Privacy Policy

1. Who we are

SeeWider ("we", "us") operates this marketing website and the linked SeeWider product. We act as the data controller for personal data collected through both surfaces, unless we tell you otherwise.

2. Data we collect

We collect personal data in three contexts:

Contact form: when you submit the contact form on this site we collect the email address and message body you provide, together with the IP address of the request (used only to rate-limit abuse).

Analytics: if you grant analytics consent in the cookie banner, we collect standard web-analytics events through Google Tag Manager and Google Analytics — pages viewed, approximate location, device, browser, and a pseudonymous identifier. If you do not consent, these events are not collected.

Mobile app usage: when you use the SeeWider app, it records named actions — such as opening a board, adding a person or a photo, sending an invite, or seeing the upgrade screen — together with the time, your account identifier and the app's language. It never sends the names, dates, notes or photos on your boards, does not record your screen, and does not determine your location. We use this, on the basis of our legitimate interest in improving the app (Art. 6(1)(f)), to understand which parts of the app help people and where they get stuck.

Account on the linked product: when you sign up for a SeeWider account on the linked product, we collect your email address, a hashed password, and the graphs, posts, and other content you choose to create.

3. Legal basis

We process your personal data on the following legal bases (GDPR Article 6):

Consent (Art. 6(1)(a)) — for analytics cookies, and for any marketing email if you opt in to one in the future.

Performance of a contract (Art. 6(1)(b)) — for operating the SeeWider account you sign up for, including storing the content you create.

Legitimate interests (Art. 6(1)(f)) — for handling messages you send through the contact form, for security and abuse-prevention measures (rate-limiting, logging), and for keeping aggregate technical records needed to run the service.

4. How long we keep your data

Contact-form messages: kept for up to 24 months from the date of the message, then deleted, unless the message is part of an ongoing matter that requires longer retention.

Analytics: subject to the retention configured in Google Analytics (currently 14 months) and to your consent — withdrawing consent stops further collection but does not delete events already collected through your previous consent.

Account data: kept for as long as your account exists. When you delete your account, we delete the account and the content associated with it within 30 days, except for backups that are rotated out within a further 90 days, and for any record we are legally required to keep.

Administrative access records: when a member of our team acts on an account or a board through the admin tools — changing a plan, deleting an account or a board — we record who did it, what they did, which account or board it concerned, and when. We keep those records for 6 months, then delete them. They exist so that a question about what happened to your data has an answer.

5. Service providers (processors)

We share personal data with the service providers below, which process it on our behalf under written terms that limit them to that role. Each entry says what the provider does for us and what personal data reaches it.

Hetzner

Runs the servers and the database behind the linked product.

Receives: Everything held in your account: your email address, your boards, and the people and photographs on them.

Cloudflare R2

Stores the image files used by the product and this website.

Receives: Every photograph uploaded to a board, including photographs of people who are not users of the product, and the images published on the blog.

OpenAI

Powers the board assistant.

Receives: The message you type to the assistant, together with the names and details of the people on the board it is working on. Nothing is sent unless you use the assistant. If you speak to the assistant instead of typing, the recording is sent to be transcribed and is not kept.

TypeSafe AI

Guesses what a new entry is, and what sex a name is.

Receives: The name you are typing as you add someone, and — when you import from Instagram — that profile's public bio. Nothing else about the board is sent, and the answer only fills in fields you have not touched.

Google Gemini

Guesses a person's sex from their profile picture when a social-media import arrives without one.

Receives: The profile picture of the person being imported — usually someone other than you — and nothing else: no name, no board, nothing about your account. It is only sent when an import brings a picture and the sex is still blank.

Bright Data

Fetches a public social-media profile when you import one into a board.

Receives: The profile address you are importing — which is usually about someone other than you — and nothing about your account.

Sentry

Records errors so we can find and fix them.

Receives: The technical details of the failure, tagged with your account identifier and the request identifier. A log line carried into the error may contain other data present at the moment it failed.

Expo

Delivers push notifications to the mobile app.

Receives: Your device’s push token and the text of the notification, which can include the name of a board or of a person on it.

RevenueCat and Google Play

Handles subscriptions and purchases in the mobile app.

Receives: Your purchase and subscription state, tied to your account identifier, and the store transaction.

PostHog

Measures how the mobile app is used, so we can see what helps people and where they get stuck. Hosted in the EU.

Receives: Named in-app actions (such as adding a person or sending an invite), when they happened, your account identifier and the app's language. Never the content of your boards, no screen recordings and no location.

Google (Sign-In)

Verifies your identity when you choose "Sign in with Google".

Receives: The sign-in token issued by Google, from which we read your email address, name and profile picture. Only when you use that button.

Resend

Delivers the email we send you — account verification, password resets, and replies to the contact form.

Receives: Your email address and the contents of the message we send.

Google Tag Manager and Google Analytics

Measures how this website is used, only after you have granted consent.

Receives: Analytics events, approximate location derived from your IP address, and a pseudonymous identifier.

Google reCAPTCHA

Protects the contact form from automated abuse. Loaded only on the contact page.

Receives: The form-submission token, your IP address, basic browser details, and a small interaction signal used to score how likely the submission is to be spam.

We do not sell your personal data, and we do not share it with advertisers or data brokers.

6. International transfers

Some of our processors (notably Google) are based outside Türkiye and the European Economic Area. When data is transferred to such a country, we rely on the recipient's certifications and on Standard Contractual Clauses or equivalent safeguards approved under the applicable data-protection law.

7. Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; delete your data ("right to be forgotten"); restrict or object to certain processing; receive your data in a portable format; withdraw consent at any time (for the processing that relies on consent); and lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us using the address in section 13. For account holders, basic export and deletion can also be requested by writing from the email address associated with the account. We respond within 30 days.

8. Cookies

We use a small number of cookies, listed and described in our Cookie Policy. You can grant, refuse, or change your cookie choices at any time using the cookie banner.

9. Security

We use industry-standard measures to protect personal data, including encrypted transport (HTTPS), restricted access to production systems, and audit logging. No system is perfectly secure, but we work to keep risks low and to respond quickly if we learn of an incident.

10. Children

SeeWider is not directed at children under 16. We do not knowingly collect personal data from anyone under that age. If you believe a child has provided us with personal data, contact us and we will delete it.

11. People on a board who are not users

Most of the people recorded on a board never signed up for one. Someone in their family typed in their name, their dates, how they are related, and often a photograph. This section is about them rather than about you.

Some entries also carry a phone number or a web link, when the person who made the board chose to add one. They are kept with the rest of the entry and treated the same way.

The record is private. A board is visible to the account that owns it and to the people that account invites or hands a share link to, and to nobody else. Boards are not published, not listed, and not indexed by search engines. We do not read what is on them to build profiles, to advertise, or to sell anything to anyone.

We hold this information on the basis of legitimate interests: keeping a record of your own family and the people in your life is an ordinary thing to want, and a private record of it does not override the interests of the people in it. Where someone recorded on a board has died, data-protection law in most countries no longer applies to them at all.

We do not write to each person on a board to tell them they are there. Usually there is no way to reach them from what has been written down — a name and a birth year is not an address — and finding one would mean collecting more about them than the entry itself holds. The law allows this where telling each person would be impossible or a disproportionate effort, and this is that case.

If you are on someone's board and would rather not be, write to [email protected] with the name as it is likely recorded and anything else that helps us find the right entry. We will find it, delete it along with any photographs, and tell you when it is done. We answer within 30 days. You do not need an account, you do not have to tell us who added you, and we will not pass your message on to them unless you ask us to.

One feature deserves naming on its own. A user can import a public social-media profile into a board, and when they do we fetch that public page through the provider named in section 5 and copy what it shows — the name, the picture and the public biography — into their private board. Nothing is posted, nobody is followed, no message is sent, and we keep no copy anywhere else.

12. Browser extension

SeeWider offers an optional browser extension, the SeeWider Importer, which imports an Instagram profile shown on the page you are viewing into a SeeWider graph you own. Installing and using it is entirely optional.

Stored locally in your browser: the extension keeps your SeeWider personal access token, your chosen default graph, and a local snapshot of your graphs, labels, and nodes in your browser's extension storage (chrome.storage.local). We do not receive or store these on our servers — they stay on your device until you remove the extension or clear its data.

Sent to our API: when you click Import, the extension sends your access token (to authenticate the request) and the imported person's name, profile photo, bio, and Instagram username to api.seewider.com over HTTPS, so we can create the node you asked for in your graph. That node is then part of your account data and is governed by the retention and rights sections above.

The extension contacts no host other than api.seewider.com. It contains no analytics or tracking, and we do not sell or share the data it handles. You can revoke its access at any time by deleting the personal access token in your SeeWider account.

13. Contact and complaints

For privacy questions or to exercise any of the rights in section 7, contact us through the contact form on this site or by writing to [email protected].

If you live in the European Economic Area or the United Kingdom, you also have the right to complain to your national data-protection authority. If you live in Türkiye, the competent authority is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK).