Privacy Policy

WhereWise exists to tell you whether you are meeting your own office attendance policy. It is a personal tool, not a reporting line. Everything below follows from that.

Your location is never shared with your employer, your manager, or anyone else. There is no employer dashboard, no manager view, and no way for an organisation to be given access to your account. This is a design decision, not a setting.

WhereWise is operated by Preston Dale Ferguson as an individual. For any question about your data, or to exercise any right described here, email admin@wherewise.app.

Account details. Your email address and a hashed, salted version of your password — the password itself is never stored and cannot be recovered, only reset. Optionally a display name and your timezone. The timezone is not decoration: attendance is counted in calendar days, and without it the wrong days get counted.

Your office areas. The coordinates and radius of the places you choose to count as “the office”. You place these yourself.

Attendance records. The times you arrived at and left one of your office areas, and days you marked by hand as attended, planned, PTO, working from home, or a holiday.

Phone status. If you use the mobile app, it reports whether it has background location permission and how many office areas it is watching, so the site can warn you when automatic tracking has quietly stopped.

Password reset and confirmation links. When you ask to reset your password or confirm your address, a random token is emailed to you and only its hash is stored — the link itself is never kept, so a copy of the database could not be used to take an account. Reset links last 30 minutes, work once, and are destroyed when used.

Failed sign-in attempts. To limit password guessing, failed sign-ins are counted against your email address and against the requesting IP address for fifteen minutes, then deleted. A successful sign-in erases them immediately.

No trail of your location is stored — not for a day, not for an hour. Ever.

When your phone reports a position, the server compares it to your office areas, decides whether you have arrived or left, and writes down only that: an arrival time, and later a departure time. The coordinates themselves are discarded in the same request. They are never written to the database and never logged. The only coordinates stored anywhere are the office areas you placed yourself.

This means WhereWise cannot show you where you were last Tuesday afternoon, and that is deliberate. Nobody needs to know where you are between the office and home — only whether you arrived.

There is also no analytics, no advertising, no tracking pixels, no behavioural profiling, and no third-party marketing scripts of any kind. Your data is not sold, rented, or shared for anyone else’s commercial purposes, and it never will be.

WhereWise sets exactly one cookie: a session cookie that keeps you signed in. It contains a random token and nothing else — no personal details are stored in it. It is marked httpOnly so page scripts cannot read it, and sameSite=lax so it is not sent from other sites. Signing out deletes it, and it expires on its own.

There is no cookie consent banner on this site, and that is not an oversight. Under the ePrivacy rules, consent is required for cookies that are not strictly necessary — analytics, advertising, tracking. A cookie that exists solely to keep you signed in is exempt. Since WhereWise sets no other cookies, there is nothing to ask you to consent to, and a banner would be a box to dismiss rather than a choice to make. If that ever changes, you will be asked properly before anything is set.

Running a website means other companies are involved. These are all of them:

Vercel hosts the site and Neon hosts the database. Both process your data on WhereWise’s behalf in order to run the service. Their servers are located in the United States.

Fonts. None. The typefaces this site uses are served from its own domain. They were previously loaded from Google’s servers, which disclosed your IP address to Google on every page load — including on this one. They are now self-hosted, so that request no longer happens at all.

OpenStreetMap. When you view the map to place an office area, map tiles are requested from OpenStreetMap’s servers. Those requests disclose your IP address and, by which tiles are requested, the approximate area you are looking at. A map cannot work without a tile server, so this one is disclosed rather than removed.

Resend. Sends the emails the service needs to send you — password reset links, address confirmation, and the progress summary you chose the frequency of. Your email address and the contents of those messages pass through Resend to deliver them. Nothing is sent to you for marketing, and your address is not added to any mailing list.

Sentry. The mobile app sends crash and error reports so failures can be found and fixed. Reports are configured to strip IP addresses and to drop any diagnostic data containing coordinates, so location does not travel inside an error report.

WhereWise can be connected to another app — typically an AI assistant — so you can ask it about your own attendance. This only ever happens because you approved a specific app on a screen that named it, and nothing is connected by default.

What an approval allows. Reading your visits, your policies, how the current period stands, and your office areas by name. Area coordinates are never sent. It also allows marking a future day as planned in or out of the office, which is the only thing a connected app can write.

What no approval allows. Creating, editing or deleting an attendance record. There is no permission that does it, so this is a property of the service rather than a promise about how apps behave. Your attendance history is only ever changed by you.

This is not sharing. A connected app acts for you, not for WhereWise, and is not a subprocessor — the companies listed above process your data on WhereWise’s behalf to run the service, and a connected app reads it on yours because you said so. What that app does with what it reads is covered by its own terms, and WhereWise sends your data to nobody on its own account.

Ending it. Every connection is listed under Settings → Connected apps, on the web and in the app, showing what it can do, when it was connected and when it last read anything. Disconnecting takes effect on that app’s next request and cannot be undone by the app — it has to ask you again. The key an app holds expires every hour and is renewed only while the approval stands, and an approval that goes thirty days without being used lapses on its own.

Two kinds, and only two. The first is the mail the service cannot work without: a password reset link when you ask for one, and a confirmation when you sign up. There is no opting out of those — without them a forgotten password is an unrecoverable account.

The second is a progress summary: where you stand against your policy, anything you earned, and the dates you were in the office. It arrives monthly unless you say otherwise, and you can change it to daily, weekly, quarterly or never under Settings → Notifications. Every summary carries that link, so turning it off never requires finding this page.

The dates are in there deliberately. A stack of those emails is a copy of your attendance record that sits in your own inbox and does not depend on this service continuing to exist.

There is no marketing email, no newsletter, no product announcements, and no third-party mail sent on anyone else’s behalf.

Sign-ups are limited to a fixed number of accounts. When they are all taken, the sign-up page offers to email you when a place opens up. If you ask for that, your email address and the date you asked are stored — nothing else, and not attached to any account, because you do not have one.

It is used to send you that one message and for nothing else: no newsletter, no product mail, no sharing with anyone. Ask to be taken off, at admin@wherewise.app, and the row is deleted.

The Feedback button on the site and in the app emails your message to the person who runs WhereWise, along with your email address, your plan, and whether you have a policy and office areas set up. That context is there so a bug report can be acted on without a round of questions.

None of your attendance records, office areas or location data are attached, and the message is not stored in the app or the database — it exists only as an email, and is kept no longer than any other correspondence.

Account details, office areas and attendance records are kept for as long as your account exists, because they are the thing the service is for — an attendance history that is deleted is an attendance history that cannot answer the question you came with.

Sessions expire on their own. Failed sign-in records are deleted within a day. Delete your account and everything belonging to it is removed from the database.

You can ask for a copy of everything held about you, ask for anything inaccurate to be corrected, or ask for your account and all its data to be deleted. Depending on where you live, you may also have rights to restrict or object to processing, and to complain to a data protection authority.

Two of those you can do yourself, immediately, without asking anyone. Under Settings → Your data you can download everything held about you as a JSON file, and permanently delete your account and all of its records. Deletion is immediate and cannot be undone — there is no backup to restore from, which is the honest consequence of not keeping copies of your history.

For anything else — a correction, a restriction, a question about what a field means — email admin@wherewise.app.

Passwords are hashed and salted. Traffic is encrypted in transit. Sign-in endpoints are rate limited against password guessing. Session tokens are random, expire, and can be revoked by signing out.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If you find a vulnerability in WhereWise, please report it to the address above rather than disclosing it publicly, and it will be taken seriously.

WhereWise is a workplace tool and is not intended for anyone under 16. Accounts are not knowingly created for children, and any such account found will be deleted.

If this policy changes in a way that materially affects what is collected or who it is shared with, you will be told before the change takes effect — not by a silently updated date at the top of a page.