Privacy Policy

1. Who we are

The Service is provided by WannaCall Ltd, trading as Wannaverse, a company registered in England and Wales with company number 13112226. Our correspondence address is 124 City Road, London, EC1V 2NX, United Kingdom.

For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we are the controller of the personal data described in this policy. Where the EU General Data Protection Regulation applies to you, we are also the controller under it. In this policy, “we”, “us” and “our” mean WannaCall Ltd.

2. The short version

We collect your email address so you can sign in, and the notes you choose to write.
There are no passwords. We email you a one-time code, and we only ever store a scrambled (hashed) version of it.
We do not sell your data, we do not show adverts and we do not use your notes to train AI models.
Optional analytics (Microsoft Clarity) only runs if you say yes, and the text of your notes is hidden from it.
You can delete your account at any time from the sidebar. That permanently deletes your notes too.

3. What we collect

Information you give us

Account data: your email address. We use it as your account identifier and to send you sign-in codes.
Your content: the notes you create, including their titles, details, due dates, categories, colours, status (to do, in progress or done), the order and position you arrange them in, and when they were completed.
Correspondence: anything you send us if you contact us, such as support or privacy requests.

Information collected automatically

Sign-in records: when you request a code we record the email address, a hashed copy of the code, its expiry time, the number of attempts and the IP address the request came from. We use this to deliver the code and to stop abuse.
Session data: when you sign in we create a session. We store a hashed copy of your session token, your browser’s user-agent string (which describes your browser and device type), and when the session was created and last used.
Server logs: like most websites, our servers record technical details of requests, such as IP address, the page or API address requested, response codes, timestamps and browser information. These logs help us keep the Service secure and working.
Preferences stored on your device: for example whether you prefer the Kanban or wall layout, and your analytics choice. These stay in your browser and are not sent to us.
Analytics (only with your consent): if you allow analytics, Microsoft Clarity collects information about how you use the Service, such as clicks, scrolling, pages visited, device and browser details, approximate location derived from your IP address, and recordings of how pages were used. We mark the content of your notes and your email address so Clarity masks them, and Clarity masks text you type into form fields.

We do not ask for, and you should not put in your notes, special category data (such as health information) or sensitive information such as passwords, bank details or government identity numbers. See section 8.

4. How we use it and our lawful bases

Data protection law requires a lawful basis for each use of your personal data. Ours are:

What we do	Data used	Lawful basis
Create your account, send sign-in codes and keep you signed in	Email, sign-in records, session data	Contract: necessary to provide the Service you asked for
Store, sync and display your notes across your devices	Your content	Contract
Prevent abuse, fraud and attacks (for example rate limiting and blocking repeated wrong codes)	IP address, sign-in records, server logs	Legitimate interests: keeping the Service and its users safe
Fix bugs, monitor performance and keep the Service running	Server logs, session data	Legitimate interests: providing a reliable service
Understand how people use the Service so we can improve it	Analytics data from Microsoft Clarity	Consent, which you can withdraw at any time
Reply to you when you contact us	Email and correspondence	Legitimate interests: responding to you; or contract where it concerns your account
Send essential messages about your account or changes to our terms	Email	Contract and legitimate interests
Comply with the law, respond to lawful requests and establish, exercise or defend legal claims	Any relevant data	Legal obligation and legitimate interests

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object to this use (see section 10). We do not send marketing emails. If we ever want to, we will ask first.

We do not sell or rent your personal data, and we do not share it for advertising. We share it only with the following, and only as far as necessary:

Hosting and infrastructure providers who run the servers and database the Service uses.
Our email delivery provider, which sends sign-in codes and essential account emails on our behalf.
Microsoft Corporation, for Clarity analytics, but only if you consent. Microsoft’s use of this data is described in the Microsoft Privacy Statement.
Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
Authorities and others where required by law, for example in response to a valid court order, or where necessary to protect the rights, property or safety of our users, the public or us.
A buyer or successor if our business, or the Service, is sold, merged or reorganised. They would have to keep using your data in line with this policy, and we would tell you in advance.

Our service providers act as processors on our instructions under written contracts, and may not use your data for their own purposes.

6. International transfers

Some of our providers, including Microsoft, may process data outside the United Kingdom, for example in the United States or the European Economic Area. When personal data is transferred outside the UK, we make sure it is protected by an adequacy decision (such as the UK’s data bridge with the United States for certified organisations) or by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more information about these safeguards.

7. How long we keep it

Sign-in codes: a code expires 10 minutes after it is sent, or after 5 wrong attempts, and is used up once you sign in. The records are deleted automatically about a day later.
Sessions: a session ends 30 days after you last used the Service on that device, or straight away when you sign out. Expired sessions are deleted automatically.
Your account and notes: kept until you delete them. Deleting a note removes it immediately. Deleting your account immediately and permanently removes your account, all of your notes, your sessions and your sign-in records from our live systems, and we email you a short confirmation. This cannot be undone.
Inactive accounts: if you do not use the Service for 24 months, we will email you to say your account will be deleted. If you do not sign in within 30 days of that email, we permanently delete your account and notes and send a short confirmation. To support this, we record when your account was last used.
Server logs: kept for a short period for security and troubleshooting, then deleted or overwritten.
Backups: if a backup copy of our database includes your data, it remains in that backup until it is overwritten in the normal course. We do not restore deleted data from backups except to recover from a serious incident, and if we did, we would delete your data again.
Analytics: retained by Microsoft in line with its Clarity retention settings and privacy statement.
Correspondence: kept for as long as needed to deal with your request, and afterwards only where needed for legal reasons.

We may keep limited information for longer where the law requires it, or where it is needed to establish, exercise or defend legal claims.

8. How we protect it

We take security seriously. Our measures include:

Encryption in transit: the Service is only meant to be used over HTTPS.
No passwords to steal: we use one-time codes that expire quickly and allow a limited number of attempts.
Sign-in codes and session tokens are stored only as one-way hashes, never in readable form.
Session cookies cannot be read by scripts on the page (HttpOnly), are sent only to our own site (SameSite) and are sent only over secure connections when you use HTTPS.
Rate limiting, cross-site request checks and strict security headers to block common attacks.
Each account can only ever access its own notes.

Please note: your notes are stored on our servers so they can sync between your devices. They are not end-to-end encrypted. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not store passwords, financial details, health information or anything else highly sensitive in your notes. Keep your email account secure, because anyone who can read your email can request a code and sign in as you.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office where required, and tell you without undue delay where the risk is high.

9. Cookies and similar technologies

Cookies are small files stored by your browser. “Local storage” works similarly but is only read by your own browser. We use as few as possible.

Strictly necessary (always on)

Name	Type	Purpose	Duration
`sn_session`	First-party cookie	Keeps you signed in securely	30 days from last use, or until you sign out
`stickynotes:analytics-consent`	Local storage	Remembers whether you allowed analytics	12 months, then we ask again
`stickynotes:board-layout`	Local storage	Remembers whether you prefer the Kanban or wall layout	Until you clear your browser data

Analytics (only if you allow it)

If you choose “Allow analytics”, we load Microsoft Clarity. Clarity sets first-party cookies such as _clck and _clsk to recognise your browser and link page views into a session. Microsoft may also use its own cookies on Microsoft domains, such as MUID, CLID, ANONCHK, MR and SM. We tell Clarity that advertising storage is not permitted. For current names, purposes and durations, see Microsoft’s Clarity cookie list.

If you choose “No thanks”, Clarity is not loaded at all. You can change your mind at any time using Cookie settings at the bottom of any page. If you withdraw consent, we ask Clarity to erase its cookies. You can also block or delete cookies in your browser settings, but blocking sn_session will stop you from signing in.

We do not use advertising cookies, and we serve our fonts ourselves, so your browser does not contact Google Fonts when you use the Service.

10. Your rights

Under data protection law you have the right to:

Access the personal data we hold about you and receive a copy.
Rectification: have inaccurate data corrected. You can edit your notes yourself at any time.
Erasure: have your data deleted. You can do this yourself with “Delete account” in the sidebar.
Restriction: ask us to limit how we use your data in certain circumstances.
Portability: receive the data you gave us in a structured, machine-readable format.
Objection: object to our use of your data where we rely on legitimate interests.
Withdraw consent at any time, using Cookie settings. This does not affect anything we did before you withdrew it.

To exercise any of these rights, email privacy@stickynotes.space from the email address linked to your account. We may need to confirm your identity before acting on a request. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you why. We do not normally charge a fee.

11. Children

The Service is not intended for children under 13, and you must be at least 13 to create an account. If you are under 18, please make sure a parent or guardian has read this policy and agrees to you using the Service. If we learn that we hold personal data of a child under 13, we will delete it. If you believe this has happened, contact us.

12. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Features such as suggesting a “lighter day” for a note are simple helpers that you are free to ignore.

13. Changes to this policy

We may update this policy from time to time, for example when we add features or when the law changes. We will change the “last updated” date at the top, and if a change is significant we will tell you by email or in the Service before it takes effect. This version was last updated on 5 November 2026.

14. Contact and complaints

For privacy questions or requests, email privacy@stickynotes.space. For anything else, email support@stickynotes.space. You can also write to WannaCall Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint, or, if you live in the EU, to your local data protection authority.