privacy in your little world.

your account and your worlds

Wosa stores your account details, sign-in sessions, world memberships, and the things you keep. your name and timezone help members recognise you and see local times. Wosa shows locally illustrated ghost portraits in place of imported account photos. worlds are accessible to their members through account and membership checks.

public profiles and drops

A public profile is optional. When you publish it, your chosen name, handle, bio, chosen ghost or profile photo, cover background, Crew (people you follow), Orbit (people following you), and explicitly published drops are visible to anyone. Public drops may include text and a photo. Private world messages, photos, invitations, nationality, religion and celebration preferences are never copied to your public profile automatically.

You can delete your drops or turn off profile publishing to hide the profile and its drop images from Wosa’s public routes. Images uploaded for profile pictures, covers and drops are separately resized and re-encoded with metadata removed. Other people may retain copies they downloaded while content was public.

your profile and celebrations

Nationality, religion or traditions, any saved celebration preferences, country, city, and reminder time zone are optional preferences stored on Wosa’s server. They are visible only to you and are not sent to card-design or writing providers. Wosa does not infer religion from your name or location. Wosa uses the optional background you enter to notice relevant upcoming occasions and privately ask whether you would like a panel. There is no celebration checklist to complete.

Occasion suggestions stay personal until you explicitly add a panel to a world. A shared panel contains the celebration, your gathering date, preparations, and a published calendar source. Your profile details and personal reminder are excluded. You can dismiss suggestions, turn them off, or clear optional preferences in settings → profile & account. Clearing preferences does not remove panels already shared with a world or reminders you previously set.

chat in your world

ordinary chat messages are stored on Wosa’s server and shared with members of that world. each person has their own read status. ghost reactions are stored with the message and visible to world members; you can change or remove yours, and leaving removes your reactions. Chat does not send your messages to the card-design or writing models. Create is the separate mode for generated previews. chat history is included in your world export. leaving removes access; chat messages remain available to the remaining members.

wosa inside imessage

when you message wosa or add it to a conversation, photon handles the messages delivered to its identity. in groups, wosa processes explicit requests addressed to it and replies to its own cards. unrelated conversation messages are discarded before wosa stores them or sends anything to a model. requests sent directly to wosa are treated as requests to the assistant.

wosa keeps provider sender identifiers, conversation membership, saved cards and delivery metadata to scope access and recover interrupted requests. typed creation requests may use the card-design and writing providers described below; member addresses and unrelated conversation history are excluded. sending a creation request asks wosa to return a card to that conversation, without the website’s separate preview step. pending or failed request text remains for recovery; confirmed delivery clears that request text.

opening a card requires a private device connection sent to your own messages, with an explicit confirmation. those sessions are separate from website sign-in, expire after thirty days and can be revoked with disconnect this device. private connection links expire after ten minutes and work once. current provider membership is checked before card access; forwarding a card link does not grant access. expense flags record only what a participant says they paid and never transfer money. photon and the imessage launcher are additional services; this integration does not provide end-to-end encryption through wosa.

live activity

when live activity is enabled, your ghost shows whether you are here, typing, listening, watching, recording a voice note or in a connected call. only members of the world you have open can see it. these short-lived signals never include draft words or media content. closing or hiding the world ends its presence, and a server restart clears live activity. you can hide activity using the ghost’s privacy switch on this device. wosa does not infer thinking, sleep or gender.

audio, video, and screen-sharing calls

When you join a call, Wosa sends your display name, a connection identity, and the media you choose to publish to the configured LiveKit service. LiveKit transports microphone audio, camera video, and shared-screen video or audio between participants. The connection is encrypted in transit; this implementation does not provide end-to-end encryption. Wosa does not record or transcribe calls and does not send call media to AI models.

Only signed-in members of the world can request access. Wosa keeps call metadata such as who started a call, participant states, and start/end times. Your camera and microphone are requested only after you choose to test devices or join. Screen sharing requires a separate browser selection. Incoming-call prompts appear while Wosa is open. Optional app push can alert an enabled browser when Wosa is closed; opening an alert leads to a call preview. These notifications do not provide a native iPhone call screen.

optional app notifications

App notifications are separate from Wallet. After you enable a browser, Wosa stores its push subscription endpoint and encryption keys, with a browser-specific revocation token hash. Each world has your own choices for incoming audio calls, video calls, missed calls, personal reminders, and shared plan updates; they start off. Lock-screen copy is generic and omits names, message text, reminder titles, and payment amounts.

Your browser’s push service carries encrypted notification payloads and delivery metadata. Notifications can contain a link to a world, call, or card; opening it still requires current account access. Quiet hours, device permissions, Focus, connectivity, and browser support affect delivery. Signing out requests removal of this browser’s subscription. Already queued or delivered notifications may remain under device control.

photos and voice recordings

uploaded drafts are visible only to the person who added them until explicitly kept or attached to a shared entry. shared photos and voice notes are accessible to world members. photos are resized and re-encoded, removing GPS metadata; original photo files are not retained. voice recordings are converted to audio-only M4A with metadata removed.

media is stored privately on the Wosa server or in Cloudflare R2, depending on the upload’s storage configuration. access is checked when a file is requested. this is not end-to-end encryption. a person who downloads a file can retain that copy.

song search and shared players

the optional song picker uses youtube api services. pressing search youtube sends the song or artist text you submit to google’s youtube data api. it does not include world membership, chat history or saved card contents. public search results are cached in memory for up to ten minutes. choosing a result prepares a preview with your own words as its title. only your chosen link and personal card wording are kept when you share; youtube result titles, channel names and thumbnails stay temporary search data.

loading youtube thumbnails or opening a youtube player connects your browser to google, which can receive your ip address and browser information. embedded players can serve advertisements and use cookies or similar storage under the google privacy policy. playback remains in youtube’s visible player; wosa does not download or extract the audio. these optional features are also covered by the youtube terms of service.

typed previews and AI

photo-only prompts, saved-content lookups, and updates run locally on Wosa’s server. other typed drafts may be sent to TypeSafe to choose a card layout and visual style. simple notes and explicit lists can reuse your words; drafts that need additional wording or structured content also go to OpenAI. OpenAI requests disable API storage; this is not a promise of zero provider-side retention, and no equivalent setting is claimed for TypeSafe. photos, voice recordings, saved cards, world names, and member profiles are not included in these requests.

previews become shared cards only when you press send. avoid typing information into a generated preview that you do not want processed this way.

scheduled notes and wallet

a scheduled note stays hidden from other members until delivery. apple wallet is optional: one personal wosa pass covers the worlds you select, including new worlds automatically. you can mute each world and choose alert categories in settings → notifications. categories start on for a new card; saved off choices from older cards remain off. shared note text needs a separate opt-in. the pass can show your next plan and date; activity alerts use generic copy without message text, media, payment amounts or game answers.

an existing installed card becomes the account card without changing its update token. extra older world cards become inactive and can be removed in apple wallet. apple and your iphone settings control delivery and may delay or combine updates. wallet cannot ring or answer a call. wallet content may be visible on a shared device, and offline copies do not disappear instantly when access changes.

keeping, trash, and leaving

completed cards move into history; that does not delete them. trash and archive can be restored. permanent deletion is a separate manual action. draft uploads and trash are not deleted on a timer.

leaving a world removes your access. when the last person leaves, the world’s entries are removed. stored files and backups may remain until manually removed. backup retention and account-deletion controls are still being developed.

your controls

you can review a preview before keeping, remove your uploaded attachments, export permitted shared content, choose your Wallet preferences, leave a world, and sign out. signing out ends this browser session; it does not delete your account or leave your worlds.

Personal reminders and their scheduled times belong to the person who sets them. They appear in that person’s calendar. Optional Wallet reminder alerts use generic copy; bill names and amounts remain in Wosa.