Woope ("we", "us", "our") is a social platform for people who build, learn and share their work. It is operated by Arnex Development Studio, which is the data controller for the personal data described here.

This Policy describes what Woope actually does with your data - it is written from the application's database schema and source code, not from a template. Where something is retained, shared or made public, it is because a specific feature does that, and the feature is named.

Woope runs on infrastructure in the European Union and is operated from the Czech Republic. We process personal data under the General Data Protection Regulation (GDPR) and applicable Czech law.

Data controller: Arnex Development Studio Contact: support@woope.eu

This deserves its own section, because the honest answer is neither "never" nor "always".

Portfolio view counts: when someone who is not signed in looks at a public portfolio page, we compute a keyed hash of their IP address so the same visitor refreshing the page is not counted twice. The address itself is never written down, and the hash is keyed with a secret that only our servers hold, so it cannot be turned back into an address by anyone who obtains a copy of the table. These records are deleted after 90 days; only the aggregate counts survive. The visitor's browser identification string is checked against a list of known bots and then discarded, not stored.

Push notifications: if you turn them on, the browser identification string from the moment you subscribed is stored alongside the subscription, so you can tell your devices apart if you subscribe on more than one. It is deleted when you turn push off or delete your account.

Infrastructure logs: our hosting provider and our database provider record standard request information, including IP addresses, in their own operational logs. That is infrastructure we do not control the contents of, and it is retained under their own log policies.

Session and device lists: Woope does not show you a list of the devices you are signed in on, and does not keep one. Building that feature would mean storing the IP address and browser of every sign-in - a location and device history the product does not otherwise keep. Instead, Settings offers "sign out other sessions", which achieves the same security outcome without the record.

Contract performance (Art. 6(1)(b)): everything needed to give you the service you signed up for - your account, your profile, the content you publish, your messages, the notifications tied to activity on your own content.

Legitimate interests (Art. 6(1)(f)): keeping the platform working and safe. This covers anti-spam and rate limiting, moderation and reports, view counts and the trending and recommendation ranking built from public engagement, and account-security records. Our interest here is a functioning, non-abusive platform, and each of these is limited to what that requires.

Consent (Art. 6(1)(a)): push notifications, optional marketing email, analytics cookies, and any optional profile field you choose to fill in. You can withdraw any of these at any time in Settings, without losing access to anything else.

Legal obligation (Art. 6(1)(c)): responding to lawful requests, and keeping records we are required to keep.

If you set your profile to private, your profile and your activity are visible only to followers you have approved, and following you becomes a request rather than an action. Content you had already published to a public community or project stays where you published it.

Everything above is enforced by the database, not only by the interface: a request that bypasses the app entirely is subject to the same rules.

We do not sell your personal data, and we do not share it with advertisers. The services below are the complete list of external providers Woope's code actually talks to.

Supabase - database, authentication and file storage. Effectively all application data described in this Policy is stored here. Acts as our processor. Our project runs in the EU (Paris) region.

Vercel - hosting and request routing for the application itself. Acts as our processor. Standard request metadata is handled by the platform.

Resend - delivery of transactional and notification email. Receives the recipient address and the content of the email being sent. Acts as our processor.

Google (Gemini API) - only when you press Translate on a piece of content. Receives the text being translated and the source and target languages. It does not receive your identity, your email, your IP address or any authentication token. Direct messages cannot be routed through this feature.

Google (Sign in with Google) - only if you choose to sign in that way. The exchange is between you and Google; we receive your email address and basic profile information from it.

Google (Analytics and Tag Manager) and Vercel Analytics and Speed Insights - product analytics. These load only after you accept analytics cookies, and not at all if you decline or ignore the cookie banner.

Your browser vendor's push service (for example Google, Mozilla or Apple, depending on your browser) - if you enable push notifications. Receives the encrypted notification payload and the subscription endpoint. This is how the Web Push standard works; there is no way to deliver a push notification without it.

We may disclose data if we are legally required to, or where it is necessary to protect the safety of users or the integrity of the platform.

While your account exists, your account data, profile, content and settings are kept. Some records have a shorter fixed life regardless, and these are enforced automatically by a scheduled job rather than being an intention:

If you want something specific removed beyond this, write to support@woope.eu and we will look at it individually.

Right of access (Art. 15) and portability (Art. 20): Settings, under Your data, has "Download my data". It produces a machine-readable JSON file containing your account details, profile, posts, comments, discussions, projects, messages, follows, community memberships, notifications, preferences, Woopies history, badges, achievements and reports you filed. You will be asked to confirm your password first, because the file is everything at once.

Right to rectification (Art. 16): edit your profile, or write to us.

Right to erasure (Art. 17): Settings, under Delete my account. Read the previous section first - it says exactly what is erased and what is not.

Right to restriction (Art. 18) and to object (Art. 21): write to support@woope.eu. Processing based on our legitimate interests, such as ranking and analytics, is the usual subject of an objection.

Right to withdraw consent (Art. 7(3)): turn push notifications off in Settings, change your email preferences per category, or change your cookie choices from the link in the footer. Withdrawing consent does not affect anything done before you withdrew it.

Right to complain: you can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz) or to the supervisory authority where you live.

Write to support@woope.eu to exercise any of these. We aim to respond within one month, as GDPR requires.

We do not use advertising cookies. We do not use session replay. Nothing in the "marketing" cookie category is currently used by any code in the application - the option exists in the banner but sets nothing today.

You can change your choices at any time from "Cookie preferences" in the footer, and you can clear everything from your browser settings. Clearing cookies signs you out.

No system is completely secure. If a breach affects your rights and freedoms, we will notify you and the supervisory authority within 72 hours, as GDPR requires.

You must be at least 13 to have a Woope account. We ask for your date of birth at sign-up in order to check this, and the check is repeated on our servers rather than being left to the browser.

If an account is found to belong to someone under 13, it is removed.

If you are 13 or 14, we ask for a parent's or guardian's email address and their account stays inactive until that person approves it by email. This is enforced, not just requested: in the Czech Republic and several other EU countries, consent-based processing for someone under 15 (under 16 in some other EU countries) requires the authorisation of whoever holds parental responsibility, and Woope's minimum age of 13 is below that threshold. The parent or guardian's email is used only to send that one approval link and is not used for anything else. If you are 15 or older, no additional permission is required to use Woope itself, though local law may still require it for certain optional features depending on where you live.

If you believe a child under 13 has an account, write to support@woope.eu.

Our database, authentication and file storage run in Supabase's EU region (Paris). The application itself is hosted by Vercel.

Supabase, Vercel, Resend and Google are US-headquartered companies. Where personal data is transferred outside the European Economic Area in the course of their providing these services, that transfer relies on the European Commission's Standard Contractual Clauses and, where applicable, on the EU-US Data Privacy Framework. Each provider publishes its own transfer documentation.

We update this Policy when what the application does changes - not on a schedule. The "Last updated" date at the top of the page changes with it, and we will tell you in the app or by email about anything material.

Continuing to use Woope after a change means you accept the revised Policy.

Email: support@woope.eu Contact page: woope.eu/contact We aim to answer data requests within one month.