Privacy Policy

Last updated: October 2026

What changed: this update explains the relay we use to reach Google's Gemini, and what Google keeps from it (see Third parties).

Wombow respects your privacy. This policy explains what we collect, why, and what control you have over it. It covers both Wombow for iPhone and Wombow for Windows; where the two differ, each is called out separately.

What we collect

Automatically, while you use Wombow

• Device identifier — an anonymous UUID generated the first time you launch the app, stored only in your iOS Keychain. It is NOT linked to your Apple ID unless you explicitly sign in with Apple.
• Camera frames — while a session is active, a JPEG image is captured every 2 seconds and sent to our servers, and from there to Google's Gemini, which writes the reply. We don't save the image, except as noted under Third parties, which also explains what Google keeps.
• Photos you attach in chat — if you choose to attach photos (from your library or camera) to a chat message, they are sent with that message to the cloud model you picked and used for that reply. We don't save them, except as noted under Third parties, which also explains what Google keeps if you picked a Gemini model. Attaching is always your explicit action; on-device models never receive photos.
• Voice transcripts — when you speak, iOS transcribes on-device using SFSpeechRecognizer. The transcribed text (not the raw audio) is sent with the next frame so the AI can respond.
• Chat messages — text you type or speak in Chat mode is sent to the AI provider you select so it can generate a reply. If you choose an on-device model, the conversation itself runs entirely on your phone; when you are signed in, the text of the conversation is also saved to your account (see “Your account”) so you can continue it on another device.
• Usage metadata — game preset, usage counters (your weekly allowance), subscription tier. Used for rate limiting and aggregated analytics.
• Ambient sound classification (opt-in only) — when you enable "Suggest a mode" in Settings, while the Home screen is visible Wombow runs Apple's on-device sound classifier on the microphone input to detect whether a TV, sports broadcast, or movie is nearby. The classification runs ENTIRELY on your device with Apple's bundled model — no audio bytes, waveforms, or spectrograms leave the phone, and the suggestion is not logged anywhere. Default is OFF.

If you sign in with Apple

• The opaque Apple user ID. We use it only to let your subscription survive device reinstalls.
• Your email address only if you choose to share it.

If you purchase a subscription

• Apple tells us your subscription product ID, transaction ID, and expiration date. Payment itself is handled by Apple — we never see your card number.

Wombow for Windows

The Windows companion works the same way in spirit, but it reads your screen instead of a camera, so the specifics differ:

• Screen frames — while a watch session is running, Wombow captures your screen roughly every 2 seconds. On the cloud tier each frame travels over encrypted connections to our servers and on to Google's Gemini, which writes the commentary. We don't save frames, except as noted under Third parties, which also explains what Google keeps. On the local tier the frame never leaves your PC at all: it is analysed by a model running on your own graphics card.
• Standby (chat-only) mode — frames are held in memory only (the most recent few seconds) and are never analysed, never written to disk, and never uploaded. They are sent only if and when you type a message yourself, so the AI can see what you were just looking at.
• Game-published match data — on a few games (League of Legends, CS2, Dota 2) Wombow reads the read-only match state the game itself publishes on your PC — score, clock, who is alive. On the local tier it never leaves your PC; on the cloud tier it is included, as text, in the request that produces a line of commentary, and is handled exactly like the frame it travels with. For CS2 and Dota 2, Wombow writes one small integration file into that game's own config folder to switch the feed on; you can delete it any time.
• Highlight screenshots — when a moment is flagged as a highlight, that single frame is saved to Pictures\Wombow Highlights on your PC only. It is never uploaded. You can switch this off in Settings.
• Device identifier — an anonymous UUID generated on first launch and stored in %AppData%\Wombow.
• Spoken commentary text — to give Wombow a natural voice, the text of a line (never the frame) is sent to the voice service you pick in Settings. If that service cannot speak a line, the next one after it in this order says it: Microsoft's free Edge voices, then our server-side neural voice (Alibaba Qwen3-TTS), then a voice built into Windows. Choosing a Windows voice keeps the text on your machine.
• Usage metadata — game preset, usage counters, subscription tier, for rate limiting and aggregate analytics.

Anonymous game statistics (Windows only — you can switch it off)

Almost every Wombow session runs on the generic preset, and we cannot tell whether that is because the games people play are missing from our list or because our automatic detection is failing. So the Windows app can send one small, anonymous report about what is in your foreground. It is designed so that nothing in the stored result can be traced back to a person.

Does your copy do this? Only if Settings shows a switch called “Share anonymous game stats”. This section describes that switch and nothing else: if your build of Wombow for Windows does not have it, that build sends none of what is below, whatever this page says.

• What is sent — five things: the file name of the foreground program (for example cs2.exe); which entry in Wombow's own game list that file name matched, if any — the app looks it up in a table it ships with, and “no match” is the answer we are looking for; whether that window was filling the screen; how the game preset in use was chosen (one of: never changed from the default, switched automatically, or picked by you); and the version number of the Windows app. At most one report per watch session, and at most one per hour.
• What is NOT sent — the window title, the program's folder or path, your screen, any image, your other file names, and anything you typed or said. Your account or device identifier travels with the request, exactly as it does with every other call the app makes, and is used only to rate-limit the report and to produce the one-way code described below. It is never written down next to what was reported.
• What we keep — per day, aggregates and nothing else: a count for each combination above, an irreversible estimate of how many different people were seen, and a plain tally of how many reports we rejected as malformed. There is no per-person record, no event log, and no history: nothing per person is written down, so there is nothing to reconstruct one from. The app version is checked to make sure the report is well formed and then discarded — it is not stored with the statistics.
• How the estimate is de-identified — before it goes into that estimate, your account (or, if you are not signed in, your device identifier) is turned into a one-way code, using a key made of random bytes that are generated fresh every day and thrown away when that day ends. So the same person gets a different code tomorrow and no two days can be linked together — and once a day is over, nobody can work out that day's codes again, including us, because one of the ingredients no longer exists anywhere. The estimate itself is a HyperLogLog, a structure that keeps a rough headcount and not the things it counted.
• How long it is kept — 40 days. The counters expire on their own after that, and nothing about a person is archived. We do copy the aggregate table — program names and totals, never anything tied to a person — into our own internal engineering notes, and those we keep.
• Deletion — because nothing in these statistics is linked to you, there is nothing for us to find and remove if you ask; they age out by themselves within 40 days.
• How to switch it off — Settings → “Share anonymous game stats”.
• Pure local mode never sends it. A watch session on the local tier makes no report. The only thing such a session can send our servers is spoken text, as described above: every line if you picked our server-side voice, or, with Microsoft's Edge voice picked, a line Edge cannot speak.

Your account (both apps)

• Email and password — if you register with an email address, your credentials are held by Supabase, a specialist authentication provider, and never stored on Wombow's own servers. We keep only an internal user ID and your email address.
• Sign in with Google — we receive your Google account's email address and an opaque user ID, used solely to identify your account across devices.
• Whichever way you sign in, one email address is one account: signing in through a different method with the same verified email links to the same account rather than creating a second one.
• Saved conversations — when you are signed in, the text of your chat conversations is saved to your account so you can find them and continue them from any device, like any modern assistant. This archive is text only: camera frames, screen frames, screenshots, and attached photos are never part of it. Each conversation is kept until you delete it in the app or delete your account. Signed out, conversations are not saved to an account; they stay on the device they happened on.
• What Wombow remembers about you (profile memory) — a small, capped set of preference facts (what to call you, the games you main, how you like to chat) distilled over time from your conversations, including things you say out loud during watch sessions. It exists so Wombow feels like the same companion on every device. It is on by default; in Settings you can see every fact, delete any single one, clear them all, or switch the feature off entirely. By design it never stores sensitive details — health, politics, religion, sexuality, or precise location are rejected before anything is saved.

If you subscribe on PC

• Payment is handled by Stripe in your browser. We never see or store your card details — Stripe tells us only your plan and its renewal date.

If you report a reply

• When you use Report on one of Wombow's messages, we receive that one line of text, any note you add, and a little context to reproduce it: which app and version, the game preset, and which model produced it. We keep reports for up to 90 days so we can investigate and fix the behaviour.
• A report never includes your screen, your camera, your highlight screenshots, or the rest of the conversation.

Third parties

We do not sell your data, and we do not share it with advertisers or data brokers. Each company below receives only what a specific feature needs. Note the first one: Google keeps what reaches it through our AI relay, and may use it for its own products.

• Google (Gemini), through our own AI relay — Gemini writes live commentary and Gemini chat replies. We normally reach it through a relay server we run, which connects to Google's Antigravity service. Each request carries what the reply needs: frames, what you said or typed, attached photos, match data, recent conversation and what Wombow remembers about you. Under Google's terms for this service, Google keeps it until we ask Google to delete it, may use it to develop and improve its products and AI models, and Google employees and contractors may review it. The relay does not store the content of requests: failed requests are not written to disk, its log folder lives only in memory and is cleared whenever it restarts, and the only record it keeps is a one-line access entry per request (time, status, duration) that is rotated away.
• OpenRouter — our backup route to Gemini when the relay is slow or failing; a request can go both ways at once. It is also the only route for OpenAI and Anthropic models in Chat, and for recaps, Wrapped, profile memory and web search. On this route your data is not used to train AI models and OpenRouter does not store it; Google keeps Gemini requests sent this way for up to 55 days to check for abuse, or not at all, depending on the Google service used. On-device and local models use neither route, and the app asks for your consent before anything is sent.
• Upstash Redis — stores your usage counters, subscription entitlement, recent conversation history (last 16 turns, 7-day TTL), and the anonymous per-day game counters described above (40-day TTL).
• Sentry — crash and error reports. Reports contain only the error and a stack trace: they do NOT include camera frames, screen captures, photos, voice transcripts, or chat text; screenshots and view hierarchies are disabled.
• Resend — delivers our account email (verification, password reset) and forwards a content report to our review inbox when you send one. A forwarded report carries the reported line, your note, and the same context described above; it does not carry your account or device identifier.
• Supabase — holds email/password credentials for accounts registered with an email address, so those credentials never sit on our own servers. Its database also stores your saved conversations and profile memory when you are signed in (see “Your account”).
• Stripe — subscription payments made outside the App Store (PC). Card details go to Stripe directly; we never see them.
• Alibaba Cloud (Qwen3-TTS) and Microsoft (Edge voices) — turn a line of Wombow's text into speech when you pick one of the cloud voices. Only the sentence being spoken is sent; never a frame or an image. Picking a voice built into Windows keeps this on your machine.
• Google — for Sign in with Google, if you choose it.
• Apple — for Sign in with Apple, subscription billing, and App Store services.

What's kept on this device

These features keep their data on your iPhone, and deleting the app deletes it from there. Some of it also leaves the phone when you are signed in or when a feature needs it; a daily recap, for example, is written by a cloud AI model from a summary of that day's sessions, including a few things you said.

• Chat history — your saved chat conversations (the drawer in Chat) live in the app's local database on this device. Signed in, the text also syncs to your account (see “Your account”); signed out, it stays here only.
• Notebook — session keepsakes, highlights, and recaps are stored locally; you can export or delete them from the app.
• On-device model chats — with a downloaded on-device model, the AI itself runs on your phone: no frames or photos ever leave it. Signed in, the text transcript syncs to your account like any other chat; signed out, it stays local.

On Wombow for Windows, the equivalent data lives on your PC, in %AppData%\Wombow and Pictures\Wombow Highlights. Some of it also leaves the PC when you are signed in or when a feature needs it; on the cloud tier, for example, what Wombow remembers about you goes along with each request.

• Watch and chat history — transcripts of your sessions, kept on your PC. Watch-session transcripts stay local; the text of typed chats additionally syncs to your account while you are signed in.
• What Wombow remembers about you — a small set of preferences it picks up over time (the games you main, what to call you). Viewable and erasable any time under Settings → “What Wombow remembers”. Signed in, this becomes your account-level profile memory, shared across your devices and controllable the same way.
• Highlight screenshots — yours alone, never uploaded.
• Local model sessions — with a local model selected, commentary and chat run entirely on your own machine and nothing about your screen leaves it. Signed in, the text of local chats syncs to your account; your screen never does.
• Uninstalling asks whether to delete all of this or keep it.

Your rights

• Ask what we have by emailing privacy@wombow.com.
• Ask for deletion by emailing privacy@wombow.com. We delete our copy immediately: we erase your Redis entries, and the device ID regenerates on next launch. (The anonymous game statistics above are the one exception on our side, and that section explains why: there is nothing in them that points at you, so there is nothing to look up and remove.) Copies that reached Google through our AI relay are governed by Google's terms, and we periodically ask Google to delete all of them. Gemini requests sent through OpenRouter are deleted by Google on its own within 55 days.
• Delete any saved conversation right in the app; it is removed from your account, not just this device. Profile memory is deletable fact by fact or wholesale, and can be switched off in Settings. Deleting your account erases your saved conversations and profile memory with it.
• Opt out of crash reports in Settings.
• On PC: erase what Wombow remembers about you from Settings, turn highlight saving off, or delete every local trace by uninstalling and choosing to remove your data.
• Report an AI reply you find inappropriate — use “Report” on the message itself, and it comes straight to us.

Children

Wombow is not directed at children under 13. Do not use if you are under 13.

Contact

privacy@wombow.com