Privacy notice

WENUP app · Effective 7 November 2026

1. Data controller

The WENUP app is provided by an individual developer in Thailand ("we"). Contact us about personal data at support@wenup.app.

2. Data that stays on your phone

What you enter in the app is kept in a database on your phone and is not sent to us (except the shifts you share with a group — see Groups and your account): your shifts, shift types and times, day notes, rotation patterns, swap records and the colleagues' names you type, the salary and pay rates you enter, and your settings.

• Backup files are created when you back up, and saved wherever you choose (Files, Google Drive, LINE…). We don't receive them.
• Your phone's own backup. If iCloud Backup (iPhone) or Android backup is on, the app's data may be included in your phone's backup, which Apple or Google keeps in your account under your own settings, and which can move it to a new phone. We don't receive it. You can turn it off in your phone's settings.
• Shared roster images are made on your phone and leave it only when you share them. They carry no name of yours; colleagues' names appear on swap lines only if you turn that option on, and your day notes only if you turn on “Show day notes”.
• Widgets, reminders and alarms are built and scheduled on your phone, not through our servers. Home-screen widgets can show your day notes (switch them off in Settings › Widgets); lock-screen widgets never do. The To-Do widget shows your task titles on the home screen once you add it, and a task reminder shows the task's title in the notification (on the lock screen your phone can hide it, depending on its settings).
• Colleagues' names you save are other people's data; please keep only what you need to track your own swaps.

Deleting the app deletes this data, unless you have kept a backup.

3. Data that leaves your phone, and where it goes

Phone ID: the app sends our server the phone ID described in the groups row when you use groups, Invite friends or roster scan, even before you sign in, to prevent excessive use and so the same phone can't count as a new friend twice. Our server keeps only a keyed hash of it. It is never used to track you across other apps or websites, and is never given to our advertising or analytics providers.

Groups and your account

Groups are optional. The calendar, reminders, widgets and Pro need no sign-in; you sign in only to use groups.

• Sign-in. LINE, Google or Apple sends us a user ID used only for this app and the name on that account (Apple sends the name only the first time, and only if you allow it). We don't keep your email, phone number or profile photo from those accounts, even when a provider includes them. With Apple, we keep an encrypted token only so we can disconnect from Apple when you delete your account. Each sign-in method is a separate account.
• What group members see: your nickname, profile photo (if any), your role (owner or member) and your shifts for last month, this month and next month, in the shift names and colours you set — only the shift types you choose to share with that group. On a work or leave day whose type you don't share with it, the group sees only “busy” (an unshared day off stays empty). A type you share with no group never leaves your phone; only “busy” on those days does. Never your notes, full shift-type names, colleagues' names, swaps, hours or pay. Anyone with an invite code or link sees the group's name and member count before joining.
• Sharing your shifts. While you are in at least one group, the app sends this month's, last month's and next month's shifts when you edit your calendar or open the app. Being in a group means sharing with it; to stop, leave the group. Once you are in no group (you left, were removed, or the group was deleted), your shared shifts are deleted from our server.
• Profile photo. You choose or take it. The app shrinks it to 256 pixels and removes the photo's hidden data (such as where and when it was taken) before sending, and the server strips it again. Only you and members of your groups can see it, and you can remove it at any time.
• Pro and groups. Pro is not tied to your groups account; it stays with your Apple ID or Google Play account as before. When your phone has Pro (or when you create more than 3 groups), the app sends our server the subscription-management provider's random user ID to check for Pro and show how many groups you've created, and we record a purchase reference (store, product and purchase date, or transaction number) with the groups you create, to apply the limit of 20 groups per purchase, counted across every account that uses it.
• Security and abuse prevention. Sign-in sessions are stored only as hashes. We use your IP address to count requests over short periods and delete those counts within two days.
• Reports and blocks. When you report a member or a group, we keep your account ID, the group, the person reported (if any), the reason and any note you type, and send our team a notice (through Resend) with the report's reference, the reason and your note (no names), so it is reviewed within 24 hours. The person reported is not told who reported them. A block records only who blocked whom, to hide that person's name, photo and shifts from you and your shifts from them; they are not told. Accounts or groups that break the terms may be suspended. If a suspended account is deleted, we keep a one-way hash of its sign-in (not a name or email) for 30 days, so the same sign-in can't simply start over.
• Deleting your account is in Settings › Account › Delete account. We delete your account, sign-ins, profile photo and shared shifts, and remove you from every group; groups you own pass to the longest-standing member who can run them, or close if there is none. Your calendar on your phone is not affected. All that remains is an account record with no name (a random ID and dates), so groups you created stay consistent. See how to delete your account.

Inviting friends

Inviting friends is optional, and the person inviting doesn't sign in. The first time you open Invite friends, the app sends our server the random user ID and the phone ID, to make this phone's invite code and to grant the free Pro where your Pro lives. We keep the code, a hash of the key the phone uses to read its progress, a keyed hash of the phone ID (see the groups row — so a phone can't count as its own friend, even after the app is reinstalled) and the months granted. If you are signed in to groups, friends see your nickname. A friend who uses a code signs in; we keep their account, the install date and first-shift date the app sends, a keyed hash of the phone ID, and the status (waiting, counted or not counted). Once a friend has earned someone a month, we keep a one-way hash of that sign-in and of the phone ID (linked to no account) for 24 months, so neither counts twice, even after the account is deleted and a new one made. The inviter sees only friends' nicknames and status — never their shifts, groups or contact details.

About roster scan

Our server does not store the image or the result. The image goes to an AI provider to read the shift codes. The provider does not use it to improve its products and keeps it only briefly, to detect misuse. The app always shows you the exact image before it is sent. Taking the photo, finding the page edges and straightening it happen on your phone, in the system document scanner (iPhone, or Google Play services on Android); the full photo is never sent, and the app deletes its copies when you leave the scan screen.

To prevent excessive use, we keep usage counts in pseudonymous form, keyed with a secret (never the actual IP address or IDs), and delete them within 40 days. Our host may keep basic request logs, such as time and IP address, for a short period.

Usage statistics

Statistics are anonymous: they use a random install ID (not a device or advertising ID), no user profiles, no screen recording, and nothing you type. Our usage statistics do not use the IP address to locate you and do not store it (the ad networks in the free version estimate an approximate location separately; see Ads). Switch it off in Settings › Share usage statistics; the change applies at once and travels with your backup file.

Ads

The free version shows advertisement banners on a few screens, including a small strip below the calendar on the main screen, and sometimes a full-screen ad when you tap the Groups tab or come back to the app after an hour or more away (at least 3 minutes apart, and never when a notification, alarm, widget or link opens the app). It also offers an optional video ad that unlocks the pay views for a while; it plays only when you tap it.
On Android, ads may be personalised using the Android advertising ID, which you can reset or delete in your phone's Settings › Google › Ads. On iPhone, from version 1.4.0, the app asks once, in Apple's own dialog, whether it may track. If you allow it, ads may be personalised using the iPhone advertising ID; if not, ads don't use the iPhone advertising ID (Apple withholds it) and Google's ad requests are non-personalised. You see the same number of ads whatever you answer, and you can change it any time in Settings › Privacy & Security › Tracking. (Before version 1.4.0 every iPhone ad request is non-personalised.) Where the law requires consent, Google shows a consent form first.
From version 1.4.0, Google AdMob also lets the ad networks InMobi and Liftoff Monetize bid to show an ad in the same ad slots. They receive the same data listed in the table above — never your roster, pay or notes. Pro has no ads.

4. Legal bases

• Contract — to provide the features you choose, such as roster scan and, when you sign in, groups and your account, and to confirm the Pro you bought.
• Legitimate interests — to prevent abuse and fraud, keep the service secure, deliver app updates, improve the app from anonymous usage statistics (which you can switch off), and fund the free version with ads.
• Consent — where the law requires it, such as Google's ad consent form, which you can withdraw.

5. International transfers

The providers we use may process data outside Thailand, including in Singapore (the groups server and database), the United States, the EU and India. The main ones are Apple, Google, LINE, RevenueCat, Expo, PostHog, Vercel, Neon, Upstash, Resend, Cloudflare, and the ad networks InMobi and Liftoff (from version 1.4.0). These transfers are necessary to provide the service you request (Thailand's Personal Data Protection Act, section 28), and each provider protects the data under its own agreements and policies.

6. Retention

• Data on your phone: until you delete it or uninstall the app.
• Scans: no image or result is kept; usage counts are deleted within 40 days.
• Usage statistics: up to 12 months.
• Groups account, nickname and profile photo: until you delete them; accounts unused for 24 months are deleted after a notice in the app.
• Shifts shared with groups: while you are in a group; deleted once you are in none. Only last month, this month and next month are kept; older months are deleted automatically every day.
• Deleted groups: permanently removed within 30 days.
• Reports: kept until reviewed, then for up to 12 months to deal with repeat abuse; reports you sent are deleted when you delete your account. Blocks: until you unblock or delete your account. The sign-in hash of a deleted suspended account: 30 days.
• Inviting friends: the code and its list of friends until 12 months after Invite friends was last opened or the app last checked the code's progress, and never while a friend's free month is still owed; hashes of sign-ins that earned a month, 24 months from the month they counted; the hash of a phone that earned a month stays with the friend's entry until she deletes her account, then is kept on its own, linked to no account, for 24 months from that month; the number of free months given to each random ID of our subscription-management provider (so the five-month limit holds per person), 24 months after it last changed.
• Sign-in sessions: expire a year after last use, and are deleted within 30 days of expiring or signing out.
• Request counts (including IP address): up to two days.
• Purchases: the stores and our subscription-management provider keep purchase history as needed to confirm access and as the law requires.
• Support email: as long as needed to help you, then deleted.

7. Your rights

Under Thailand's Personal Data Protection Act B.E. 2562 (2019) you may request access to and a copy of your data, correction, erasure or anonymisation, restriction, objection, data portability, and withdraw consent, by writing to support@wenup.app. Most of your data is on your phone and yours to manage directly in the app. If you use groups, you can change your nickname and photo, and delete your account, in Settings › Account (see how to delete your account). For purchases, include the ID from Settings › Support ID.

If you believe your data is handled unlawfully, you may complain to the Personal Data Protection Committee (PDPC) of Thailand.

8. Security

All traffic is encrypted with HTTPS. The scan service is available to Pro users only, with usage limits. Groups use LINE, Google or Apple sign-in, so we never hold a password, and a group's data is visible only to its members. Because your data lives on your phone and in your backup files, lock your phone with a passcode and keep backups somewhere safe.

9. Children

WENUP is designed for people who work shifts and is not directed at children.

10. Changes

We may update this notice when the app or the services it uses change, and will update the effective date above. Significant changes will be announced in the app.

11. Contact