's settings; this does not affect crash reporting needed to keep the app working.

We also run our own small backend on Google's cloud (Cloud Functions and Firestore, located in the United States): it stores newsletter subscriptions you explicitly request and subscription-purchase records needed to provide Weavly Pro.

Website analytics (Google Analytics)

On weavly.app, Google Analytics is not loaded until you make an explicit website analytics choice. If you accept, we use it to understand page journeys and record only these two website business events: a completed newsletter signup and an App Store redirect click. The event data we send does not include your newsletter email address.

Rejecting website analytics does not stop you from subscribing to the newsletter or downloading the app. You can change your website analytics choice at any time using the analytics controls on the website.

We keep the operational subscriber record needed to deliver the newsletter and honour unsubscribe requests separately from Google Analytics. If you accepted website analytics, a pending subscription temporarily carries the anonymous Google Analytics browser identifier so the completed double opt-in can be attributed; that identifier is removed after the confirmed event is dispatched and is not retained on the active-subscriber record. Our aggregate App Store redirect counter contains no Google Analytics identifier and retains no IP address, user-agent, or referrer.

7. Who else processes data (sub-processors) and where

We are not in the business of selling personal data and we do not share it with advertisers or data brokers. We may disclose data if legally compelled (e.g., a valid court order) or to prevent imminent harm or fraud, and, where the law allows, we will tell you.

8. International data transfers

Weavly is available worldwide (except where our providers are unavailable). Some recipients above are in the United States. Where we transfer personal data out of the EEA, the UK, or Brazil, we use a lawful transfer mechanism:

• EEA → US/other: the EU-US Data Privacy Framework (where the recipient is certified) or the European Commission's Standard Contractual Clauses (2021/914) plus a transfer-impact assessment.
• UK → US/other: the UK International Data Transfer Agreement / Addendum (and the UK-US data bridge where applicable).
• Brazil → US/other: the ANPD Standard Contractual Clauses (Resolution CD/ANPD 19/2024) and the disclosures required by LGPD Art. 33.

Google LLC is certified under the EU-US, UK-Extension, and Swiss-US Data Privacy Frameworks.

You can request a copy of the relevant safeguard by emailing legal@weavly.app.

9. How long we keep data

• On your device / in your iCloud: your content stays until you delete it (a note, a recording, the personal dictionary) or delete the app / turn off sync. We can't delete content from your iCloud — you control that in iOS Settings.
• Voice recordings: kept on-device only as long as you keep them. (If cloud transcription is ever offered, audio sent for transcription will be deleted promptly after processing.)
• Firebase / Google Analytics & crash data: retained for up to 14 months (the Google Analytics default for event-level data; crash data is kept for a shorter period), then deleted or aggregated.
• Anonymous identifiers: retained while the app is installed; you can reset the user ID, or use Erase All Data (§10) to delete it on your device, clear it from your other devices (via iCloud), and request deletion of the analytics keyed to it.
• Cloud-AI content (if you opt in to a cloud-AI feature): retained by the provider only transiently (typically ≤30 days) under our contracts.

When we delete data, we also remove it from routine backups within a reasonable period.

10. Your rights

Depending on where you live, you have some or all of these rights: to know/confirm what we process, to access a copy, to correct it, to delete it, to restrict or object to processing, to port it, to withdraw consent, to know who we shared it with, and to complain to a regulator (your local supervisory authority, the ANPD in Brazil, or the ICO in the UK). You will not be discriminated against for exercising these rights.

Because most of your data lives on your device or in your own iCloud, you can exercise many rights directly in the app (delete notes, recordings, the dictionary; reset your ID; export to Markdown/plain text) and in iOS Settings (manage iCloud).

Erase everything, on every device. Weavly includes an in-app "Erase All Data" action that deletes your on-device databases and files, clears the synced settings and identity from your iCloud so they do not return to your other devices, deletes the records held in your iCloud (CloudKit) — propagating that deletion to every device signed in to your account — resets the analytics identifier, and requests deletion of the analytics data keyed to your old anonymous ID from Google. It also unlinks any subscription-purchase records from your anonymous ID (we keep only the anonymized transaction record needed for accounting and refunds). After it runs, Weavly starts again as a brand-new anonymous user.

To make a request to us, email legal@weavly.app or use the in-app privacy controls. We respond free of charge, within 15 days (Brazil) or one month (EEA/UK), extendable where the law allows. We may need to verify your request; since we hold no account identity, verification may rely on device-level signals.

Region-specific

• Brazil (LGPD): you have the rights in Art. 18 (confirmation, access, correction, anonymization/blocking/deletion, portability, deletion of consented data, information on sharing and on the consequences of refusing consent, and revocation of consent). As a small processing agent (agente de tratamento de pequeno porte), we provide a communication channel in place of a formal encarregado: legal@weavly.app. You may also contact the ANPD (the Brazilian data-protection authority).
• EEA / UK (GDPR): you have the rights in Arts. 15–22, including the right to lodge a complaint with your supervisory authority. To exercise any of these rights, or to reach us on any data-protection matter, contact legal@weavly.app.
• California & other US states: you have the right to know, delete, correct, and to opt out of "sale"/"sharing" and to limit the use of sensitive personal information, plus non-discrimination. We do not sell your personal information and do not share it for cross-context behavioral advertising. We honor Global Privacy Control signals. You can exercise these choices in Weavly's in-app privacy settings or by emailing legal@weavly.app. Residents of Virginia, Colorado, Connecticut, Oregon, Texas, and similar states have equivalent rights, including opt-in consent for sensitive data.

11. Security

We use appropriate technical and organizational measures, including encryption in transit and at rest, on-device file protection, restricted access, and the privacy-by-design measures in §4. No method is perfectly secure, but we work to protect your information and will notify you and regulators of a qualifying breach as required by law (GDPR Arts. 33–34; LGPD Art. 48).

12. Children

Weavly is a general-audience product suitable for users of all ages — it is a keyboard. We do not direct it to children. Because the core app is anonymous and processes your content on your device, we do not knowingly collect personal data from children under 13 (the threshold under the US COPPA). Where local law sets an age of consent for consent-based features specifically (for example, optional analytics or future optional cloud-AI features), we apply the protections that law requires for users below that age. If you believe we hold personal data from a child under 13, contact legal@weavly.app and we will delete it.

13. Changes to this policy

We may update this policy. If we make a material change — for example, before turning on any optional cloud-AI feature — we will update the "Last updated" date and, where appropriate, notify you in the app. Your continued use after an update means you accept the revised policy, except where your fresh consent is required (and we will ask for it).

14. Contact

Questions or requests: legal@weavly.app · Felipe Veiga Rodrigues – ME (CNPJ 12.031.568/0001-59), Rua Jerônima Dias, 260, Conj. 122, Mandaqui, São Paulo – SP, CEP 02407-000, Brazil.