Privacy Policy

Last updated: November 8, 2026

1. Overview

WidgetDash ("the App") is an iOS application that lets you push data from any service and display it on your iPhone home screen and lock screen widgets. This policy describes what data we collect, how we use it, and your rights regarding that data.

We believe in keeping things simple: we collect only what is necessary to provide the service, and we do not sell, share, or monetize your data in any way.

2. Data We Collect

When you use WidgetDash, we collect the following information:

• Account. When you open the iOS app, it creates a free account for you automatically, with a random name and no email address. If you sign up on the website instead, we store the email address you provide, used for account verification and communication, and the IP address and country the account was created from, used to prevent abuse.
• Password, stored securely using bcrypt hashing. We never store or have access to your plaintext password.
• Widget data, any data you push to the service via API calls. This is the content you choose to display on your widgets.
• API keys, generated for authenticating your requests to the service.
• Device push tokens (device identifiers), collected only if you turn on notifications in the iOS app or use the Live Activities feature (Pro). The app registers an Apple push token with our server so we can deliver notifications or real-time Live Activity updates to your device. They are used exclusively for that delivery, are never used for advertising or tracking, are never sold or shared, and are deleted when you turn notifications off, when the related activity ends, when Apple reports the token is no longer valid, or when you delete your account.
• Feedback you send, the answers you give in our optional feedback survey or support form, plus your email address if you share it or reached the survey from an email we sent you.
• Transit trips, if you save a bus or train trip: the bus stop codes, line and train stations you choose, how long you walk, and the trip’s name. While the trip’s Live Activity runs, our server asks public transit services (Open Bus by the Public Knowledge Workshop, curlbus, and Israel Railways) for the times at those stops and stations. It sends them only the stop and station numbers, never who you are. You can delete a trip at any time, and your trips are deleted with your account.
• Assistant conversations, if you use the “Ask” assistant in the iOS app: the messages you write, the answers you get, and any reply we add.
• Usage events. Our server records product events, such as an account being created, a source being added, notifications being turned on or off, a Live Activity starting, or the assistant or the free sources being opened in the app. Each event is linked to your account and stored with the app version or browser (user agent), your approximate country, and a salted, non-reversible hash of your IP address.

Beyond what is listed above, we do not collect precise location, contacts, photos, or other personal information, and no device identifier is collected other than the push tokens described above (and only when you turn on notifications or use Live Activities). Analytics are first-party only: we use no third-party analytics or advertising SDKs. See “Cookies and Tracking” below.

3. How We Use Your Data

Your data is used exclusively to provide the WidgetDash service:

• Email, to verify your account, send password resets, communicate important service updates, and occasionally ask for your feedback.
• Password, to authenticate you when you log in.
• Widget data, to store and deliver the content you push so it can be displayed on your widgets.
• API keys, to authenticate API requests from your scripts and automations.
• Device push tokens, to send the notifications you turned on and Live Activity updates to your device through the Apple Push Notification service — nothing else.
• Usage events, to understand how the app and website are used, measure sign-ups and upgrades, and find problems. Never for advertising.
• Feedback, to understand what works, fix problems, and decide what to build next. We contact you about your answers only if you say we may.
• Assistant conversations, to answer your questions about setting up your widgets, and so we can read them, add a reply in the app, and learn what people want to see.

4. Data Sharing

We do not sell, rent, or trade your personal data, and we never share it for advertising.

To run the service, we use these providers, which process data on our behalf and only for that purpose:

• Hetzner (Germany): hosts our servers and database.
• Cloudflare: delivers our website and API, so it handles the IP address of every request.
• Lemon Squeezy: sells Pro subscriptions as the merchant of record and processes payments. Your card details go to them; we never see them.
• Resend: sends our emails (account verification, password resets, and messages we send you).
• Google Workspace: hosts our support inbox, so messages you send us are stored there.
• Apple (Apple Push Notification service): delivers notifications and Live Activity updates to your device.
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): writes the assistant’s answers using its AI model. Only when you use the assistant, and only after you agree in the app, we send it what you write to the assistant, the recent conversation, the names of your sources, and our public documentation. We never send your email address, API keys, or the values on your widgets. DeepSeek processes and stores this data in the People’s Republic of China, and its privacy policy says it may use it to improve its models.

We do not use third-party analytics services, advertising SDKs, or cross-site trackers of any kind, and the app contains no third-party SDKs that collect user data.

5. Cookies and Tracking

The WidgetDash iOS app does not use cookies and contains no third-party SDKs, advertising, fingerprinting, or cross-app tracking. Our server records the usage events described in section 2 when the app talks to it.

Our website uses privacy-friendly, first-party analytics to understand aggregate usage (page views and product events such as sign-ups and source additions). Specifically:

• We store a random, first-party session identifier in your browser's local storage. It is not a cross-site tracking cookie and is not shared with anyone.
• We are comparing two designs of our home page. A first-party cookie, wd_home, remembers which one your browser was shown (it holds only the letter “a” or “b”) for 90 days, so you keep seeing the same one. The site's other pages read it too, to show the same design. Page views and clicks on the home page record that letter, so we can tell which design helps visitors more.
• To estimate unique visitors, we store a salted, non-reversible hash of your IP address. Our analytics never store the IP address itself.
• We use no third-party analytics, advertising SDKs, fingerprinting, or cross-site tracking. All analytics data stays on our own servers and is never shared or sold.

6. Data Storage and Security

Your data is stored on our server infrastructure. We take reasonable measures to protect your information:

• Passwords are hashed using bcrypt before storage.
• API communication is encrypted via HTTPS.
• API keys are used for request authentication.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your data for as long as your account is active. Widget data is stored until you delete it or overwrite it with new data. When your account is deleted (see “Your Rights”), all associated data (email, hashed password, API keys, widget data, any device push tokens, and assistant conversations) is permanently removed from our servers, and usage events are kept only without any link to you.

8. Your Rights

You have the right to:

• Access your data. View your account information and widget data at any time through the app or API.
• Delete your data. Delete your account yourself at any time: in the iOS app (Account → Delete Account) or on the website (Account → Delete account). It takes effect immediately, cancels an active Pro subscription, and permanently removes your account and all associated data. You can also email us at [email protected] from your account's email address and we will do it within 30 days. Usage events are kept only without any link to you.
• Export your data. Retrieve your widget data via the API at any time.
• Correct your data. Update your email or password through the app.

To exercise any of these rights, contact us at [email protected].

9. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence. By using the Service, you consent to the transfer of your information to facilities outside your jurisdiction. We take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy. If you use the in-app assistant, what you write to it is processed in China by DeepSeek (see section 4).

10. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal basis for processing: We process your data based on (a) your consent when you create an account, (b) the necessity to perform our contract with you (providing the Service), and (c) our legitimate interest in operating and improving the Service.
• Right to access: You may request a copy of your personal data.
• Right to rectification: You may request correction of inaccurate data.
• Right to erasure: You may request deletion of your personal data.
• Right to restrict processing: You may request that we limit how we use your data.
• Right to data portability: You may request your data in a structured, machine-readable format.
• Right to object: You may object to our processing of your data.
• Right to withdraw consent: You may withdraw consent at any time by deleting your account.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

11. California Users (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of your personal information.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.
• No sale of data: We do not sell, and have never sold, personal information to third parties.

12. Children's Privacy

WidgetDash is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Disclaimer

WidgetDash displays data that you push to the Service. We do not verify, validate, or guarantee the accuracy of any data displayed through our widgets. You are solely responsible for the data you push and any decisions made based on that data. We accept no liability for any loss, damage, or harm arising from reliance on data displayed through WidgetDash.

14. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify registered users via email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes constitutes acceptance of the revised policy.

15. Terms of Service

Your use of WidgetDash is also governed by our Terms of Service, which include important provisions regarding disclaimers of warranties, limitation of liability, and indemnification.

16. Contact

If you have questions or concerns about this privacy policy or your data, contact us at:

[email protected]