WattFlow Beta
Home

WattFlow · Web

Privacy policy

Last updated 19 October 2026

This policy explains what information WattFlow collects and uses when you visit the website or use the web app. The beta is available in all countries.

Who is responsible for your information

WattFlow is operated by CoreLane Digital Ltd ("WattFlow", "we", "us"). We are responsible for deciding how your personal information is used.

For privacy questions or requests, contact [email protected].

Information we handle

When you use WattFlow, we may handle:

  • Account information: your email address, optional name, password credential, and calendar timezone.
  • Workspace information: project names and colours; task titles, descriptions, estimates, deadlines and completion state; scheduled sessions; tracked time, timer intervals and notes.
  • Sign-in and security information: session and security tokens, API tokens you choose to create, and information used to protect accounts and keep the service working.
  • Information stored in your browser: display preferences and some unfinished task, schedule and tracked-time edits are saved in local storage so you can recover drafts. They remain in that browser until WattFlow clears them or you remove them through your browser settings.
  • Support correspondence: information you include when you contact [email protected]. We keep support messages for up to 30 days after the request is resolved.
  • Website analytics: if you accept analytics cookies, Google Analytics 4 (GA4) collects basic website usage information, such as page views, visitor and session counts, approximate location, and browser and device information. We do not configure GA4 to collect task content, account email addresses, or advertising data.
  • Service diagnostics: technical information about errors and the environment in which they occurred is sent to our first-party, self-hosted Bugsink error-reporting service. We also record limited timer-rollout events: event type, client version and capability, command outcome, and a keyed pseudonymous account reference. These rollout events do not include task titles, notes or timer payloads.

Please avoid putting sensitive personal information in task titles, descriptions, notes or support messages unless it is needed for your use of WattFlow.

How we use information and our legal bases

We use information to provide and operate WattFlow, including creating and securing accounts, synchronising workspace data, providing scheduling and time-tracking features, remembering preferences and recovering unfinished edits. We do this because it is necessary to perform our contract with you.

We use information to respond to support requests, diagnose errors, protect the service and prevent misuse. We rely on our legitimate interests in operating, maintaining and securing WattFlow, while taking steps to protect your rights and information.

We use Cloudflare Turnstile on sign-in, account creation, and password recovery forms to help distinguish people from automated requests. Cloudflare processes security signals such as your IP address, browser information, sitekey, and the page origin for bot detection. Cloudflare may also use these signals to improve Turnstile. See Cloudflare's Turnstile Privacy Addendum.

We use essential cookies and similar storage to sign you in and protect requests. This is necessary to provide the web app and keep it secure.

We use GA4 analytics only if you choose Accept analytics in the cookie choice. We rely on your consent for this analytics storage and processing. You can choose Reject analytics or change your choice later. Rejecting analytics does not prevent you from using WattFlow.

We may also use information where needed to comply with legal obligations.

Cookies and browser storage

WattFlow uses essential cookies for sign-in and protection against cross-site request forgery. These cookies are needed for the web app to work. We also use browser local storage for appearance preferences and recoverable drafts.

GA4 analytics cookies are set only after you accept analytics. GA4's default cookies include _ga and _ga_<measurement-id>, which help distinguish visitors and sessions. Their default expiry can be up to two years, subject to browser limits and our GA4 configuration.

You can change or withdraw your analytics choice using Cookie settings on the website. You can also clear local storage and cookies through your browser settings. Clearing them may sign you out or remove drafts that have not synced.

When information is shared

We use the following providers to operate WattFlow:

  • Hetzner hosts the website and database in Germany.
  • Amazon Web Services (AWS) Simple Email Service (SES) sends service emails from the London region.
  • Bugsink receives server error reports through our first-party, self-hosted service in Germany.
  • Cloudflare processes security signals through Turnstile to protect sign-in, account creation, and password recovery forms from automated abuse.
  • Google processes GA4 analytics information if you accept analytics cookies.

Apart from these providers, we do not share information with other organisations unless you choose to connect an integration, we are required by law, or sharing is necessary to protect users or WattFlow. An integration you connect may access information allowed by the permissions you grant it. You can revoke API tokens in WattFlow settings.

Google may process analytics information in countries outside the UK or European Economic Area. Where required, transfers are protected by the transfer mechanisms in Google's data processing terms. You can contact us for more information about those safeguards.

How long we keep information

We keep account and workspace information while your account is active. You can request account deletion by contacting [email protected]. After we complete a verified deletion request, we remove the associated live account and workspace data. Copies in backups may remain for up to 7 days before they expire.

Support messages are kept for up to 30 days after the request is resolved.

We set GA4 user and event-level data retention to 14 months. Google may retain aggregated reports for longer. You can find more about how Google handles Analytics data in Google's Analytics documentation.

We keep error reports and security records only for as long as reasonably needed to diagnose issues, protect the service, investigate misuse, and meet legal obligations. We then delete or anonymise them.

Your choices and rights

You can update some account details and revoke API tokens in WattFlow settings. You can ask us for access to, correction of, or deletion of your personal information, or ask us to restrict or object to certain uses. Contact [email protected]. We may need to verify your identity before acting on a request. We respond within the time required by applicable law.

You can withdraw your consent to GA4 analytics at any time through Cookie settings. This does not affect processing that took place before you withdrew consent.

Depending on where you live and the circumstances, you may also have the right to receive a portable copy of information or to complain to your local data protection authority.

Security

WattFlow uses account-scoped access controls. The production configuration is designed to use HTTPS and secure session and CSRF cookies. No method of storing or transmitting information is completely secure. Keep your password and API tokens private, and contact us promptly if you think your account has been accessed without permission.

Changes to this policy

We may update this policy as WattFlow changes. We will update the date above and, where a change materially affects how we use information, provide notice through the service or another appropriate channel.

Contact

For privacy questions and requests, contact [email protected].

WattFlow is operated by CoreLane Digital Ltd.