Wabi.do
EN
Get the app

Privacy policy

Last updated: September 13, 2026. This version takes effect on the same date.

This policy explains what personal data we collect when you use Wabi.do, why we collect it, who receives it, how long we keep it, and what rights you have. It covers the Wabi apps for iPhone, iPad and Android, the web app at app.wabi.do, the REST API at rest.wabi.do, and this website, wabi.do. Together we call these "Wabi" or "the service".

Who we are

Wabi is operated by nSof LTD, a private company registered in the Republic of Cyprus (registration number HE 479786), with its registered office at Florinis 7, Greg Tower, 2nd floor, 1065 Nicosia, Cyprus. nSof LTD is the controller of the personal data described in this policy. This means we decide why and how the data is used.

To contact us about privacy, write to wabi@wabi.do.

What we collect

Your account

You sign in to Wabi with Google or Apple. We do not receive or store your password for those services. The provider you choose sends us:

  • Your name
  • Your email address
  • Your profile photo

If you sign in with Apple and choose to hide your email address, we receive the relay address that Apple creates for you.

Content you create

This is the information you put into Wabi so it can do its job:

  • Lists and tasks, including private tasks
  • Comments and chat messages inside tasks
  • Files you attach to tasks
  • Due dates and who a task is assigned to

We do not need this content for any purpose other than running the service for you and the people you share it with. Be careful with sensitive information in tasks and files, such as health or financial details, and share it only with people you trust.

People you share with

When you invite someone to a list or share a task, we receive that person's email address. We use it to give them access to what you shared and to let them know about it. If they are not yet Wabi users, we do not use their address for any other purpose.

Device and technical information

  • Device tokens, so we can send push notifications to your phone, tablet or browser
  • Basic technical logs, such as the time of a request, IP address, device or browser type, and errors. We use these to keep the service secure and to fix problems.
  • If you use the REST API, the personal API tokens you create and records of the API requests made with them

Website analytics and marketing cookies

On wabi.do we use Google Tag Manager to load Google Analytics 4 and the Meta (Facebook) Pixel. These load only after you click Accept in the cookie banner. If you choose "Essential only", neither of them loads. When they are active, they collect information such as the pages you visit, how you arrived at the site, your approximate location, your browser and device type, and cookie identifiers. The section Cookies and your choices below explains the details.

The contact form

When you send us a message through the contact form, we collect:

  • Your name
  • Your email address
  • Your phone number, if you choose to give it
  • Your message
  • Your IP address, the country your connection comes from (estimated from the IP address) and your browser's user agent. We keep these to prevent spam and abuse.

Do you have to give us this information?

No law requires you to give us personal data. However, we cannot create an account without the details from your sign-in provider, and we cannot answer a contact form message without your name, email address and message. Your phone number is always optional.

Why we use your data, and our legal basis

We use personal data only for the purposes listed here. For users in the European Economic Area (EEA) and the United Kingdom, we also list the legal basis under the GDPR.

  • To provide the service. We create and run your account, store and sync your lists, tasks, comments and files, show shared content to the people you share with, send push notifications and service emails, and operate the REST API. Legal basis: performance of our contract with you (the Terms and conditions).
  • To keep the service secure and working. We use technical logs to prevent abuse, investigate problems and fix errors. We use the IP address and user agent from the contact form to block spam. Legal basis: our legitimate interest in running a safe and reliable service.
  • To answer you. We use contact form messages and emails to reply to you. Legal basis: our legitimate interest in responding to people who contact us.
  • To understand how the website is used. Google Analytics 4 helps us see which pages are useful. Legal basis: your consent, which you give by clicking Accept.
  • To measure and improve our advertising. We advertise Wabi on platforms such as Facebook and Instagram. The Meta Pixel on our website tells us whether our ads lead to visits and sign-ups, and it lets us show Wabi ads to people who visited our site. The Wabi apps may also share limited contact information with advertising partners for this purpose. Legal basis: your consent where the law requires it (on the website, this is the Accept button), and otherwise our legitimate interest in promoting Wabi. You can object at any time by writing to us.
  • To meet legal obligations. We keep and disclose data when the law requires it, for example in response to a valid court order. Legal basis: compliance with a legal obligation.

We do not sell personal data for money.

Who we share it with

We share personal data only with the people and companies below, and only as needed for the purposes in this policy.

People you share with

When you share a list or task, the people you share it with can see its content, your name and profile photo, and the comments and files in it. See also the section on shared lists in our Terms and conditions.

Service providers that process data for us

  • Google Firebase (Google): sign-in, real-time sync and push notifications
  • Twilio SendGrid: sending service emails
  • The hosting company that runs our servers: storing the app, its database and attached files
  • Cloudflare: hosting this website and storing contact form messages
  • Slack: delivering contact form messages to our team's internal channel
  • Google: Google Analytics 4 and Google Tag Manager on the website, only after you accept cookies

These providers may use the data only to provide their services to us, under their agreements with us.

Companies that also make their own decisions about the data

  • Meta (Facebook): the Meta Pixel on the website, only after you accept cookies, and advertising measurement for the apps. Meta also uses this data under its own privacy policy.
  • Apple, Google and Meta as sign-in providers: when you sign in with them, they know you use Wabi and handle your data under their own privacy policies.
  • Apple (App Store) and Google (Google Play): they handle app downloads and deliver push notifications to your devices, under their own privacy policies.

Other cases

  • Authorities. When the law requires it, or to respond to a valid legal request.
  • Protection. When needed to protect the rights, safety or property of our users, the public or nSof LTD.
  • A change of ownership. If nSof LTD or Wabi is part of a merger, sale or acquisition, personal data may move to the new owner. The new owner must continue to protect it as described in this policy, and we will let you know about the change.

International transfers

nSof LTD is based in Cyprus, in the European Union. Several of our providers, including Google, Meta, Cloudflare, Twilio SendGrid and Slack, process data in other countries, mainly the United States and the European Union. This means your data may be stored and processed outside the country where you live.

When we transfer data outside the European Economic Area, we use the safeguards that the GDPR allows. These include adequacy decisions (for example, the European Commission recognizes that Israel and the UK protect personal data adequately), the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework where a provider is certified under it, and the contractual data protection commitments of our providers. You can ask us for more information about these safeguards.

How long we keep it

  • Account data and your content: while your account is active. If you ask us to delete your account, we delete this data within 30 days. Copies in backups may remain for up to 90 days after that request, and are then deleted.
  • Contact form messages: up to 180 days, including the IP address, country and user agent stored with them. If your message becomes an ongoing conversation by email, we keep that email conversation only as long as we need it to help you.
  • Technical logs: only as long as we need them for security and troubleshooting.
  • Website analytics: Google Analytics keeps event data for no longer than 14 months. Cookie lifetimes are listed in the cookies section below.
  • Legal needs: we may keep specific data longer when the law requires it, or when we need it to handle a legal claim.

Deleting your account does not delete copies that other people made themselves, for example by copying text from a task you shared with them.

Your rights

Everyone

Wherever you live, you can ask us to:

  • Tell you what personal data we hold about you and give you a copy
  • Correct data that is wrong, incomplete or out of date
  • Delete your account and your data
  • Stop using your data for advertising

You can also change your cookie choice at any time, as explained below.

Users in Israel

If you live in Israel, you also have rights under the Israeli Privacy Protection Law, 5741-1981, including Amendment 13. You have the right to review the information about you that we hold, and to ask us to correct or delete information that is not correct, complete, clear or up to date. You can also ask us to remove you from any list used for direct marketing. If you think we have not handled your data properly, you can complain to the Privacy Protection Authority at the Israeli Ministry of Justice.

Your rights under the GDPR

Because nSof LTD is established in the European Union, the GDPR applies to how we handle your data wherever you live. Users in the UK also have the same rights under the UK GDPR. You have the right to:

  • Access your personal data and receive a copy
  • Rectification of data that is wrong or incomplete
  • Erasure of your data
  • Restriction of how we use your data
  • Portability: receive the data you gave us in a structured, machine-readable format, or ask us to send it to another company
  • Objection to our use of your data based on legitimate interests, including for advertising
  • Withdraw consent at any time, without affecting the use of your data before you withdrew it
  • Complain to our lead supervisory authority, the Commissioner for Personal Data Protection in Cyprus, or to the data protection supervisory authority in the country where you live or work

How to use your rights

Write to wabi@wabi.do. Please send your request from the email address linked to your Wabi account, so we can confirm it is you. We may ask for more information if we cannot confirm your identity. We answer within 30 days. If a request is complex, we will tell you within those 30 days if we need more time and why.

Using these rights is free. We will not treat you differently because you used them.

Cookies and your choices

Cookies are small files that a website stores in your browser. Similar technologies, such as local storage, work in a similar way. This section explains what wabi.do uses.

Essential storage

We store your cookie choice in your browser's local storage, under the name "wabi-consent", so we do not ask you again on every page. This storage is needed for the site to respect your choice, so it does not require consent. The web app at app.wabi.do also uses storage in your browser that is needed to keep you signed in.

Analytics cookies (only if you accept)

Google Analytics 4 sets cookies such as _ga and _ga_ followed by an ID. They count visits and show how people use the site. By default they last up to 2 years.

Marketing cookies (only if you accept)

The Meta Pixel sets cookies such as _fbp and, when you arrive from a Facebook or Instagram ad, _fbc. They measure the results of our ads and allow us to show Wabi ads to people who visited the site. By default they last about 3 months.

How your choice works

  • When you first visit, a banner asks you to choose. Nothing from Google Analytics or the Meta Pixel loads before you choose.
  • Accept loads Google Analytics 4 and the Meta Pixel through Google Tag Manager.
  • Essential only loads neither of them. The whole site works the same way.
  • If your browser sends a Global Privacy Control signal, we treat it as "Essential only" and do not load analytics or marketing cookies.

Change your choice

You can change your choice at any time. Use the "Cookie settings" link in the footer of any page, or this button:

If you withdraw your consent, we delete the analytics and marketing cookies that were set on wabi.do. You can also delete cookies and local storage in your browser settings.

Children

Wabi is not directed to children. You must be at least 13 years old to use it. If you live in a country where a higher age applies to consent for online services, such as up to 16 in some countries of the European Union, you need permission from a parent or guardian to use Wabi below that age.

We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, write to wabi@wabi.do and we will delete it.

Security

We protect personal data with measures that fit the type of data we hold:

  • All data sent between your device and our service is encrypted in transit with HTTPS (TLS).
  • Only staff who need access to personal data to do their work can access it.

No system is completely secure, so we cannot promise that your data will never be accessed without permission. If a security incident affects your personal data, we will notify you and the relevant authorities when the law requires it. You can read more on our Security page.

You also play a part: keep your Google or Apple account secure, and keep your API tokens secret.

Changes to this policy

We may update this policy when the service or the law changes. The date at the top of this page shows when it was last updated. If we make an important change, for example to how we use your data or who we share it with, we will tell you in advance in the app or by email. If a change requires your consent, we will ask for it.

Contact

For questions about this policy or about your personal data, or to use your rights, contact nSof LTD at wabi@wabi.do.