Wivlo

Last updated July 25, 2026

Privacy Policy

This policy explains how Wivlo handles personal information for the Wivlo web and mobile apps.

Information we collect

  • Account information such as email address, authentication provider identifiers, profile details, and account settings.
  • Workspace content you create, edit, upload, import, search, or sync, including notes, folders, tags, projects, references, imported conversations, images or other note assets, source URLs copied into notes, search history, AI prompts, AI outputs, and note metadata.
  • Purchase and subscription metadata handled through Stripe on web, or Apple App Store / Google Play billing where mobile in-app purchases are enabled, such as plan, billing cycle, renewal status, customer identifier, receipt or transaction identifiers, and entitlement records. Wivlo does not store full payment card numbers.
  • Device, diagnostics, usage, advertising, and analytics data such as device type, operating system, app version, screen size, locale, time zone, crash or error signals, feature interactions, approximate network information, ad interactions, advertising identifiers where permitted, analytics client identifiers, experiment assignment, and remote-config eligibility.
  • Support and account-deletion request information, such as reply email, subject, message, request context, signed-in account email, and support delivery metadata.

How we collect information

  • We collect information when you create an account, sign in with Google or Apple, create notes, upload or copy images into notes, search your workspace, connect references or projects, use AI features, contact support, subscribe to Wivlo Plus, request account deletion, or interact with the web or mobile app.
  • Some data is received from service providers used to operate Wivlo, such as Google or Apple sign-in, Stripe, App Store billing, Google Play billing, AI providers, analytics providers, advertising SDKs, hosting providers, email delivery providers, or error-reporting tools.

Processing locations and international transfers

  • Wivlo’s primary account, database, and file-storage region is Tokyo, Japan, through Supabase, Inc., a United States company. Account identifiers, notes, projects, tags, transcripts, summaries, images, and voice assets saved on web are sent by HTTPS when you create, edit, or upload them and are processed for authentication, sync, storage, backup, and recovery until the account or content is deleted. Supabase stores and primarily processes customer data in the selected region, subject to limited processing elsewhere when required by law or requested services. Contact: privacy@supabase.com.
  • Vercel, Inc. hosts Wivlo’s web application and API. IP addresses, request metadata, authentication identifiers, and content needed to fulfill a request may be processed in the United States and Vercel subprocessor locations for hosting, API execution, security, and incident response. Vercel can be contacted at privacy@vercel.com.
  • When you use AI or voice features, request content, prompts, original audio, language information, transcripts, and summary requests are sent by HTTPS to OpenAI, OpCo, LLC in the United States and its disclosed subprocessors. API inputs are not used for model training by default. OpenAI currently lists no abuse-monitoring or application-state retention for audio transcription; Responses API content used for summaries may be retained for up to 30 days for abuse monitoring even when store=false. OpenAI can be contacted at privacy@openai.com.
  • You can refuse voice-feature transfers by not starting a recording or revoking microphone permission; voice features will then be unavailable, but typed notes remain available. If you do not want account or workspace data stored in Japan, do not create an account or upload content, or delete existing content or your account; account-based sync and storage cannot then be provided.

How we use information

  • To provide synchronized notes, tags, projects, references, AI assistance, billing, support, account, and settings features across web and mobile.
  • To authenticate users, secure accounts, prevent abuse, troubleshoot errors, and maintain service reliability.
  • To process subscriptions, manage Wivlo Plus entitlements, send billing notices, and respond to support requests.
  • To store and display uploaded note assets, copy external images into Wivlo-controlled storage, keep signed asset URLs short-lived, synchronize search history where enabled, and manage device sessions.
  • To improve Wivlo through aggregated or limited analytics, remote configuration, experiments, feature reliability measurement, debug logs for allowlisted testers, display or measurement of ads where an advertising SDK is enabled, and App Store, Google Play, tax, accounting, legal, and security requirements.
  • Wivlo does not send raw note body text, note titles, image URLs, uploaded assets, raw search queries, or raw note prompts to analytics warehouses such as BigQuery for product analytics. Product analytics uses minimized derived data such as note length, tag count, created day, language, image presence, AI action counts, plan, device type, and reliability status.
  • Tag names can be personal. Where practical, analytics should use tag identifiers, tag color, tag count, or tag length instead of raw tag names.

AI processing and model improvement

  • When you use WivloAI, Wivlo may send the note content, selected text, tags, imported conversation excerpts, image or asset metadata, and surrounding context needed to answer that specific request to AI providers such as OpenAI or Google Gemini / Google AI.
  • Background AI analysis is enabled by default for active notes and may run automatically when notes are created or updated. It creates compact knowledge metadata, related-note context, suggested titles, suggested tags, summaries, or search/recommendation signals, subject to product configuration, rate limits, and cost controls.
  • If embedding features are enabled, Wivlo may send the text needed to create vector embeddings to an AI provider. Embeddings are used for search, related-note, memory, or recommendation features, not to publish your content.
  • Wivlo may route a request to OpenAI or Google Gemini / Google AI according to server-side model configuration. AI usage logs may record the feature, provider model, token or credit usage, status, and timestamps for billing, abuse prevention, reliability, and cost control; product analytics does not include the raw prompt or raw note content.
  • AI providers are used to process your request, not to let Wivlo sell your notes or publish your content. Wivlo does not use raw note content for AI model training or model improvement unless you separately opt in.
  • Do not place information in Wivlo or use AI features for content you do not want processed by Wivlo infrastructure or by the AI providers needed to provide those features.

Voice memos and audio processing

  • When you intentionally start a voice memo or voice input in a note, Wivlo requests microphone permission and records audio. Recording may continue while you use another screen in the app until you stop or cancel it, and Wivlo shows recording status in the app and supported system surfaces.
  • A temporary recording file is created on the device and sent over encrypted transport to the Wivlo API and OpenAI to create a transcript and summary. Audio inserted into a note is saved as a private, account-scoped workspace asset and played through a short-lived access URL.
  • The original audio, transcript, and AI-generated summary are linked to the selected note, synchronized and retained like other note content, and become subject to deletion when you remove the audio block, note, or account.
  • For reliability, usage limits, and abuse prevention, Wivlo may record the user identifier, recording duration, target type, processing status, transcript and summary lengths, and summary source. Product analytics does not include the original audio or raw transcript.
  • The overseas processor is OpenAI OpCo, LLC and its subprocessors. Audio, language code, transcription guidance, transcript, and summary request are transferred by HTTPS when you use the feature to the United States and processing locations disclosed by OpenAI for transcription and summarization. OpenAI’s published API data policy states that the audio transcription endpoint is not used for training and has no abuse-monitoring or application-state retention; summary requests may be retained for up to 30 days for abuse monitoring depending on account controls. Current processing locations are listed at https://openai.com/policies/sub-processor-list/.
  • Voice memos are optional. You can avoid the feature or revoke microphone permission in device settings. Do not record sensitive information or another person’s voice if you do not have the required authority or consent.

Sharing and processors

  • We use service providers such as Supabase for authentication, database, storage, and edge infrastructure; Vercel for web hosting and API runtime; OpenAI and Google Gemini / Google AI for AI processing; Stripe for web billing; Apple and Google for sign-in, app distribution, and app-store billing; Firebase Analytics and Google Analytics for measurement where enabled; Google BigQuery for minimized derived product analytics where enabled; Google Mobile Ads / AdMob for ads where enabled; Resend for support email delivery where enabled; and error-reporting or debugging providers where enabled.
  • We do not sell personal information. We share data only as needed to provide Wivlo, comply with law, protect rights and safety, or process payments.
  • Third parties that process Wivlo user data must protect that data in a manner consistent with this policy and the platform requirements that apply to their role.

Apple App Store and Google Play disclosures

  • Wivlo discloses applicable collection and sharing by Wivlo and integrated third-party SDKs in the App Store privacy details and Google Play Data safety section.
  • Depending on enabled features, those store disclosures may include user content, images or other assets, search history, identifiers, purchases, product interactions, advertising data, diagnostics, support messages, and data handled by analytics, advertising, billing, or AI services.
  • Most account, workspace, purchase, diagnostic, usage, search, and support data is linked to your Wivlo account or device because it is needed for sync, entitlement, support, security, or reliability.
  • If Wivlo uses data for tracking as defined by Apple, or accesses identifiers such as the IDFA for advertising, the app must request permission through AppTrackingTransparency where required. If you decline or revoke that permission, Wivlo will not use the restricted identifier for tracking.
  • Google Play requires an in-app path and an external web path for account deletion. Wivlo provides account deletion in settings and at /account/delete.

Retention, deletion, and account removal

  • Workspace data is retained while your account is active or until you delete it. Deleted data may remain in backups for a limited period before routine removal.
  • You can request account export, correction, or deletion through settings, support, or /account/delete. When your account is deleted, Wivlo deletes active account records, notes, note assets, memory metadata, projects, search history, device sessions, integration records, AI usage logs, support-linked account metadata, and billing entitlement records under Wivlo control unless retention is required for billing, security, legal, tax, audit, dispute, chargeback, fraud-prevention, or platform-compliance obligations.
  • When notes or accounts are deleted, Wivlo deletes raw workspace content from active storage and deletes or de-identifies analytics records that can reasonably be linked to your account, unless retention is required for the limited obligations described above. Payment processors, app stores, and infrastructure providers may retain their own records under their policies and legal obligations.

Security and international processing

  • We use access controls, encrypted transport, row-level access rules, and least-privilege service access where practical. No online service can guarantee absolute security.
  • Your data may be processed in countries where Wivlo or its service providers operate. We use service providers with contractual and technical safeguards appropriate to their role.

Your choices and rights

  • You can sign out, change language and theme settings, manage billing, delete notes, clear supported search history, and request account deletion or data access through settings or support.
  • Depending on your region, you may have rights to access, deletion, correction, portability, objection, restriction, or withdrawal of consent.
  • You can change platform-level ad tracking and privacy permissions in iOS or Android settings.

Children

  • Wivlo is not directed to children. If you believe a child provided personal information to Wivlo, contact us so we can review and delete it where required.

Contact

  • For privacy questions, data requests, account deletion, or legal inquiries, contact Wivlo through the support form.
Terms of ServiceRequest account deletionContact Wivlo