Privacy Policy

Last updated: 30 October 2026

What we collect

• Account: username, the name you want to be called, and the email address and account ID of the Google account you sign in with.
• Phone: the WhatsApp number you connect, so Weave can reply to you.
• Messages and projects: what you send Weave (text, and voice notes, which are turned into text on our own server) and the apps and sites it builds, so it can keep working on them. Older parts of a conversation are condensed into a short summary.
• Files you send: photos, spreadsheets, PDFs and other files you send in the chat or through an upload link (up to 5 MB each; programs and scripts are refused). The AI reads a spreadsheet's column names and a few sample rows and the text of PDFs and Word files; photos are shown on your websites.
• Referrals: which account invited you, so the person who invited you can see how many friends signed up and paid.
• Payments: payment ID, amount and date from Dodo Payments. We never see your card or UPI details.
• Safety records: messages flagged as spam, off-topic or unsafe, and any warning, mute or block that followed.
• Usage: number of builds and the amount of AI processing used, to enforce limits and control costs.

How we use your data

By using Weave you agree that we use the data above to:

• run the service: reply to your messages, build, change and host your apps and websites, and remember your projects and preferences;
• send what you write, your files' contents and the conversation so far to our AI providers (below) to produce replies, apps and sites;
• take payments, track your plan and referrals, and enforce usage limits;
• keep Weave safe: detect spam, unsafe requests and abuse, and act on reports;
• fix problems and improve Weave, for example by reviewing failed builds and conversations where Weave got something wrong.

We don't use your data to train AI models.

Who processes it

• Twilio and WhatsApp (Meta) deliver messages.
• OpenRouter (GLM model) writes replies, apps and sites from your requests; Google Gemini looks up public information for new websites.
• Dodo Payments handles payments.
• Cloudflare carries traffic to our server; Netlify hosts askweave.xyz.
• Google handles sign-in (we receive only your name, email and account ID).

We don't sell your data and don't use it for advertising.

Who at Weave can see it

A small number of Weave developers can open a password-protected operations console. It shows accounts (including phone numbers), recent messages, conversation summaries, builds, payments, referrals and safety flags, used to run Weave, fix problems, handle abuse reports and stop misuse. Every view and action in it is recorded in an audit log.

How long we keep it

Messages, summaries and uploaded files stay while your account exists and are deleted with it. Safety and payment records may be kept longer where needed to prevent abuse or meet legal duties.

Public sites

Websites you build, and any photos you uploaded for them, are published at your address on askweave.xyz and are visible to anyone with the link.

Your choices

• Download all your data from the dashboard at any time.
• Delete projects (restorable for a limited time) or delete your whole account from the dashboard.
• Text STOP to Weave to stop receiving messages.

Security

Sessions use secure, HttpOnly cookies on app.askweave.xyz. A second cookie, weave_signed_in, only says that you are signed in (it holds no personal data) so askweave.xyz can show your Dashboard button; it is removed when you sign out. Hosted sites run sandboxed and can't send data anywhere. Upload links are private, work once and expire after 30 minutes; programs and scripts are refused and nothing uploaded is ever run.