1. Who we are
Woosh AS ("we", "us") runs this service and decides how your data is handled. In GDPR terms, we're the data controller.
Because we're established in Norway, the GDPR applies, as brought into Norwegian law by the Personal Data Act (personopplysningsloven). If you're outside the EEA, we apply the same standard anyway.
Questions, requests, and complaints go to contact@woosh.no. We aren't required to appoint a Data Protection Officer, so that address reaches us directly.
2. What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Your account: username, email (guests may not have one), password stored hashed and never readable, nickname, avatar, banner, profile colours | Sign you in, keep the account secure, and show who you are to the people you talk to | Contract |
| Messages and attachments: what you write, the files and images you send, edits, replies, reactions, timestamps | Deliver them and show your history | Contract |
| Who you talk to: friends, server memberships, DM participants, what you've read | Run your friends list, your servers, and your DMs | Contract |
| Voice and screen share: the audio and video you send while you're in a voice channel | Relayed live to the other people in the channel. Not recorded, not stored, not analysed. It isn't end to end encrypted: the relay server passes each stream on and drops it. | Contract |
| Signed in devices: a hashed sign in token per device, plus the device name | Keep you signed in without retyping your password, and let you sign a device out | Contract |
| Notification tokens: one for each device you turned notifications on for | Send you push notifications. Your device asks for permission separately. | Contract |
| Voice minute records: which channel you were in, and for how long | Usage statistics and capacity planning | Legitimate interests |
| Terms acceptance: a copy of the Terms you agreed to, and when | Show which version of the agreement you accepted | Legal obligation and legitimate interests |
| Logs and diagnostics: IP address, request times and outcomes, error and crash reports, app and OS version | Keep the service secure and working, find bugs, and rate limit abuse | Legitimate interests |
| Feedback and call ratings: what you write in the feedback box, a thumbs up or down on a call, and a quality snapshot of that call | Fix what you reported and improve call quality | Legitimate interests |
| Support and reports: your name, email, what you picked and wrote on the contact or report form, your browser, and your account if you were signed in | Answer you, look into what you reported, and keep a record of it | Legitimate interests, and legal obligation for reports under the Digital Services Act |
| Moderation records: what we removed or suspended, reports we received, requests we handled | Comply with the Digital Services Act, copyright law, and GDPR record keeping | Legal obligation |
The bases above are GDPR Article 6(1)(b) for contract, (c) for legal obligation, and (f) for legitimate interests.
To see how Woosh works in different countries, we look up the country your IP address belongs to in an offline database on our own servers (IP geolocation by DB-IP). Nothing is sent to DB-IP, and only the country is kept for those statistics, never the address.
We don't sell your data, and we don't use it for advertising, profiling, or automated decisions. We don't set out to collect special category data (Article 9) either. If you put it in a message we have no practical way to spot it, but nothing here is aimed at collecting it.
3. Microphone, camera, and screen
We ask for these only when you join a voice channel or start a screen share, and your operating system's permission prompt is the consent. Nothing is recorded, stored, transcribed, or analysed, and access is released the moment you leave or stop sharing.
On Android, the RECORD_AUDIO permission is required by the operating system for any app that uses the microphone.
4. How long we keep it
| Data | How long |
|---|---|
| Profile: username, email, avatar, banner | Until you delete your account, then removed straight away |
| Messages and attachments | Until you, or someone with permission such as a server owner, deletes them. Messages survive your account deletion, shown as "Deleted user" with your name no longer attached. Attachments you sent are deleted with the account. See Delete account |
| Voice and screen share | Never stored |
| Signed in devices | Until you sign out or the session expires. Deleting your account stops every session working immediately |
| Notification tokens | Until you turn notifications off, uninstall, or delete your account |
| Voice minute records, feedback, and call ratings | Kept as product records. Once your account is deleted, the ID on them no longer points to anyone |
| Terms acceptance | Until you delete your account |
| Logs and diagnostics | Up to 90 days |
| Support messages and reports | Up to 12 months after we close the ticket |
| Moderation records | Up to 6 months, longer only while an investigation or legal dispute is still open |
| Backups | Anything deleted is gone from backups within 30 days |
Where the law makes us keep something longer, tax records for instance, we keep it for that period and no longer.
5. Who else touches your data
- Microsoft Azure (Microsoft Ireland Operations Ltd.) for hosting, database, file storage, and diagnostics, in EU/EEA regions. Privacy statement.
- Google Firebase Cloud Messaging (Google Ireland Ltd.) for push notifications on Android. Privacy policy.
- Apple Push Notification service (Apple Distribution International Ltd.) for push notifications on iOS. Privacy policy.
- KLIPY for GIF, sticker, and clip search in chat. When you search, KLIPY sees the search term and your IP address, the way any web request would.
Each of them is under a data processing agreement and can only act on our instructions. If we change providers, we update this list before the change takes effect.
6. Data leaving the EEA
Our own infrastructure is in EU/EEA regions. Push notification providers may move a device token or IP address to servers outside the EEA, including the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses, and on the EU-US Data Privacy Framework for providers certified under it. Email contact@woosh.no for a copy of the safeguards.
7. Your rights
You can ask us to:
- Give you a copy of your data. There's a button for it: Settings → General → Privacy & Data → Email me my data sends a JSON file to your registered address. Guest accounts need an email on the account first, or ask us and we'll find another way.
- Correct anything wrong. Most of it you can edit yourself in Settings.
- Delete your account. That's in Settings too, and Delete account explains what goes and what stays.
- Restrict or object to processing we base on our legitimate interests, or withdraw consent where we relied on it.
We don't make automated decisions about you with legal effect.
Email contact@woosh.no. We answer within a month, or tell you if a complex request needs up to two more. It's free, unless a request is excessive or clearly unfounded.
If you think we've handled your data wrongly, you can complain to Datatilsynet in Norway, or to the data protection authority where you live.
8. Children
Woosh isn't for children under 13, and we don't knowingly collect their data. Some EEA countries set the digital consent age higher, up to 16. If you're under that age where you live, you need a parent's or guardian's permission. Tell us if a child has given us data without it and we'll delete it.
9. Security
Data is encrypted in transit and at rest, passwords are hashed, sessions are token based and can be revoked, and access to production systems is limited and logged. No system is perfect, and we can't promise absolute security.
If there's a breach that puts your rights at risk, we notify the supervisory authority within 72 hours, and you directly where the risk is high.
10. What we store in your browser
Only what the app needs to run: your sign in token, your interface preferences such as theme, the last server and channel you had open, microphone and audio settings, and per person volume, plus a push subscription if you turned notifications on.
No advertising cookies, no tracking pixels, no third party analytics, no cross site identifiers. Under Norwegian electronic communications law that counts as strictly necessary storage, which is why there's no consent banner. You can clear it from your browser settings whenever you like, and that signs you out of the web app.
11. Changes to this Policy
We may update this Policy. If a change matters, we announce it in the app or by email at least 14 days before it takes effect. The date and version at the top always reflect the current one, and we keep earlier versions on file if you want to see them.
12. Contact
Woosh AS, organisation number 938 644 594, Staudeveien 1B, 0875 Oslo, Norway.
Questions about this Policy or your data? Reach out and we'll get back to you.
Contact Us →