Local preview, not published. This page renders the supplied legal file without changes. Marked items are placeholders the founder must fill before going live.

wbu privacy policy

Version 1.0. In force from 2 November 2026.

This is the full privacy policy for wbu. There is a shorter version for 13 to 17 year olds at wbu-app.com/privacy-teens. If the two ever seem to disagree, this one is the one that counts, and you can ask us to explain.

1. The short version

  • What you write in wbu is just for you unless you choose to share it. Nobody can see that your private entries exist.
  • Your voice is turned into words on your phone. The recording only leaves your phone if you choose to send a check-in as a voice note.
  • When you share the usual way, only the parts you tick are sent to an AI service. It writes a gentle summary for the person you picked. They do not see your exact words.
  • If you switch on Talk it through with Lila (a Pro feature), the entry you are talking about and the chat are sent to the same kind of AI service. You agree to that separately, and only once you choose.
  • We do not sell your data. We do not use your entries to train AI models. At the moment there are no ads in wbu, and no advertising or tracking tools.
  • Free accounts see the last 7 days, and older entries are deleted. Pro keeps your history from the day you subscribe.
  • There is no download button. To get a copy of your data, email hello@wbu-app.com. It is free and we reply within one month.
  • You can delete your account in the app at any time.

2. Who is responsible for your data

Hasinc Ltd, trading as wbu ("wbu", "we", "us") is the controller of your personal data. That means we decide why and how it is used.

We do not have a data protection officer, because the law does not require us to have one at our size. Please email hello@wbu-app.com and your message will be read by the founder.

Apple and Google run the app stores, take payments and deliver notifications. For those things they are responsible under their own privacy notices.

Some of what you tell wbu is about how you feel. That can count as special category data (information about health). We only use it with your explicit consent (UK GDPR Article 9(2)(a)). You give that consent on its own screen when you start. You give a separate consent before your first AI summary, before your first voice note, and before you use Talk it through with Lila.

What Why we use it Our legal basis
Phone number To sign you in, send your code, and let people you know link with you. We keep a scrambled version (a keyed hash) so someone who types your number can send you a request, and so a block works. Your number is never shown to other users. Contract; our legitimate interest in security and preventing fraud
Display name So people you link with know who you are Contract
Age information To check you are old enough and to apply the right rules. We store your date of birth, encrypted, until you delete your account. If someone is under the minimum age, nothing is stored. Legal obligation and legitimate interest (keeping children out); consent record
Your entries: your words, the five-point status, feelings, causes, celebration tag, topic sections, and who you chose to share which parts with To run your diary and share what you choose Explicit consent
Voice notes (only if you choose to send one) To save a check-in as your own recording, or to send it whole to the people you ticked instead of a summary Explicit consent, asked once before your first voice note
AI summaries written for each person or circle you share with To give the recipient a gentle write-up Explicit consent, asked before your first share
Talk it through with Lila: the entry you choose and what you and Lila write in the chat To let you think an entry through with an AI companion. Pro only. Explicit consent, asked once, with its own screen
What Lila remembers (only if you switch Memory on and tap "Remember this") So Lila can remember things you choose, for example the name of a friend Explicit consent. Memory is off unless you turn it on
Comments, replies and reactions So the people you shared with can answer Contract; explicit consent where what is said reveals health
Seen ticks: whether and when someone opened what was shared with them To show the sender it was delivered and seen. On by default. You can turn it off in Settings. Contract and legitimate interest
Profile photo (only if you add one) So people you are linked with and people in your circles recognise you. Never public. Consent
"I'm not OK" alerts (no free text) and their delivery status To tell the people you choose that you are not OK, when you press the button Your explicit consent and your own action
Links, blocks, requests and invites To connect people who both agree, and to make blocks work Contract; legitimate interest in keeping people safe
Streak and check-in days To run your own streak. Only you see it. Contract
Reports you make, or that are made about you To look into abuse and keep people safe Legitimate interest; legal obligation
Subscription status (from Apple or Google) To unlock Pro or a circle Contract
Technical data: device token for notifications, app version, IP address in server logs To deliver notifications, protect the service and fix faults Legitimate interest
Totals that are not about any one person To see whether wbu works, for example how many people check in each week. Small counts are not shown. Legitimate interest
Your consent choices To show what you agreed to and when Legal obligation and legitimate interest
Emails you send us To answer you Legitimate interest; legal obligation

What we do not collect.

  • Your address book. To link with someone you type their number or pick one contact in your phone's own contact picker. wbu receives only that one number.
  • Your location.
  • An email address (unless you email us).
  • Advertising identifiers.
  • Your photo library. Your phone's own picker gives us only the one photo you choose.
  • Recordings of your voice, unless you choose to send a voice note.

Other people in your entries. If you write about someone else, that is their information too. We use it only to run your diary and the shares you choose. See section 12.

4. What stays on your phone

  • Your voice. Speech is turned into words on your phone. The audio is held in memory only. It is not saved and not uploaded, unless you choose to send a voice note.
  • Topic sections and titles. Your phone splits what you say into topics and makes the title and the "for you" summary of your entry. This happens on your phone.
  • Looking back over your own private diary. Anything that looks back over your own private entries is made on your phone. The one exception is Talk it through with Lila, which you switch on yourself.
  • Your evening reminder. It is set on your phone. Our servers do not know when it fires.

5. How the AI works

We use AI in three places. In each one, you choose.

A. Gentle summaries for people you share with.

  • Only the sections you tick are sent. One request is made for each person or circle.
  • The AI rewrites your words in a gentle way for the recipient. It does not diagnose, score or judge anything. It does not change your status.
  • The recipient sees that it was written by AI and is not your exact words.
  • A voice note is never sent to the AI.
  • Parts you did not tick stay private and are not sent.

B. Weekly recap ("Your week", Pro, if you switch it on).

  • A recap for a person or circle is written from the summaries already delivered to them that week. Nothing private or unticked goes into it.

C. Talk it through with Lila (Pro, if you switch it on).

  • Lila is an AI. She is not a person.
  • When you start a chat, the entry you are talking about and what you write in the chat are sent to the AI service. This is the one case where a private entry can go to the AI, and it happens only because you chose it.
  • Lila never sends anything for you and never contacts anyone.
  • If you write in a chat about hurting yourself, Lila replies with one short fixed message. It points to the raised-hand button and to free support. wbu does not flag, score or report you, and nobody is told. The message is the only effect.
  • A chat is saved with the entry it is about. It is kept and deleted with that entry.
  • Memory is off unless you turn it on. You can see everything Lila remembers and delete each item.
  • You can turn Lila off in Settings at any time.

Who runs the AI. We plan to use Amazon Web Services (AWS) through its Amazon Bedrock service. We send requests to AWS, not to the company that made the model. We are putting written terms in place with our AI provider, covering where the AI models run, how what we send is handled and kept, and that it is not used to train AI models. Until those terms are in place, no real entries are sent to the AI. We may change which model or provider we use. When we do, we keep this policy and our list of providers up to date.

What we do with the AI.

  • We do not use your entries to train AI models.
  • We only send what is described in this section. What comes back is stored encrypted with your entry.
  • Nothing happens automatically because of what you write. A person decides, or you do.

6. Who we share data with

  • People you choose. They get the AI summary of the parts you ticked, or your whole voice note if you chose that.
  • People you are linked with, and people in your circles. They see your display name, your profile photo if you add one, comments on entries they received, and (if seen ticks are on) whether you have seen what they shared.
  • Our service providers (processors). They act on our instructions under written terms. They are:
Provider What it does for wbu Data it handles
Supabase Database and sign-in Account and entry data, with content stored encrypted
Amazon Web Services (Amazon Bedrock) Runs the AI models The text described in section 5
Twilio (or a similar SMS service) Sends sign-in codes by text Your phone number and the code
Zoho Company email Emails you send to us
Cloudflare, Inc. (Cloudflare Pages and DNS) Hosts this website and delivers it through its global network Visitors' IP addresses and the pages asked for, in server logs and network records, kept for the time Cloudflare's own terms provide. Cloudflare may process this data in the United States and other countries.
  • Apple and Google. They run the app stores, subscriptions and notifications. Notifications carry the sender's name and never what was written. If the app crashes, Apple or Google may give us a technical crash report with no entries or names in it.
  • Authorities, advisers and insurers. When the law says we must, to protect someone from serious harm, or to get legal advice.
  • No one else. We do not give your data to advertisers, data brokers or analytics companies.

We keep this list up to date. If we add a provider that handles your data, we will update this policy before it starts.

7. Where your data goes

  • We choose UK or EU data centres for our database. For the AI models, see section 5: we are putting written terms in place with our AI provider.
  • Some providers may handle limited data outside the UK and EU, for example in the United States. This can apply to text-message sign-in, Apple, Google and email. When it does, we rely on approved safeguards. These include UK adequacy rules, the UK–US data bridge for providers that are certified, and the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
  • You can ask us for details of the safeguards by emailing hello@wbu-app.com.

8. How long we keep it

Data How long
Entries on a Free account The last 7 days. Older entries are deleted automatically.
Entries on Pro Kept while you subscribe, from the day you start. Pro cannot bring back days already deleted.
Entries made on Pro, after Pro ends We keep them until you delete your account or delete them yourself. You see only the last 7 days. The rest shows again if you subscribe again. Entries you make on Free follow the 7-day rule.
Voice notes With their entry. Deleted when the entry is deleted.
AI summaries the recipient received As long as the entry. They go if you delete the entry, unlink, block, or delete your account.
Chats with Lila With the entry they are about.
What Lila remembers Until you delete it, or delete your account.
Comments, reactions and seen ticks As long as the entry they are on. People can remove their own comments.
Profile photo Until you change or remove it, or delete your account.
"I'm not OK" alerts As long as your diary history: 7 days on Free; on Pro, as long as your Pro history, which after Pro ends means until you delete your account.
Link requests and invites 7 days if not accepted.
Shares waiting for someone to accept Up to 7 days. If they do not accept, they are not sent and stay private.
Streak Until you delete your account. Check-in days: the last 60 days.
Reports 12 months after we finish looking into them. Longer only while a legal claim, regulator request or safety referral is open.
Server logs Up to 14 days.
Backups Up to 7 days after deletion, then overwritten.
Blocked numbers (scrambled) Kept so a block still works if someone makes a new account, until you delete your account.
Records of your consent choices For as long as we need to show what you agreed to. After you delete your account we keep only minimal details (a coded user ID, the type of consent and the dates).
Emails you send us As long as needed to answer you. Our email provider may keep backup copies for some months after deletion.
Account details Until you delete your account.

Deleting your account. In Settings, hold to delete, then confirm with Face ID or your passcode. You become invisible to other people straight away. You can undo it for 7 days. After that your content is deleted. Backups clear within their own 7 days. The people you were linked with stop seeing anything from you and are not told.

9. Your rights

Under UK GDPR you can:

  • Be told how we use your data (this policy).
  • Get a copy of your data. There is no download button in the app. Email hello@wbu-app.com and say what you would like. You do not need legal words. It is free. We reply within one month. If your request is complex we may need up to two more months, and we will tell you within the first month. To check it is really you, we send the usual sign-in code to your wbu phone number. The copy includes everything we hold about you: entries (including older Pro entries hidden on Free), voice notes, the AI summaries written from your entries, chats with Lila, comments, alerts, links and settings.
  • Correct your data. You can write a new entry. For anything else, email us.
  • Delete your data. Use Settings, or email us. For example, you can ask us to delete older Pro entries you can no longer see without closing your account.
  • Restrict or object to some uses. Email us.
  • Move your data. Ask for a copy in a structured file that you can reuse.
  • Withdraw consent at any time in Settings. If you withdraw consent to store your diary, we delete your diary and close your account, because we cannot run a diary without storing it. If you withdraw consent to AI sharing, you can still use wbu, but you cannot share summaries. You can also turn off voice notes, seen ticks and Lila in Settings.
  • Complain. Please tell us first at hello@wbu-app.com so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint (checked 1 November 2026).

10. Children and young people (13 to 17)

  • You must be at least 13 to have a wbu account. If you are younger we cannot make one. wbu is in family beta in the UK. When we open elsewhere we will say so, and some countries have a higher minimum age.
  • Young people get the same privacy as adults, and the same default: nothing is shared unless you choose.
  • We follow the ICO's Children's Code. That means high privacy by default, no profiling, no location tracking, and no ads.
  • Written replies in your own words are off by default for under-18s. You can switch them on.
  • If you link with a parent or carer, they see only what you choose to share with them, your name and photo if you add one, comments on entries you both received and, if seen ticks are on, when you have seen what they shared. They never see your private entries or that they exist. We do not tell a parent when you link or what you write.
  • Seen ticks are on by default for everyone. You can turn them off in Settings.
  • Talk it through with Lila is available to 13 to 17 year olds who choose it, with the same separate consent and the same rules.
  • A person at wbu reads reports. Nothing happens automatically because of what is written in an entry or a reply.
  • A shorter version for teenagers is at wbu-app.com/privacy-teens.

11. Profiling and automated decisions

We do not profile you. We do not make decisions about you by automated means that have legal or similarly significant effects. Which entries you see, and when, is never decided by what you wrote. The AI only rewrites what you chose to share, or talks with you if you choose Lila.

12. Other people named in your entries

We do not tell every person you mention that you wrote about them. They can ask us what we hold about them. We will look at each request carefully, and balance it with your privacy. Email hello@wbu-app.com.

13. Security

  • Data is encrypted when it travels to and from our servers.
  • Entries, summaries, voice notes and photos are stored encrypted.
  • Entries are not end-to-end encrypted. Our systems can read them in order to run wbu, so we do not claim that nobody at wbu could ever reach them. We limit and log who can reach our systems.
  • We do not use advertising, tracking or analytics software in the app.
  • If a breach puts you at risk, we will tell you and the ICO as the law requires.
  • Found a security problem? Email hello@wbu-app.com and write "Security report" in the subject. See wbu-app.com/security.

14. "I'm not OK" and emergencies

wbu is not an emergency or crisis service and does not watch what you write. "I'm not OK" is a button you press. It sends your alert to the people you choose. We cannot promise they will see it or reply. If you or someone else is in danger, call 999 in the UK. Support lines are on our support page.

15. Subscriptions and payments

Apple or Google takes the payment. We receive only whether your subscription is active. See section 8 for what we keep when Pro ends.

16. Cookies and tracking

None beyond what is strictly necessary. See wbu-app.com/cookies.

17. Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before the change applies, and ask for your consent again if the law requires it. For example, there are no ads in wbu today. If that ever changes, we will update this policy first, say exactly what data would be used, and ask for your consent where the law requires it. We would not use your entries, moods or what you share for advertising. Earlier versions are available on request.

Hasinc Ltd, trading as wbu

wbu is in family beta. It isn't in the App Store or Google Play yet.

Email us