Privacy Policy

Introduction

Woven (“we,” “our,” or “us”) operates the Woven mobile application and website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Information We Collect

Account Information

When you create an account, we collect your email address, name, username, and optionally your date of birth. We use a third-party authentication provider (WorkOS) to securely manage your sign-in.

Profile and Preferences

You may provide additional information such as a profile image, fashion category preferences (e.g., menswear or womenswear), and favorite brands. These help us personalize your experience.

Content You Create

We store the content you create and share on Woven, including posts, images, videos, captions, bookmarks, likes, and collaborative edits. We also store information about who you follow and who follows you.

Usage and Activity Data

We collect information about how you use the app, including search queries, product tracking activity, and general interaction patterns. This helps us improve the service and provide relevant recommendations.

Contacts and Phone Number

If you choose to sync your contacts in the Woven iOS app to find friends who already use Woven, your contacts are read on your device only. For each phone number and email address, the app computes a one-way cryptographic digest locally and sends only those digests. We never receive a readable phone number, email address, or contact name, and we do not store the digests you send — they are used to answer which of your contacts already have a Woven account and then discarded. Invitations are sent by you through your own messaging app; we do not send them and keep no record of who you invited.

You may separately choose to add your own phone number so that people who have it saved can find you. To confirm the number is yours, we send it to our SMS provider (Twilio) once, to deliver a verification code; we do not keep the number after that. We store only a salted, one-way hash of it together with its country code and last four digits, so that you can recognise and remove it. The number is never shown to anyone else. You can remove it at any time, and deleting your account removes it automatically. Neither syncing contacts nor adding your number is required to use Woven.

Device Data

If you enable push notifications, we store your device token to deliver notifications. We remove device tokens when you sign out.

How We Use Your Information

• Provide the service: display your posts, enable social features (following, liking, bookmarking), and deliver notifications.
• Personalize your experience: recommend products and content based on your preferences and activity.
• AI-powered features: generate descriptions, detect products in images, and provide style recommendations using artificial intelligence.
• Voice features: if you use voice captions, we use speech-to-text transcription to convert your audio to text.
• Improve the service: analyze usage patterns to fix bugs, improve performance, and develop new features.
• Communicate with you: send push notifications, announcements, and service-related messages.

Third-Party Services

We use the following third-party services to operate Woven:

• Authentication and identity providers for secure sign-in.
• Cloud storage providers for hosting images and videos you upload.
• AI service providers for generating descriptions, product analysis, and recommendations.
• Speech-to-text providers for voice caption transcription.
• Analytics providers for anonymous website usage data.
• Push notification services for delivering notifications on your device.
• Cloud infrastructure providers for backend services and database hosting.

These services process data on our behalf and are subject to their own privacy policies. We do not sell your personal information to third parties.

Data Retention

We retain your account data for as long as your account is active. Temporary data such as product search caches are retained for up to 60 days, and “find similar” results are cached for 7 days. When you delete your account in the Woven app, your account access is disabled immediately and permanent deletion of your account data begins. Contact digests you submit when syncing contacts are not retained at all. Some anonymized data may be retained for analytics purposes.

Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Delete your account instantly in the Woven app from Settings, or submit a deletion request at woven.my/delete-data.
• Withdraw consent for optional data processing at any time.

To exercise any of these rights, contact us at jess@woven.my.

Children's Privacy

Woven is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly.

Security

We use industry-standard security measures to protect your data, including encrypted connections, secure authentication, and access controls. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by other means. Your continued use of Woven after changes are posted constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data, contact us at jess@woven.my.