Privacy policy
What data Widget Friends uses, why, who helps us run it, and what you can ask of us.
Last updated: November 9, 2026
The short version
- We collect what we need to run your widgets and Widgimals: your email, your widget settings and what you log in them.
- We don't use analytics or advertising trackers, and we never sell or share your data for advertising.
- We never see your Notion pages. Notion only shows our widget inside your page.
- You can delete your account and all its data at any time on your dashboard.
1. Who is responsible
The controller for the processing described here is:
[YOUR FULL LEGAL NAME OR COMPANY NAME][STREET AND NUMBER]
[POSTCODE AND CITY]
Switzerland
Email for privacy questions: [PRIVACY EMAIL, e.g. privacy@yourdomain.com]
This policy applies to the Widget Friends website, the widgets you embed in Notion or elsewhere, and the emails we send. It is written to meet the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), the UK GDPR, and US state privacy laws including the California Online Privacy Protection Act (CalOPPA) and the California Consumer Privacy Act (CCPA).
Representatives in the EU and the UK
Because we are based outside the EU and the UK, we have appointed representatives you can also contact:
EU (Art. 27 GDPR):
[EU REPRESENTATIVE NAME][STREET AND NUMBER]
[POSTCODE AND CITY]
[EU COUNTRY]
Email: [EU REPRESENTATIVE EMAIL]
UK (Art. 27 UK GDPR):
[UK REPRESENTATIVE NAME][STREET AND NUMBER]
[POSTCODE AND CITY]
United Kingdom
Email: [UK REPRESENTATIVE EMAIL]
2. What we use, why, and for how long
| What | Data | Why and legal basis | How long |
|---|---|---|---|
| Your account | Email address, a user ID from our sign-in provider, your time zone, your plan, whether reminder emails are on, and when you signed up. When you sign in, our sign-in provider also processes your IP address, browser details and, if you use it, your Google or other login. | To give you an account and keep it secure. Contract (Art. 6(1)(b) GDPR). | Until you delete your account. |
| Widgets and Widgimals | Widget settings and everything you type into them (labels, titles, dates such as a birth date for the life-progress widget, quotes, links), your Widgimals and their history, coins and items. | To show and save your widgets. Contract (Art. 6(1)(b)). | Until you delete the widget or your account. |
| Habit and mood logs | The counts you log in habit counters and the daily mood (1 to 5) you pick in a mood widget, with their dates. | To show you your history, charts and streaks. Contract (Art. 6(1)(b)). A mood rating can say something about your wellbeing. Where the law treats it as sensitive data, the legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give by adding a mood widget and logging a mood. You can withdraw it at any time by deleting the widget. | Until you delete the widget or your account. |
| Trying without an account | If you try the editor or name an egg before signing up, the settings are saved in your browser and, so you can pick them up after sign-up, on our server without any name or email. | To keep your work until you sign up. Legitimate interest (Art. 6(1)(f)) in offering a try-before-you-sign-up flow. | In your browser: 7 days. On our server: 30 days, then deleted automatically. |
| Purchases | Your plan, purchases, Stripe customer ID, and the consent you gave at checkout with its date. Card and bank details are entered on Stripe's page and never reach us. | To sell you Pro and coin packs and keep accounting records. Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). | Accounting records: 10 years (Swiss Code of Obligations, Art. 958f). Other data until you delete your account. |
| Emails | Your email address and your Widgimal's name and state. Reminder emails when a Widgimal needs care, and purchase and cancellation confirmations. | Reminders: legitimate interest (Art. 6(1)(f)) in keeping your Widgimal alive, which you can turn off at any time. Confirmations: contract and legal obligation. | We don't keep copies. Our email provider keeps delivery logs for a limited time. |
| Server logs | IP address, date and time, page or file requested, browser details, and errors, when you visit the site or load a widget. | To deliver the site, keep it secure and fix errors. Legitimate interest (Art. 6(1)(f)). | Kept by our host for a short time, no more than 30 days. |
| Weather widget (when available) | The city you search for and its coordinates, rounded to about 1 km. The request is sent from our server, so the weather service never sees your IP address. | To show the weather you asked for. Contract (Art. 6(1)(b)). | Not stored beyond a short cache. |
| Contacting us | What you write to us and your email address. | To answer you. Legitimate interest (Art. 6(1)(f)), or contract if it concerns your account. | Until your request is resolved, then up to 2 years unless the law requires longer. |
You don't have to give us any personal data, but without an email address we can't create an account, and without the data above the widgets can't work.
We don't make decisions about you based solely on automated processing, and we don't build profiles for advertising.
3. Widgets and their links
Each widget has a secret link that you paste into Notion. Notion then shows the widget inside your page. We never get access to your Notion account or your pages. Anyone who has the link can see the widget and use its buttons, so treat it like a password and don't put anything confidential into a widget. You can make a new link for a widget at any time, which stops the old one from working.
When a widget loads inside Notion, your browser connects to our servers. We don't set cookies in widgets. Notion's own processing is covered by Notion's privacy policy.
4. Service providers
We use these providers to run Widget Friends. They process data on our behalf and under our instructions, bound by data processing agreements, except Stripe, which is also responsible for some processing itself (for example to prevent fraud and meet financial regulations).
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the website and widgets, server logs | USA and worldwide edge network |
| Clerk, Inc. | Sign-in and account security | USA |
| Supabase, Inc. | Database for accounts, widgets and Widgimals | [SUPABASE REGION, e.g. Frankfurt, Germany (eu-central-1)] |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payments, subscriptions and invoices | Ireland and USA |
| Resend (Plus Five Five, Inc.) | Sending emails | USA |
| Open-Meteo | Weather data, without personal identifiers | Europe |
We also share data when the law requires it, for example with tax authorities or in response to a court order, and if Widget Friends is sold or merged, with the new owner, who must keep to this policy.
5. Transfers to other countries
We are based in Switzerland, and some providers process data in the USA. For transfers to the USA, we rely on the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum and the adaptations required by Swiss law). You can ask us for a copy of these safeguards at [PRIVACY EMAIL, e.g. privacy@yourdomain.com].
6. Cookies and browser storage
We only use cookies and browser storage that Widget Friends needs to work. We don't use analytics, advertising or tracking cookies, so we don't ask for cookie consent. Widgets embedded in Notion use no cookies at all.
| Name | Type | Purpose | Duration |
|---|---|---|---|
__session | Cookie (Clerk) | Proves to our server that you are signed in. Renewed every minute while you use the site. | Until you sign out or close the browser |
__client_uat | Cookie (Clerk) | Tells the site whether you are signed in. | As long as you stay signed in |
__client | Cookie (Clerk, on our sign-in subdomain) | Keeps your sign-in session, so you stay signed in. | As long as you stay signed in |
widgetfriends:draft | Local storage | Remembers a widget or egg you made before signing up. | 7 days |
tz-synced:… | Session storage | Remembers that we saved your time zone, so we do it only once. | Until you close the tab |
Cookie names can carry a short suffix. Our sign-in provider may set a few more strictly necessary cookies for security, for example to stop automated sign-up attempts. You can block or delete cookies in your browser settings, but you then can't sign in.
Do Not Track and Global Privacy Control: we don't track you across websites, so there is nothing for these signals to switch off. We honour them anyway: we never sell or share your data for advertising.
7. Your rights
Depending on where you live, you have the right to:
- get a copy of your data and information about how we use it (access)
- have wrong data corrected
- have your data deleted
- restrict how we use it
- receive your data in a common, machine-readable format, or have it sent to another provider (portability)
- object to processing based on legitimate interests, including reminder emails
- withdraw consent at any time, without affecting what we did before
Delete your account yourself: on your dashboard, choose “Delete account”. This deletes your account, widgets, Widgimals, logs and coins right away and cancels any subscription. Only the accounting records we must keep by law remain, with Stripe.
For anything else, email [PRIVACY EMAIL, e.g. privacy@yourdomain.com]. We answer within one month (GDPR), 30 days (Swiss FADP) or 45 days (California), and may ask you to confirm your identity first, usually by writing from your account's email address.
Complaints
You can complain to a data protection authority, in particular the one where you live or work. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). In the EU, it is your national data protection authority. In the UK, it is the Information Commissioner's Office (ICO, ico.org.uk). We would appreciate the chance to sort it out with you first.
8. Notice for California and other US states
In the last 12 months we have collected these categories of personal information, for the purposes in section 2:
- Identifiers: email address, account ID, IP address.
- Commercial information: plans and coin packs bought.
- Internet activity: how you use your widgets and server logs.
- Approximate location: your time zone, and a city if you use the weather widget.
- Content you create: widget settings, habit and mood logs.
We got this information from you and from your use of Widget Friends. We disclose it only to the service providers in section 4, for the business purposes described there. We do not sell or share personal information (as “sell” and “share” are defined in the CCPA), we don't use or disclose sensitive personal information to infer characteristics about you, and we have no actual knowledge of selling or sharing data of anyone under 16.
California and other US state residents have the right to know what personal information we collect, use and disclose, to access it, to have it corrected or deleted, and to not be discriminated against for using these rights. You can use them yourself or through an authorized agent, by emailing [PRIVACY EMAIL, e.g. privacy@yourdomain.com]. If an agent asks for you, we may ask for proof of their authorization and verify your identity with you directly. If we turn down a request, you can appeal by replying to our answer.
California “Shine the Light”: we don't disclose personal information to third parties for their direct marketing.
9. Children
Widget Friends is not for children. You must be at least 16 to use it. We don't knowingly collect data from anyone under 16, and in particular not from children under 13 (US COPPA). If you think a child has given us personal data, write to [PRIVACY EMAIL, e.g. privacy@yourdomain.com] and we will delete it.
10. Security
All connections to Widget Friends are encrypted (HTTPS). Only our server can read the database. Passwords are handled by our sign-in provider and never reach us, and payment details are handled by Stripe. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
11. Changes to this policy
We will update this policy when Widget Friends changes or the law requires it. The date at the top shows the latest version. If a change matters to you, we will tell you by email or on the site before it takes effect.