Privacy Policy
Last updated 16 August 2026.
About this policy
This policy explains how Workyloop OÜ (“Waky”, “we”, “us”) handles personal data collected through Waky — the website at waky.co and the Waky apps for iPhone and Android.
The short version: Waky is an alarm clock, so the data it needs is small. Your alarms live on your phone. What reaches our servers is what a streak needs in order to survive a lost or replaced device.
Who we are
Workyloop OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. Estonian registry code 16837036. We operate Waky and are the data controller for the personal data described below. Contact: support@workyloop.com
What we collect
Account. An account is created anonymously when you first open the app, identified by a random id. If you choose to sign in with Apple or Google we also store the identifier that provider gives us, and the name and email address they release to us — with Apple that may be a private relay address.
Alarms. When sync is available we store the alarm's time, repeat days, time zone, label, chosen sound, mission type and mission settings, so your alarms can be restored on a new device.
Wake records. For each alarm occurrence: when it was scheduled, when it rang, when a mission was started and completed, the outcome and how long the mission took. This is what the streak is calculated from.
Streaks and achievements. Your current and longest streak, the date of your last successful wake-up, and which achievement tiers you've unlocked.
Subscription status. Whether you have an active entitlement, from the receipt your app store issues. We never receive your card details.
Diagnostics and product analytics. Crash reports, and events such as opening the paywall or completing a mission, tied to a pseudonymous identifier.
Push tokens. If you allow notifications, the token your device needs in order to receive them.
What stays on your device
Alarms are scheduled by your phone's own alarm system, which is why Waky still rings with no internet connection. Missions run entirely on the device: arithmetic and typing missions are generated and checked locally, and the shake mission reads the accelerometer only while the alarm is ringing. Motion data is never recorded or transmitted.
We don't use the microphone, we don't track your location, and Waky contains no advertising and no advertising identifiers.
Legal basis (GDPR Article 6)
Contract. Creating your account, syncing alarms, and calculating streaks and achievements — this is the service you asked for.
Legitimate interests. Keeping the service secure and reliable, fixing crashes, and understanding in aggregate which features are used.
Consent. Push notifications, where your device asks you first. You can withdraw it in system settings at any time.
Legal obligation. Keeping records we're required to keep, such as those relating to purchases and tax.
How long we keep it
Account data, alarms, wake records, streaks and achievements are kept while your account exists. When you delete your account from Settings, they're deleted with it — the deletion is immediate and can't be undone.
Diagnostic and analytics data is kept in pseudonymous form for up to 12 months. Records connected to purchases are kept for as long as tax and accounting law requires, which in Estonia is seven years.
Who processes data for us
We don't sell personal data and we don't share it for advertising. We use a small number of processors, each handling only what its function needs:
Fly.io and DigitalOcean. Application hosting and database, for the account and streak data described above.
Cloudflare. Traffic routing and protection for our API.
RevenueCat. Purchase and subscription status.
PostHog (EU region). Product analytics.
Sentry. Crash and error reporting.
OneSignal. Delivery of push notifications.
Apple and Google. Sign-in, payment processing and app distribution, acting as independent controllers under their own privacy policies.
Your rights
If the GDPR applies to you, you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, and to receive it in a portable form. The quickest route to deletion is Settings, then Delete my data, inside the app.
For anything else, email support@workyloop.com. You also have the right to complain to your local data protection authority; ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
International transfers
Some processors listed above are based in the United States. Where personal data is transferred outside the European Economic Area, the transfer is governed by the European Commission's Standard Contractual Clauses. We don't transfer personal data to jurisdictions without an adequate level of protection unless it's covered by appropriate safeguards.
Children
Waky isn't directed at children under 13 — or the higher minimum age of digital consent where you live — and we don't knowingly collect their personal data. If you believe a child has provided us with personal data, email support@workyloop.com and we'll delete it.
Changes to this policy
We may update this policy. When a change is material we'll say so in the app or on this page and update the date at the top.
Questions about your data? Email support@workyloop.com.