Skip to content
WLOC

Effective and last updated August 24, 2026

Privacy Policy

This notice explains how WLOC handles data in the WLOC app, on wloc.app, in the WLOC Portal at portal.wloc.app, and when you contact us.

1. Controller and scope

TXYOU, LLC, doing business as WLOC, located in the United States, is the controller for WLOC-controlled processing described in this notice. Contact us at support@wloc.app.

This notice covers the WLOC iOS app, the public website and Worker at wloc.app, the account-based Portal at portal.wloc.app, and related support. A third-party app, website, payment service, map provider, or setup tool has its own privacy practices.

2. Privacy summary

WLOC does not sell personal information, does not include advertising SDKs in the iOS app, and does not use WLOC data for cross-context behavioral advertising. Browser analytics is optional: the Google tag is not loaded on WLOC's production hosts until you choose Allow analytics. Operational product records, including precise coordinates needed for an authorized location test, remain separate from browser analytics.

3. Data we process

  • Data stored by the iOS app: Favorites, coordinate profiles, setup preferences, device configuration, diagnostic cache, onboarding state, and settings are stored on your device by default unless you choose to copy, export, or send information to support.
  • Account and Portal data: Email address for OTP sign-in; session information; workspace, organization, use-case, device, ownership, Profile metadata, policy-acceptance, entitlement, notification preference, and security-event records; and the settings and status needed to operate your account.
  • Authorized location-test data: Target coordinates, favorites, tags, diagnostics, location-session and Restore state, recent actions, and Activity records needed to run, secure, and explain a test. Precise coordinates may exist in these operational records, but they are excluded from Google Analytics.
  • Profile and credential transit: Profile bytes and an EAP password may transit WLOC-controlled Worker and Gateway memory to provide an explicit one-time, no-store download. WLOC does not intentionally retain Profile XML, EAP passwords, Gateway or Access secrets, CA private keys, session or OTP peppers, or raw VPN traffic in its control-plane databases, queues, browser analytics, structured application logs, or test fixtures.
  • Public Worker requests: When you ask the public wloc.app service to parse a map link, convert coordinates, or generate setup material, the request may contain the map link or coordinate input, coordinate values, accuracy, requested setup type, locale, and related service parameters.
  • First-party product events: The app or service may record coarse events about app launches, setup progress, diagnostics, apply and Restore outcomes, entitlement, reliability, and security. These may include random event, installation, or session identifiers, app/build and OS version, device class, locale, and fixed event properties. They do not intentionally include raw map links, exact coordinates, email addresses, receipts, credentials, or payment-card data.
  • Billing data: Apple or Stripe handles payment credentials. WLOC may receive and retain the product, transaction, subscription, invoice, refund, entitlement, environment, and notification identifiers needed for fulfillment, reconciliation, fraud prevention, support, tax, and audit.
  • Service and security data: WLOC and its infrastructure providers may process request paths, IP addresses, user agents, timestamps, rate-limit signals, errors, and security events to deliver and protect the service.
  • Support data: If you contact us, we process your email address and the message, screenshots, diagnostics, or other information you choose to provide.

4. Optional browser analytics

With your permission, WLOC uses Google Analytics 4 property G-5R5308RGVJ on wloc.app and portal.wloc.app. WLOC uses a basic-consent implementation: before you allow analytics, WLOC does not load the Google tag or send browser analytics requests to Google.

After consent, Google Analytics may receive a pseudonymous browser or client identifier stored in _ga cookies; a normalized route without query strings or hashes; a coarse page class and surface; supported content language; the origin of an external referrer; and allowlisted events for a marketing call-to-action, email-OTP sign-in, onboarding checkpoint, diagnostic start or completion, paywall view, checkout start, server-confirmed Pro entitlement, a synced location target, or your confirmation that a location test worked. The network request also provides Google with ordinary connection and browser metadata such as IP address, user agent, browser/device characteristics, and timestamps; Google may use this information to operate Analytics and derive information such as approximate geography.

WLOC does not put precise coordinates, location-search terms, account email addresses, WLOC account, workspace, or device identifiers, Profile data, credentials, checkout-session references, arbitrary page titles, raw URL query values, or raw VPN traffic into Google Analytics. Dynamic Portal device routes are reduced to a fixed template. Google advertising storage, Google Signals, ad-user-data collection, and ad-personalization signals are disabled for this implementation.

Google processes Analytics data under its own terms and privacy documentation. You can learn more in Google's business data privacy information and Google's Privacy Policy.

5. Analytics cookies and your choice

Your first-party analytics choice is stored in the wloc_analytics_consent cookie for up to 180 days and is shared across wloc.app and portal.wloc.app. If you allow analytics, WLOC configures Google Analytics cookies with a 180-day expiration; continued use may refresh a Google Analytics cookie's expiry.

You can decline without losing access to WLOC. You can later change your choice through Analytics choices in the website footer or the Google Analytics control in Portal Data & privacy settings. Turning analytics off updates your choice, removes Google Analytics cookies that WLOC can access on its domain, and reloads the page without the Google tag. It does not delete data Google or WLOC already received; you may contact us about applicable rights.

6. Why we use data

We process data to provide requested app, account, parsing, setup, diagnostic, location-test, Restore, billing, export, and support functions; authenticate users and maintain entitlements; secure the service and prevent abuse; troubleshoot and improve reliability; comply with legal, tax, accounting, and dispute obligations; and, only with consent, understand coarse website and Portal conversion paths.

Where a law requires a legal basis, we rely as applicable on performance of a contract or steps you request before a contract, our legitimate interests in operating and securing WLOC, compliance with legal obligations, and your consent for optional Google Analytics. You can withdraw analytics consent at any time without affecting the lawfulness of earlier processing.

7. When data is shared

We disclose data only as needed to service providers and recipients supporting the relevant function, including Cloudflare for hosting, networking, and security; Google for consented browser analytics; Apple or Stripe for downloads, billing, refunds, and entitlements; configured email, map, tile, or geocoding providers; professional advisers; and authorities or other parties when required by law or necessary to protect rights, safety, and service integrity. We may also disclose data in a corporate transaction subject to appropriate confidentiality and legal safeguards. We do not sell personal information.

8. Retention and deletion

  • On-device data remains until you delete or reset it or uninstall the app, subject to protected entitlement and consumed-use state.
  • Google Analytics event and user-level data is configured for two months. Reset user data on new activity is on, so new activity associated with the same pseudonymous identifier can restart that retention period. Standard aggregated reports may remain available longer than event and user-level data.
  • Account and operational data is retained while needed to provide the account and service, complete a requested deletion process, protect security, resolve disputes, meet billing, tax, audit, or legal obligations, and maintain appropriately de-identified records.
  • Support communications are retained while needed to handle the issue and for related security, dispute, and legal requirements. Infrastructure providers apply their own operational retention schedules.

Activity visible in a plan's interface is not proof of storage deletion. WLOC does not currently promise that every first-party product-analytics or operational record is automatically purged after a fixed period. In particular, a general 90-day Activity or location cleanup and a 365-day security-identifier reduction have not been qualified as implemented storage-deletion guarantees.

9. International processing

WLOC is operated from the United States, and service providers may process data in the United States and other countries where they operate. Those countries may have different data-protection laws. Where applicable law requires a transfer mechanism, we use the provider's applicable contractual safeguards or another lawful mechanism.

10. Your rights and choices

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or portability; withdraw consent; or appeal or complain to a data-protection authority. Portal export and Delete Account tools are available when applicable, including in supported restricted states. We may need to verify your identity and may retain information where law permits or requires it. To exercise a privacy right, email support@wloc.app and state your request and country or state. Do not email credentials, private keys, Profile XML, EAP passwords, or raw traffic.

11. Children and security

WLOC is intended for development, QA, configuration, and authorized device testing and is not directed to children. If you believe a child provided personal information to WLOC, contact us.

We use technical and organizational measures intended to limit collection, separate tenants, protect credentials, authenticate access, and monitor abuse. No storage or transmission method is completely secure.

12. Changes and contact

We may update this notice when WLOC's processing changes. We will change the date above and provide additional notice where required. The current English notice is at https://wloc.app/privacy; the Simplified Chinese notice is at https://wloc.app/zh/privacy.

TXYOU, LLC, doing business as WLOC
United States
support@wloc.app