Privacy Policy

Last updated 2026-10-25

This policy is issued by Two Threads Collective, LLC ("WOVAN," "we," "us," or "our"), a New York limited liability company, and describes how we handle information for the WOVAN app.

1. What we collect

• Guardians: name, email (verified), phone number (collected, not yet verified).
• Teens 13 and older: name, email (verified). No phone number is collected.
• Children under 13: no account and no login. A parent sets up the child's device and gives consent first; see section 7, "Children under 13."
• Phone numbers of people you invite: if you invite a guardian to join your family — whether you're a teen inviting a parent, or a guardian inviting a co-guardian — we collect that person's phone number to facilitate the invite.
• Extra emergency contacts (teens 13 and older only): the name, phone number and email of someone outside the family whom a guardian approves to receive a teen's SOS alerts, for a period the guardian sets.
• Device information: each device's notification token (so we can send it alerts), its platform and type (for example "iPhone" or "Android tablet"), the app version, its time zone (so schedules run at the right local time), when it last checked in, and, for a teen's device, when its sign-in will run out (so we can warn a guardian beforehand).
• Screen time protection status: whether a kid's device has the permissions WOVAN needs to enforce screen time switched on, so a guardian can see that protection is working.
• Android: which app is open, on a kid's device (see "Android and the Accessibility permission" below).
• Crash reports: when the app crashes or hits an error, a technical report of what went wrong (see section 5).
• Location, only during an SOS: when someone sends an SOS, their device's location at that moment, shared with the people that alert goes to.
• Referral code (guardians, optional): if a parent enters a creator's referral code at sign-up or in Account, we record the code on the family, which creator it belongs to, when it was entered and by which guardian. We use it to credit that creator. They're told only how many families used their code, never who you are. Kids never see or enter a code.
• Activity on a kid's device: locks, schedules, requests for more time and similar events, shown to the family as an activity history.

Android and the Accessibility permission

On a kid's Android device, WOVAN uses Android's Accessibility permission (the AccessibilityService API) to manage screen time. A parent switches it on, holding the device, after WOVAN explains what it does. WOVAN uses it to:

• see which app is open, so it can cover apps that aren't allowed during a lock or a schedule (calls, the camera, messages and SOS always keep working);
• lock the screen when a guardian locks the device;
• stop WOVAN being switched off or uninstalled without a parent. To do this it reads the words on Android's own Settings and app-installer screens, on the device, to recognise the ones that would switch WOVAN off.

Those decisions are made on the device. What reaches our servers is limited to whether protection is switched on and, for the most recent decision only, the name of the app that was open (its package name, such as "com.example.game"), whether WOVAN allowed or covered it, and any error. We keep that so we can fix a device that isn't enforcing properly; each check-in replaces the last one, so it is not a history of app use. WOVAN does not read or store messages, what is typed, passwords, or what is on screen in other apps, and does not use this permission for anything else.

On iPhone and iPad, WOVAN uses Apple's Screen Time framework, and no information about which apps are used leaves the device.

2. What we don't collect

We do not read or store the content of text messages or other messaging-app conversations, and we do not track continuous or live location: location is collected only when someone sends an SOS. We don't collect browsing history, contact lists, photos, or a history of which apps a kid uses or for how long.

3. We do not sell your data

We do not sell or share your personal information with third parties for their own marketing or advertising purposes. The app contains no advertising or analytics SDKs; the one third-party SDK that reports anything is crash reporting (section 5).

4. Who can see what

A family's data is visible only to that family's guardians and, where the app design specifically shows it to them, that family's teen or child. Data is never shared with another family without an explicit, mutual, two-sided approval.

5. Third-party service providers

We share data only with service providers that run parts of WOVAN for us:

• Amazon Web Services: authentication (Cognito), data storage (DynamoDB), our servers, and account-related email (Simple Email Service).
• Expo: delivers notifications and app updates. Notifications then reach the device through Apple's or Google's (Firebase Cloud Messaging) notification services.
• Sentry: crash and error reports. A report says what went wrong in the app, the device type, operating system and app version, and an anonymous account ID. Names, email addresses and sign-in credentials are removed on the device before a report is sent, and IP addresses aren't attached.
• Cloudflare: hosts this website and forwards email sent to getwovan.com addresses.

These providers store and process data on our behalf, under their own security safeguards, and are not permitted to use your data for their own purposes. We may also disclose information if the law requires it.

6. Data retention and deletion

SOS alerts, including any location they carry, and the activity history are deleted automatically after 90 days. Everything else is kept for as long as your account is active, so the app can function. Removing a kid from a family deletes that kid's data. Deleted data is gone from our backups within 35 days.

Deleting your account. A guardian can delete their account in the app: Account, then Delete Account. Anyone, including a teen, can also ask us to delete their account and data at getwovan.com/delete-account, which explains what is deleted and what is kept.

7. Children under 13

This section is our notice to parents under the Children's Online Privacy Protection Act (COPPA).

How it works. A child under 13 never creates an account or logs in. A parent or guardian adds the child in their own WOVAN app, gives consent there, and receives a confirmation email. The parent then sets up the child's device with a one-time code. That device receives a credential that can act only as that one child.

What we collect from a child's device, and why:

• The child's first name and age, as the parent entered them, to show the family who is who.
• Which device is the child's, and its notification token, so WOVAN can reach it with schedule changes and alerts.
• The device's location, only when the child sends an SOS, so their guardians can find them.
• What happens on the device (locks, schedules, requests for more time), to show the family's activity history.
• Device details (type, app version, time zone, last check-in) and whether screen time protection is switched on, so schedules run at the right time and the parent can see protection is working.
• On Android, the name of the app that was open when WOVAN last allowed or covered an app, so we can fix a device that isn't enforcing properly (see "Android and the Accessibility permission" above).
• Crash reports, without the child's name, to fix the app. These go to Sentry, our crash-reporting provider, which acts only on our behalf.

Who sees it. Only the child's guardians in their WOVAN family. We don't disclose a child's information to anyone else, apart from the service providers in section 5, which process it only to run WOVAN for us. Extra emergency contacts outside the family are not available for children under 13. We show no ads, do no analytics about children, and never sell data.

How long we keep it. SOS alerts and the activity history are deleted after 90 days. Everything else is kept until the parent removes the child from the family, which deletes the child's data and stops the child's device from working with WOVAN at once.

A parent's rights. A parent can review the information we hold about their child, have it deleted, or refuse further collection at any time. In the app, removing the child from the family does all three. You can also email hello@getwovan.com. We won't require a child to disclose more information than a feature reasonably needs.

Who we are. Two Threads Collective, LLC, New York, operates WOVAN. Contact: hello@getwovan.com.

8. Your rights

You can request a copy of the personal data we hold about you, ask us to correct inaccurate data, or request deletion at any time by emailing hello@getwovan.com. We'll respond within a reasonable time, consistent with applicable law.

9. International data transfer

Our servers are located in the United States, and we don't currently target users outside the US. If that changes, we'll update this policy.

10. Security

Data is encrypted in transit and at rest. Access to a family's data requires authentication as a member of that family — see our engineering practices for more if you're technically curious.

11. Changes to this policy

The date at the top of this page is the effective date of this version — changes take effect as soon as they're posted here. We encourage you to check this page periodically.

12. Contact

Questions about this policy: hello@getwovan.com