Privacy policy

Last updated 21 October 2026

1. Who we are

Wiggy is an Android app that designs home-screen widgets from a description, and the website at wiggy.io. It is made by IAM, 2615 Nambusunhwan-ro, Gangnam-gu, Seoul, Republic of Korea ("Wiggy", "we", "us"). For the gallery described in section 6, we decide how its data is used. For everything that happens only on your phone, we never receive the data at all.

2. What stays on your phone

Most of Wiggy runs on your phone and keeps its data there, in the app's private storage:

• the widgets you make, their chats with the AI, versions, styles and your notes (Settings → Instructions)
• the latest values each widget shows, and a history of its updates
• pictures you add to widgets, and pictures Wiggy downloaded for them
• which sources you connected and how, and your settings
• API keys, source tokens and your AI sign-in, encrypted with a key held in Android's Keystore

Wiggy turns off Android backup, so none of this is copied to your Google account's backups. Uninstalling Wiggy, or clearing its storage in Android settings, deletes it.

Notifications are made on the phone. Wiggy doesn't use a push service, and replies you type into a notification are saved to that widget's chat.

3. The AI model you choose

Wiggy doesn't include an AI model. You connect one in Settings → AI model, either by signing in with a subscription (ChatGPT) or with an API key from OpenAI, Anthropic, Google (Gemini), xAI or DeepSeek. Requests go directly from your phone to that provider.

What Wiggy sends depends on what you're doing:

• Making or changing a widget: your messages in that widget's chat, your notes, the names of the sources you connected and what they can read, the widget as it looks now, and the results Wiggy reads from those sources for it.
• Pictures: if you attach a picture as a style reference, or when Wiggy checks how a design looks, the picture is sent too. Wiggy only does this with the ChatGPT sign-in.
• Updating a widget: normally no AI is used. If you turned on the AI summary for a widget, the newly read values are sent so the model can write the summary.
• Choosing a model: Wiggy asks the provider which models your account can use.

The provider handles this under its own terms and privacy policy, which you agreed to when you made that account. Where the provider offers it, Wiggy asks it not to store requests (for OpenAI and ChatGPT, store: false). Check your provider's policy for how long it keeps requests and whether it uses them for training.

4. Sources you connect

A source is a service a widget reads from, such as Google Calendar, a weather service or GitHub. Wiggy only reads: it doesn't change, send or delete anything in them. Most source reads go directly from your phone to the source. Vercel sign-in uses Wiggy's Cloudflare server as described below. Source results go to your phone and, when needed to make or update a widget, to your chosen AI model (section 3).

Google

When you connect a Google source, Google asks you to allow read-only access to your email address and one of these:

Wiggy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Wiggy uses Google data only to show it in the widgets you ask for. It never uses it for ads, never sells it, and never lets people read it. It's sent to the AI model you chose only to make and update those widgets. You can remove Wiggy's access at any time at myaccount.google.com/permissions.

Other services

Other sources include Cloudflare, PostHog, Notion, Linear, GitHub, Sentry, Stripe, Atlassian, RevenueCat and Supabase, plus servers or public web APIs you add yourself. Where a source uses a token or key, Wiggy keeps it encrypted on your phone and sends it only to that service. To remove access, disconnect the source in Wiggy or revoke it in that service.

Vercel

When you choose Vercel sign-in, Vercel gives Wiggy's Cloudflare server a grant to read your recent deployments and basic account identity. The server stores the grant encrypted, and your phone stores a separate connection handle. Widget updates send that handle to Wiggy's server, which reads deployments from Vercel and returns only the project name, deployment status, environment and creation time needed by your widget. Wiggy does not store deployment results on the server. Removing the source from Wiggy deletes its server-side grant; you can also uninstall the Wiggy Integration in Vercel. Existing Vercel connections made with a manually entered token still keep that token on your phone.

5. Research and pictures from the web

When a widget needs a source you haven't connected, Wiggy can look for a public one. It searches the public API directory at apis.io and, if you added a Brave Search key, Brave Search, and it reads public web pages. These searches contain what the widget is about, never your keys or your widgets' data. Pictures a widget shows from the web are downloaded from the site that hosts them. Like any web request, these requests show that site your phone's IP address.

6. The gallery

The gallery at wiggy.io is where people share widgets. It uses our Cloudflare servers, as does Vercel sign-in and its deployment reads (section 4).

Browsing and using widgets

You can browse and use shared widgets without an account. When you use one, the app sends a random installation ID that it created. We store it only as a keyed hash, which can't be turned back into the ID. It counts each use once. Older anonymous reports retain their installation hashes, but new reports use your signed-in gallery account instead. The ID isn't linked to your Google account or to your widgets.

A gallery account, for sharing, liking and reporting

To share, like or report a widget, you sign in with Google. We receive and keep your Google account ID and email address. We don't keep your Google name or photo. Your email is private. We use it only to contact you about your shared widgets, such as a review, a takedown or a legal notice. You choose a maker name, which is public.

What sharing publishes

A shared widget includes its design, its title, the description it was made from, its category, size, the kinds of sources it uses and how often it updates. The app replaces your data with sample values before sharing. It refuses to share pictures, links, email addresses, keys or tokens. Your chats, sources and other widgets are never shared. Once approved, a shared widget is public on wiggy.io and in the app, with your maker name, how many people used it and how many liked it. People who use your widget get a copy, which stays on their phones.

Reviews and reports

We review each shared widget before it appears, and we may hide or remove widgets that break the gallery rules. You can report a widget from the app after signing in. A report stores your gallery account identifier, the reason, the reported version and the time. Your identity and report are not shown to the maker or other gallery users. Reports go to our moderation queue; their number does not automatically hide a widget. We keep report decisions and a history of moderation actions. Copyright claims made through the claim form store the claimant's email and the details they give, which we use only to handle the claim.

Abuse limits

To stop floods of sign-ins, shares, reports and uses, the server counts these actions per IP address per day. The counts are deleted after 2 days.

Deleting your maker account

In the app, go to Settings → Gallery account → Delete maker account (steps are also at wiggy.io/delete-account). This deletes your maker profile, email, Google account ID, sessions, likes and every widget you shared, including its files and any reports and claims about it. Reports linked to your account about other people's widgets are also deleted, and your identity is removed from the related moderation history. Older anonymous reports cannot be linked to your account and remain with the widget they concern. Widgets on your phone aren't affected.

7. Purchases

The unlock is sold through Google Play, which handles the payment under Google Payments' privacy notice. We never see your card or billing details. The app asks Google Play whether you own the unlock and remembers the answer on your phone. No purchase data is sent to our servers.

8. Crash reports and app analytics

When Wiggy crashes or hits an error, it sends a report to Sentry (Functional Software, Inc., United States), which we use to find and fix bugs. A report contains the error and where in the code it happened, the app version, your phone's model, Android version, language and free memory, the screens you opened just before, and a random ID for this installation. It never contains your widgets, chats, prompts, source data, pictures, keys or sign-ins, and we don't attach your name, email or IP address. Reports are kept for 90 days, then deleted (Sentry's privacy policy).

The app also uses Google Analytics for Firebase (Google LLC, United States) to count how many people use Wiggy and how. It records when the app is installed, opened, updated and used, and the unlock purchase (without payment details). With these it sends a random ID for this installation, the app version, your phone's model, Android version, language and screen size, and your approximate location (country, worked out from your IP address). It never gets your widgets, chats, prompts, source data, pictures, keys or sign-ins, and not your name or email. Wiggy doesn't use your phone's advertising ID, and ads features and personalisation are off. Data is kept for 14 months (Firebase privacy).

9. This website

wiggy.io uses Google Analytics (Google LLC, United States) to count visits and see which pages people use. It gets the page address and the page you came from, your browser, device type, screen size and language, your approximate location (country and city, worked out from your IP address, which Google Analytics doesn't store), and what you click on the page, such as a link to Google Play. Google Analytics sets cookies (_ga, _ga_*) to tell repeat visits apart. In the EEA, the UK and Switzerland it sets no cookies and sends only cookieless visit pings. Ads features and Google signals are off, so the data isn't used for ads or linked to your Google account. You can block it with a content blocker or Google's opt-out add-on (how Google uses this data).

The home page has a short intro video from YouTube (Google LLC, United States). Nothing is loaded from YouTube until you press play. Then the player loads from youtube-nocookie.com, YouTube sees your IP address and may store data in your browser, as described in Google's privacy policy.

The site itself sets no other cookies and has no ads. It remembers your language choice in your browser's local storage (wiggy.lang) so it can stop suggesting another language. Its fonts come from Google Fonts, so your browser asks Google's servers for them, and Google sees your IP address (Google Fonts privacy). Cloudflare, which hosts the site, keeps request logs for up to 7 days for security and to fix errors. These include IP addresses.

10. What we don't do

• No ads or advertising tools, and Wiggy doesn't use your phone's advertising ID. Analytics in the app and on the site (sections 8 and 9) have ads features off. Crash reports are used only to fix bugs.
• We don't sell or rent personal data, or share it for advertising.
• We don't use your widgets, chats or source data to train AI. We never receive them.
• Wiggy doesn't read your contacts, location, microphone, camera or files. The only pictures it uses are ones you pick with Android's photo picker.

11. How long we keep data

12. Your choices and rights

• On your phone: delete widgets and chats in the app, disconnect sources and AI accounts in Settings, or uninstall Wiggy to remove everything.
• With your AI provider and sources: manage or delete what they hold under their own policies. Revoke Google access at myaccount.google.com/permissions.
• In the gallery: remove shared widgets, or delete your maker account (section 6).

Depending on where you live, you may have the right to access, correct, delete or export the personal data we hold, and to object to or restrict how we use it. You may also have the right to complain to your data protection authority. Contact us (section 17) and we'll reply within 30 days. For the gallery, we rely on providing the service you asked for (your account and shares), and on our legitimate interest in keeping the gallery safe (reviews, reports and abuse limits) and in knowing how the app and the website are used (analytics).

13. Security

Keys, tokens and sign-ins are encrypted on your phone with a key in Android's Keystore. Every connection Wiggy makes uses HTTPS. On our servers, session tokens and installation IDs are stored only as hashes, and access to moderation tools is restricted. No system is perfectly secure. If a breach affects your data, we'll tell you as the law requires.

14. Children

Wiggy isn't meant for children. You must be at least 13 to use it (14 in Korea, or older where your country's law requires), and 18 to share in the gallery unless a parent or guardian agrees. We don't knowingly collect data from children. If you think a child has made a maker account, contact us and we'll delete it.

15. Where data is processed

Gallery data is stored and served by Cloudflare, Inc. (United States), which runs data centres in many countries; it is sent there when you use the gallery, over encrypted connections, and kept as described in section 11. Crash reports are stored by Sentry, and app and website analytics by Google, in the United States. AI providers and sources process what Wiggy sends them in their own locations, mostly the United States. Where the law requires it, these transfers are covered by the providers' safeguards, such as the EU Standard Contractual Clauses.

16. Changes to this policy

When Wiggy changes what it collects or sends, we update this page and the date at the top. If a change matters, for example new data going to a new place, we'll also say so in the app before it takes effect.

17. Contact

Questions and requests about your data: support@wiggy.io. Post: IAM, 2615 Nambusunhwan-ro, Gangnam-gu, Seoul, Republic of Korea.

Privacy officer: IAM, support@wiggy.io.