Privacy Policy
Last updated 30 August 2026.
About this policy
This policy explains how Workyloop OÜ (“Waky”, “we”, “us”) handles personal data collected through Waky — the website at waky.co and the Waky apps for iPhone and Android.
The short version: Waky is an alarm clock, so the data it needs is small. Your alarms live on your phone. What reaches our servers is what a streak needs in order to survive a lost or replaced device.
Who we are
Workyloop OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. Estonian registry code 16837036. We operate Waky and are the data controller for the personal data described below. Contact: support@workyloop.com
What we collect
Account. An account is created anonymously when you first open the app, identified by a random id. If you choose to sign in with Apple or Google we also store the identifier that provider gives us, and the name and email address they release to us — with Apple that may be a private relay address.
Alarms. When sync is available we store the alarm's time, repeat days, time zone, label, chosen sound, mission type and mission settings, so your alarms can be restored on a new device.
Wake records. For each alarm occurrence: when it was scheduled, when it rang, when a mission was started and completed, the outcome and how long the mission took. This is what the streak is calculated from.
Streaks and achievements. Your current and longest streak, the date of your last successful wake-up, and which achievement tiers you've unlocked.
Subscription status. Whether you have an active entitlement, from the receipt your app store issues. We never receive your card details.
Diagnostics and product analytics. Crash reports, and events such as opening the paywall or completing a mission, tied to a pseudonymous identifier.
Push tokens. If you allow notifications, the token your device needs in order to receive them.
Photo missions. If you choose a photo mission — make your bed, step outside, or find an item — the single photo you take is sent to our server and forwarded to Anthropic's Claude API, which answers one yes-or-no question: does this photo show what the mission asked for? The image is never written to disk, never written to a log, and never attached to your account or any identifier. It is discarded as soon as the answer comes back, and it is never saved to your photo library. If anything fails — no connection, a slow answer, an error — the mission falls back to arithmetic rather than trapping you in a ringing alarm.
What stays on your device
Alarms are scheduled by your phone's own alarm system, which is why Waky still rings with no internet connection.
Almost every mission runs entirely on the device. Arithmetic and typing missions are generated and checked locally. The shake mission reads the accelerometer only while the alarm is ringing, and motion data is never recorded or transmitted. The push-up and squat missions use the camera to count your repetitions, and that counting happens entirely on your phone — the video is never recorded, never uploaded, and no frame ever leaves the device.
The photo missions are the one exception. They are described above, and they are the only part of Waky that sends anything you capture off your phone.
We don't use the microphone, we don't track your location, and Waky contains no advertising and no advertising identifiers.
Legal basis (GDPR Article 6)
Contract. Creating your account, syncing alarms, and calculating streaks and achievements — this is the service you asked for.
Legitimate interests. Keeping the service secure and reliable, fixing crashes, and understanding in aggregate which features are used.
Consent. Push notifications, where your device asks you first. You can withdraw it in system settings at any time.
Legal obligation. Keeping records we're required to keep, such as those relating to purchases and tax.
How long we keep it
Account data, alarms, wake records, streaks and achievements are kept while your account exists. When you delete your account from Settings, they're deleted with it — the deletion is immediate and can't be undone.
Diagnostic and analytics data is kept in pseudonymous form for up to 12 months. Records connected to purchases are kept for as long as tax and accounting law requires, which in Estonia is seven years.
Photos taken for a photo mission are not stored by us at all. The image is forwarded, judged, and discarded within the same request — it is never written to our database, our logs or our backups.
Who processes data for us
We don't sell personal data and we don't share it for advertising. We use a small number of processors, each handling only what its function needs:
Fly.io and DigitalOcean. Application hosting and database, for the account and streak data described above.
Cloudflare. Traffic routing and protection for our API.
RevenueCat. Purchase and subscription status.
PostHog (EU region). Product analytics.
Sentry. Crash and error reporting.
OneSignal. Delivery of push notifications.
Anthropic. Photo-mission verification. When you complete a photo mission the image is sent to Anthropic's Claude API to answer a single yes-or-no question, and is not used to train their models. It is the only processor that ever receives something you capture with the camera.
Apple and Google. Sign-in, payment processing and app distribution, acting as independent controllers under their own privacy policies.
Your rights
If the GDPR applies to you, you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, and to receive it in a portable form. The quickest route to deletion is Settings, then Delete my data, inside the app.
For anything else, email support@workyloop.com. You also have the right to complain to your local data protection authority; ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
International transfers
Some processors listed above are based in the United States. Where personal data is transferred outside the European Economic Area, the transfer is governed by the European Commission's Standard Contractual Clauses. We don't transfer personal data to jurisdictions without an adequate level of protection unless it's covered by appropriate safeguards.
Children
Waky isn't directed at children under 13 — or the higher minimum age of digital consent where you live — and we don't knowingly collect their personal data. If you believe a child has provided us with personal data, email support@workyloop.com and we'll delete it.
Changes to this policy
We may update this policy. When a change is material we'll say so in the app or on this page and update the date at the top.
Questions about your data? Email support@workyloop.com.