Privacy Policy

1. Who this policy is from

This policy covers the Wakivo iPhone and Android apps, the Apple Watch and Wear OS companions, the Wakivo desktop agent, this website, and the Wakivo backend service. Where data protection law names a controller, that is Wakivo, reachable at privacy@wakivo.app.

2. Two modes, two very different answers

Almost every question about Wakivo and your data has two answers, because the product runs two ways. Which one you are in is shown in the app and is never changed for you.

3. Local mode — no account, no server

On your own network your phone connects straight to the desktop agent. There is no cloud leg, so there is no collection to describe: we receive nothing, because nothing is sent to us. This includes the fact that you are using the app at all.

What exists in local mode lives on your own two devices:

• On the computer — the list of phones you approved, their public keys, your schedules, and the activity log of every command including refused ones. Deleting the agent removes all of it.
• On the phone — the computers you paired with, their public keys, and its own private key. The private key is held in the iOS Keychain or the Android Keystore and never leaves the device.

4. The watch

Apple Watch and Wear OS are companions to the phone, not devices on your account. The distinction matters here because it decides what a watch can hold: it has no key, no sign-in and no connection to us. Every command it sends leaves through the phone it is paired with, and is signed by the phone.

What is on the watch is a copy of what the phone last told it:

• The names and states of your computers, the actions each one currently offers, any countdown that is running, and recent activity — held so the screen can be drawn the instant you raise your wrist rather than after a round trip.
• On Apple Watch this copy is shared with the complication through an app group on the watch itself, because a complication runs in its own process and cannot ask the app. Neither leaves the watch.

Take the app off the watch and that copy goes with it. Nothing about a watch is sent to us, and pairing one is not something we can see.

5. Remote mode — what the service holds

Creating an account is what turns the backend on. It exists to route a command from your phone to a computer that is not on the same network, and it holds the minimum needed to do that and to keep the account safe.

Account

• Your email address, and a display name if you set one.
• A password hash, if you set a password. It is Argon2id — the password itself is not stored and cannot be recovered from the hash.
• If you sign in with Google or Apple, the provider’s subject identifier for you. Apple’s is unique to this app and is not an email address.
• Whether the email has been verified, and counts of failed sign-in attempts.

Devices you connect

• A name you chose, the device type, its platform, OS version and app version.
• Public keys only, and their fingerprints. Private keys stay in the operating system’s keychain on the device that generated them. There is deliberately no column they could be stored in.
• The computer’s MAC address, needed to build a Wake-on-LAN packet, and a hash of the network identity so a wake can be matched to the right LAN. The network name itself is not stored.
• The result of the capability probe — whether the hardware can actually wake, whether Wi-Fi wake is unreliable on it, and similar findings the app shows you.
• Current power status and when the device was last seen.

Commands

A command is stored as an encrypted envelope. Its parameters are ChaCha20-Poly1305 ciphertext that only your phone and your computer hold the key for. Alongside it we store, in the clear:

• Which of the eight action types it is — needed to route it, expire it and rate-limit it. This is a deliberate, documented exception, not an oversight.
• Which two of your devices it is between, its status, and its timestamps.
• A signature and a single-use number that make a replayed command detectable.

Sessions and security records

• A hash of each refresh token — never the token — with the IP address and user agent it was issued to, so a stolen session can be spotted and cut.
• An append-only activity log: what was attempted, whether it succeeded, was refused or failed, and from which device and IP address. This is the same log you can read in the app, and its serialiser has an explicit denylist so that no key, token or password can reach it.
• If you enable notifications, the Apple or Google push token for that device. It is a routing address, not a credential.

6. What is never collected

Not “we choose not to” — there is no mechanism, and in most cases no field:

• Your computer’s password or PIN. Wakivo never asks for it. Nothing accepts one, nothing stores one, and no feature would work better if it did.
• Any private key. Every key we hold is a public one.
• Screen contents, keystrokes, mouse input, files, or terminal output. The agent requests no screen-recording and no accessibility permission, so these are not available to it even in principle.
• The contents of your commands. See section 5.
• Location, contacts, photos, browsing history, or an advertising identifier.
• Third-party analytics. There is no analytics SDK in the apps and no tracking script on this site. Build-time telemetry in our own tooling is disabled too.

7. Why we are allowed to hold it

Under the GDPR and equivalent laws, the legal bases are:

• Performing the contract — your account, your devices and the routing of your commands. Without these there is no remote mode to provide.
• Legitimate interests — the security log, session records and rate limits, for detecting abuse of a system whose whole purpose is to power other people’s computers off. We keep the least that makes this work.
• Consent — push notifications, which you turn on and can turn off at any time in your operating system’s settings.

8. Who else sees it

We do not sell personal data, share it for advertising, or use it to profile you. We use a small number of processors to run the service, each with access only to what its job needs:

• A cloud hosting provider, for the servers themselves.
• A managed database provider, which stores the records in section 5.
• Apple Push Notification service and Firebase Cloud Messaging, which deliver notifications to your device.
• An email delivery provider, for verification and account emails.

We also disclose data where the law compels it. If we are legally able to tell you first, we will. Note that the useful limit here is technical rather than legal: a demand for the contents of your commands cannot be complied with, because we do not hold the keys.

9. How long it is kept

• Account records — until you delete the account.
• Commands — they carry their own expiry and are cleared after it. A shutdown queued for a machine that reappears three days later must not fire, so an old command is useless as well as unwanted.
• Sessions — until they expire or are revoked, whichever is first.
• Activity log — kept for a limited period on a retention schedule, because its value is in showing you what happened recently.
• Deleting your account removes your devices, schedules, commands, sessions and push tokens. Backups age out on their own cycle. Anything on your own computer and phone is yours to delete by removing the apps.

10. Your rights

You can ask for a copy of what we hold, correct it, delete it, get it in a portable format, restrict or object to a use, and withdraw consent. Write to privacy@wakivo.app and we will answer within 30 days. Deleting an account can be done in the app without asking us.

If you are in the EEA or the UK you may complain to your data protection authority. If you are in California you have the rights to know, delete, correct and opt out of sale or sharing — and there is nothing to opt out of, because we do neither.

There is one honest limit: we cannot produce the contents of your commands, for the same reason nobody else can.

11. Security

What protects this, concretely:

• Pairing needs a human at the computer. A correct code is not enough on its own — someone has to press Allow on the machine itself. Codes are single-use and expire in two minutes.
• Every command is signed with a key pinned at pairing, and your computer refuses anything it cannot verify. A command replayed a second time is refused.
• Command bodies are encrypted end to end between your phone and your computer.
• Passwords are hashed with Argon2id, and refresh tokens are stored only as hashes, so a copy of the database yields no working sessions.
• Only eight actions exist on the wire. Lock, sleep, hibernate, restart, shut down, wake, and creating or cancelling a schedule. There is no command that runs a command, so an attacker who fully compromised the channel could turn a computer off — not read anything on it.
• You can end it at any time — revoke a device, or pause remote control entirely from the computer, and every phone is refused with a stated reason.

No system is perfectly secure, and we would rather say so than imply otherwise. If you find a vulnerability, write to privacy@wakivo.app.

12. International transfers

Remote mode’s servers may be in a different country from you, so your account data may be processed outside your own. Where that leaves the EEA or the UK, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision. Local mode transfers nothing anywhere.

13. Children

Wakivo is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will remove it.

14. Changes to this policy

The date at the top changes when this page does. A change that materially affects what is collected or who sees it will be announced in the app before it takes effect — not backdated onto data already gathered.

15. Contact

Privacy questions and rights requests: privacy@wakivo.app. Anything else: support@wakivo.app.