Version 1.0 — August 2026
Privacy Policy
1. Who We Are
Weavely is a productivity application operated by Blue Cat Technologies, India. For privacy questions, contact our Grievance Officer at [email protected].
2. What We Collect
When you use Weavely, we collect the following personal data. Each item is listed with the purpose it serves and how long it is kept.
| Data item | Description | Retention |
|---|---|---|
| Email address | Your Google account email address, collected when you sign in. It is your account identifier and the address we use to communicate with you. | Until account deletion plus cooling-off period (7 days). |
| Display name | The name from your Google profile, or a name you provide. Shown to collaborators you share threads with. | Until account deletion plus cooling-off period (7 days). |
| Google account identifier | A Firebase-issued identifier that links your Weavely account to your Google sign-in. It is never shown to other users. | Until account deletion plus cooling-off period (7 days). |
| Thread content (titles, notes, cards) | Everything you write: thread titles, markdown notes, canvas cards, statuses, categories, and due dates. | Until you delete the thread (Trash: 7 days) or delete your account (7-day cooling-off). |
| Thread metadata (status, kind, dates, refs) | Status, whether an entry is a thread or a task, due date, and the auto-generated reference number (#REF) attached to each thread. | Same as thread content. |
| Change history | A record of changes made to your threads: which field changed, from what to what, and when. If you collaborated, this includes changes made by others on threads you own. | Until the thread is permanently deleted. Your identity is detached (actor_id → NULL) on account erasure; the record of the change survives. |
| Collaborator invitations and grants | When you invite someone to a thread, or someone invites you: the email address, role (viewer/editor), and acceptance status. | Until the thread is deleted, the grant is revoked (30-day retention), or your account is erased. |
| Public share links | When you create a public read-only link for a thread, the unguessable token that makes it work. | Until you revoke the link, the thread is deleted, or your account is erased. |
| File attachments | Files you upload to a thread: filename, size, type, and the file bytes stored in object storage. | Until you delete the attachment, the thread is deleted, or your account is erased. |
| IP address (truncated) | Your IP address at sign-in and during consent events, truncated to the /24 (IPv4) or /48 (IPv6) prefix. It is never stored in raw form. | Consent events: until account erasure. Access log: 400 days from the event. |
| Browser / device hint | A minimal device fingerprint (browser family and OS family) recorded with consent and in the security log. It is never stored as a raw User-Agent string. | Same as IP address. |
| Consent records | A record of every consent decision you have made: what you agreed to, which version of the notice, and when. | Consent events: until account erasure. Purpose consents: until account erasure. The final state is captured in the deletion audit record. |
| Security access log | A record of sign-ins, sign-outs, and security-relevant events, retained as required by Rule 6 DPDP Rules 2025. | 400 days from the event. On account erasure, your identity is detached (user_id → NULL); the record survives under a one-way hash for incident correlation. |
| Rights requests and responses | When you exercise a data-principal right (access, correction, erasure, nomination, grievance), a record of the request and its resolution. | Until account erasure, after which your identity is detached and the record survives under a one-way hash. |
3. How We Use Your Data
Your data is used only for the purposes listed below. We never sell your personal data to third parties.
Terms of Service(Document)
Acceptance of the Terms of Service, which govern your use of Weavely as a product.
Enables: Access to and use of the Weavely application.
Privacy Policy(Document)
Acknowledgement of the Privacy Policy, which explains how your personal data is collected, used, stored, and shared.
Enables: Transparency about how your data is handled.
Account provision(Essential)
Creating and maintaining your account: storing your email, name, and Google account identifier so you can sign in and the application can identify you.
Enables: Sign-in, account identity, and the ability to own and manage threads.
Content storage and retrieval(Essential)
Storing and serving the content you create: threads, notes, cards, statuses, categories, due dates, file attachments, and change history.
Enables: The core function of Weavely: creating, editing, organising, and retrieving your threads and notes.
Collaboration features(Essential)
Enabling you to share threads with other users: storing collaborator invitations, roles, and the roster disclosures that let collaborators see each other.
Enables: Thread sharing, collaborative editing, and the participant roster on shared threads.
Product analytics(Optional — you may refuse)
Collecting anonymised usage data to understand how Weavely is used and to improve the product.
Enables: Product improvement informed by how people actually use Weavely. — You may withdraw consent at any time in Settings.
Product updates(Optional — you may refuse)
Sending you occasional emails about new features, improvements, and changes to Weavely.
Enables: Staying informed about what is new in Weavely. — You may withdraw consent at any time in Settings.
AI / ML model training(Optional — you may refuse)
Using your content to train or improve machine-learning models. No ML pipeline currently exists in Weavely; this purpose is disclosed for transparency and will be offered as an explicit opt-in before any such processing begins.
Enables: Future AI features, if and when they are built. — You may withdraw consent at any time in Settings.
The following processing is required by law and is not subject to consent:
Security logging(Legal obligation)
Maintaining a security access log as required by Rule 6 DPDP Rules 2025: recording sign-ins, sign-outs, and security-relevant events with truncated IP addresses and minimal device hints.
Consent and compliance records(Legal obligation)
Maintaining records of your consent decisions, rights requests, and account deletion as required by the DPDP Act 2023: proof that consent was given, withdrawn, or that a right was exercised and honoured.
4. Who We Share Data With
Your data is shared with the following recipients, each of which is bound by contract to process it only for the purpose described.
Self-hosted by the operator on their own machine (beta)
Cloud infrastructure provider / processor (hosting, database, and object storage)
All stored personal data: database contents and attachment file bytes. MinIO runs on the same server as Postgres, so this is one processor, not two.
Bengaluru, India
Firebase Authentication (Google)
Authentication service provider / processor
Google account identifier (googleId) and email address at sign-in.
Global (Google infrastructure)
Transactional email provider (Resend or AWS SES)
Email delivery processor
Email address (for breach notifications, deletion confirmations, rights acknowledgements, and invite notices).
United States (Resend)
Thread collaborators (other Weavely users)
Independent data fiduciaries (each user controls their own account)
Your email address and display name, disclosed when you are invited to or collaborate on a thread. Thread content you can see is shared with you by the thread owner.
India (Weavely users)
Public (via share links)
Anyone with the share link
The content of the thread you chose to share (title, notes, cards, and attachment metadata — not attachment bytes).
Global (anyone with the link)
5. Your Rights (DPDP Act)
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access — download all your data from Settings at any time.
- Correction — update your name in Settings. For email changes, contact the Grievance Officer.
- Erasure — delete your account and all associated data from Settings (7-day cooling-off applies).
- Nomination — nominate another individual to exercise your rights on your behalf.
- Grievance — file a grievance with our Grievance Officer. We will respond within 7 working days and resolve it within 90 days.
To exercise any of these rights, visit Settings in the application, or contact [email protected].
6. Data Retention & Deletion
Individual threads are soft-deleted to Trash for 7 days, during which you can restore them. After that they are permanently deleted, along with their notes, history and attachments.
Account deletion triggers a 7-day cooling-off period, during which you can cancel; after it ends, all personal data is permanently erased. A record that a deletion occurred is preserved as required by law.
Content you contribute to another user’s thread stays with that thread when you delete your account; your name is removed from it.
Files you upload to another user’s thread count against their storage quota and are deleted when they delete the thread.
7. Security
We take reasonable security safeguards to protect your personal data, including encryption in transit and at rest, access logging, and Row-Level Security on the database. In the event of a personal data breach, we will notify affected users and the Data Protection Board of India without undue delay, as required under the DPDP Act.
8. Age Requirement
Weavely is intended for users aged 18 and above. We do not knowingly collect data from children. You must verify that you are 18 or older when creating an account.
9. Policy Changes
Material changes to this policy will be shown to you on next login. You will be asked to re-accept any purposes whose terms have changed before continuing to use the service.
10. Contact
Grievance Officer: Administrator
Email: [email protected]
Phone: +91-XXXXX4531
Postal: Nirupam Estate II, Narmadapuram Road, Bhopal - 462026
We aim to acknowledge your request within 7 working days and resolve it within 90 days.