Privacy policy

Who we are and how to reach us

Operator: Wickrun Solutions Corp., [[Operator address]]. For privacy questions, requests or complaints, email [email protected]. We reply within 30 days.

What we process

The table lists each category with its purpose, where it is stored, how long we keep it and the legal basis. The legal basis column applies under the EU/UK GDPR; elsewhere we rely on the basis your local law provides, such as knowledge and consent under Canada’s PIPEDA.

Promotional QR link analytics: Cloudflare estimates the city from the visiting network. The analytics feature reads only the country, region and city to produce owner-only daily city totals, kept for the latest 30 UTC dates. VPNs, mobile networks and location databases can affect the estimate; missing locations are marked unknown. Visits are not unique people. This analytics database does not store full IPs, IP digests, network prefixes, precise coordinates, postal codes, visitor accounts, conversations or device fingerprints, and does not build individual visitor profiles. To deduplicate website-load confirmations, we briefly keep a random visit-code hash, campaign, date, city and arrival confirmation; codes are valid for 30 minutes and pruned after a one-day grace period. Daily campaign totals without geographic data may remain. When a social QR opens Instagram or LinkedIn, that service handles the subsequent visit under its policy; we cannot confirm that its page loaded. Social QR destinations entered by the site owner are encrypted on the server and editable only by authorized owner accounts; once enabled, anyone with the QR link can discover the destination through navigation. Copies in encrypted backups expire under the backup retention periods above.

Website operations analytics: public page loads and download clicks are summarized by fixed page and source categories and UTC date. Collection is off by default; when enabled, it uses no visitor identifiers, cookies or device fingerprints and respects DNT and GPC. City collection is enabled separately and retains 30 UTC dates. A random, account-unlinked one-time receipt expires after 10 minutes. Server activity records only account/day metadata for committed operations, without reading conversations, prompts, file content or project names. Account-day details are retained for 90 days and removed on account deletion; previously observed cohort contributions become aggregates without account identifiers. Other anonymous daily totals are retained for 13 months and accessible only to authorized site operators.

We do not collect precise location, contacts, SMS or call logs, we do not use advertising IDs, and we do not track you across other apps.

What end-to-end encryption covers

End-to-end encryption (E2EE) is on for every account and cannot be turned off. When you first sign in, the keys are created automatically on your device and kept on your devices; a new device must be approved by one that is already unlocked, or use your recovery code. We store only public keys and a recovery bundle sealed with your recovery code.

• Synced content (conversations, projects, settings, memory, Today Butler summaries, the file library, shared items and cloud workspaces, team calendars and goals, phone commands) is encrypted before it leaves your device. Neither we nor our providers can read it.
• Until your account's migration completes, data synced by earlier versions stays as it was; after it completes we delete the plaintext copies, and encrypted backups may hold them until they expire (up to 35 days). Shared files and cloud workspaces from earlier versions are replaced by encrypted copies and the originals are deleted.
• Requests to the hosted route are decrypted on your device and sent over TLS to our proxy, which forwards them to the model provider and does not store them; we keep the model, token counts and credits for billing.
• Public "anyone with the link" links keep working: content shared by a public link is readable by anyone who has the link (the key is in the link; for links made before 5.2 it is derived from the link's token, which our server sees whenever someone opens the link, though it stores only a hash).
• The Claude (MCP) bridge is an opt-in, per-project exception: tasks you hand to Claude through it pass through the server in plaintext.
• Calendar subscriptions and Google/Microsoft sync run on your device; the server only brokers the OAuth sign-in (it sees the token once, seals it to your device and keeps nothing). Published calendar feeds are not available. Calendar reminder emails carry no event text.
• Feedback you send us is sealed on your device once the operator key is set; until then it is stored in plaintext.
• Account email and name, billing records, device names, push tokens and the metadata sync needs (such as item IDs, times and sizes) are outside E2EE.
• If you lose your recovery code and have no unlocked device, encrypted content cannot be recovered.

Android: Today Butler phone data

• App usage time (Android Usage access): the number of minutes each app was in the foreground per day, with the app’s package name, name and system category. We do not read what you do inside apps. Finance, health and dating apps are never counted.
• Notification counts (Android Notification access): how many notifications each app posts per day. We never read notification titles, text, senders or images, and the app cannot reply to or dismiss notifications.
• Calendar: only the start and end times of today’s and tomorrow’s events. Never titles, attendees or locations.
• Place labels: a label you tap, such as “Home”, with the time. No location services are used.

Where it goes. These records are kept only on your phone (usage, notification and calendar records for at most three days, place labels for 30 days) and are never uploaded. On the phone they are turned into a few short daily summaries grouped by app category (for example “about 2 hours in coding apps yesterday”). Those summaries sync to your other devices only when end-to-end encryption is set up and unlocked, so neither we nor our servers can read them; if you are signed in to sync without encryption, no summaries are made. When the assistant runs, the summaries are sent as context to the AI model provider you configured, under that provider’s terms. We do not use this data for advertising, do not sell it and do not share it with anyone else.

Your controls. In Today Butler settings you can turn each source on or off (turning one off deletes its records), pause all collection, delete one source’s records, delete each summary, or delete everything at once. You can also withdraw the permission in Android settings at any time.

Android: accessibility service (screen context)

The Android app includes an optional accessibility service, WickrunContextService, that reads the visible text in apps you explicitly select, so you can use it as context when you ask the assistant something. It is off by default; you turn it on by agreeing in the app and enabling it yourself in Android settings.

• It reads only the apps you selected. It never reads password or text-entry fields, and it never taps, types or performs any action for you.
• While it runs, a notification is always shown so you know it is active.
• What it reads is kept in an encrypted temporary inbox on the phone, at most 24 items, and is not uploaded automatically. It is sent to the model provider you configured only when you choose to add it to a conversation.
• Turning the service off in Android settings stops it immediately.

Service providers

We share only what each service needs, and these providers process it for us under contract:

• Railway (United States): runs the web server and the PostgreSQL database.
• Cloudflare R2: stores larger synced files, media and encrypted backups.
• Google: Google sign-in, and Firebase Cloud Messaging (FCM) to send minimal wake-up messages to Android devices.
• Airwallex (once available): payment processing. Airwallex collects card details directly; we receive only the payment result, amount and plan.
• OpenRouter: when you use hosted routes, we pass your request to OpenRouter and the model provider behind it.
• Model providers you choose (such as OpenAI, Anthropic, Google or DeepSeek): when you use your own API key, requests go to them directly, or through our relay in the web app, under their own privacy policies. Local models run on your device and involve no one else.

We do not disclose your information to anyone else unless the law requires it, for example a valid court order. If we are involved in a merger or asset transfer, we will tell you first.

International transfers

Our servers and providers are located mainly in the United States and elsewhere, so your information may be processed outside your country or region (for example Canada, Hong Kong or the EU). We protect these transfers with our providers’ contractual safeguards, such as the EU Standard Contractual Clauses, and with the encryption described above. If you do not want data to leave your device, you can use the app without signing in.

Your rights and how to use them

Depending on where you live (including under Canada’s PIPEDA, Hong Kong’s Personal Data (Privacy) Ordinance, the EU/UK GDPR and California’s CCPA/CPRA), you can:

• Access and export: export local data in the app at any time, or ask us for a copy of your cloud data.
• Correct: edit it in the app, or contact us.
• Delete: delete individual conversations, projects, files, API keys or Butler data in the app; deletions sync to the cloud. To delete your whole account, see the next section.
• Withdraw consent: turn off sync, turn off Butler sources, or revoke permissions in system settings. This does not affect processing before you withdrew.
• Object to or restrict processing and data portability (GDPR), and complain to your regulator, such as the Office of the Privacy Commissioner of Canada, Hong Kong’s Privacy Commissioner for Personal Data, or your EU supervisory authority.

Notice for California residents (CCPA). The categories of personal information we collect are listed in the table above; they come from you and your devices. We do not sell or “share” (for cross-context behavioural advertising) your personal information, and have not in the past 12 months. We do not use sensitive personal information to infer characteristics about you. You have the right to know, delete and correct, and we will not discriminate against you for using these rights. An authorised agent may make a request for you.

To use any of these rights, email [email protected]. We may need to verify your identity, usually by a reply from your account email. We answer within 30 days, or tell you if the law allows us more time.

Deleting your account

You can delete your account in the app under Settings → Look → Account → Delete account, or without the app at wickrunai.com/account/delete. This is how it works:

1. Export first: the app can export your cloud data as a JSON file.
2. Confirm it is you: you need to have signed in with Google within the last 10 minutes, and you type your account email.
3. Straight away, every device, browser session and connector token is signed out.
4. A 7-day grace period follows. Signing in again during it cancels the deletion.
5. Then we permanently delete every database record of the account: synced data, files and media in Cloudflare R2, shared spaces you own and their content, devices and push tokens, cloud API keys, feedback and your sign-in identity. To meet tax obligations, payment records keep only the plan, amount, time and payment reference, under an anonymised id that cannot be linked to you, and are deleted after about 7 years.

Content you added to shared spaces that other people own belongs to those spaces and is not deleted with your account; delete it yourself first if you want it gone. Copies in encrypted backups are not edited individually; they expire with the backups (daily backups within 35 days, point-in-time data within 14 days). Local data on your devices is removed by deleting it in the app or uninstalling the app. If you cannot use either route, email [email protected] from your account email.

Children

The app is not directed at children under 13, or under 16 where local law, such as in the EU, sets a higher age. We do not knowingly collect children’s personal information. If you believe a child has given us information, contact us and we will delete it.

Security

We use HTTPS, database access controls, encrypted storage of sensitive credentials, checks on uploaded content, encrypted offsite backups, and end-to-end encryption for all synced content. No system is perfectly secure. If a breach affects your data, we will notify you and regulators as the law requires.

Changes to this policy

When we change this policy we update the effective date at the top. For significant changes we tell you in the app or by email beforehand. Continuing to use the app means you accept the updated policy.