Privacy Policy

Effective Date: April 29, 2026

01. Overview

Wolleato ("the App"), operated by Montages Media Labs ("we," "us," or "our"), is designed with a "Privacy First" philosophy. We believe that your digital identity should remain under your control. Our architecture is based on zero-knowledge principles, ensuring that your data remains local and encrypted.

02. App Privacy

2.1 Information the App Collects

In accordance with the Google Play Data Safety policy, we disclose the following data collection practices. Most data collection is optional and depends on your use of specific app features.

Personal Information

  • Name & Email: Collected if you use Google Authentication for licensing or profile display. Used for App Functionality and Account Management.
  • Phone Number: Collected only if you choose to include it in a Lead Generation form.
  • User & Device IDs: We use an anonymous 16-character Device ID to track referral milestones and a hashed email (User ID) for licensing.

App Content & Media

  • Contacts (Leads): Leads you collect are stored locally. If synced to the cloud, they are encrypted and purged from our servers within 24 hours.
  • Photos: The app fetches your Google Profile photo (if authenticated) and stores custom icons for your cards locally.
  • App Activity: We store the content of your cards (URLs, text, links) to facilitate sharing via NFC and QR.

2.2 Google User Data (OAuth Scopes)

When you connect your Google account for cloud sync or licensing, Wolleato requests the following limited permissions (OAuth scopes). Each scope and its use is explained below:

userinfo.email + openid

Used to verify your identity and display your email in the app's "Account Identity" section. Also used to provision Pro license grants and beta tester status. Your email is never shared with third parties and is encrypted (RSA-2048) at rest on our servers.

userinfo.profile

Used to fetch your name and Google profile photo so they can be displayed in your app's "Account Identity" area. This data is cached locally on your device and is not stored on our servers.

drive.appdata

Used to back up and restore your card designs to a private, invisible AppData folder in your Google Drive. Wolleato cannot see or access any other files in your Drive. This folder is only accessible by the app and cannot be viewed by other users or applications.

drive.file

Used to create a single spreadsheet ("collected_leads") in your Google Drive when you choose to export leads. The app can only access files it creates itself — it cannot list, read, or modify any other files in your Drive.

spreadsheets

Used to write your collected lead data into the Google Sheet you created via the drive.file scope. This only applies to the specific spreadsheet created by Wolleato.

Data Handling & Revocation

  • Wolleato does NOT sell Google user data to third parties.
  • Wolleato does NOT use Google user data for advertising or marketing purposes.
  • Wolleato does NOT transfer Google user data to any third-party analytics or advertising platforms.
  • You can revoke Wolleato's access to your Google account at any time via your Google Account Permissions page.
  • You can delete all synced data by using the "Delete Account & Data" option within the app, or by visiting our Data Deletion Portal.

2.3 Data Security

We implement a variety of security measures to maintain the safety of your personal information:

  • Asymmetric Encryption: We use RSA-2048 encryption for account data and lead transit.
  • Data Sovereignty: Your collected leads never touch our central servers; they reside either on your device or your personal Google account.
  • Identity Anonymization: We identify your referral progress via an anonymous 16-character Device ID.

03. Website Privacy

When you visit wolleato.mml25.com, the following data practices apply:

3.1 Infrastructure & Jurisdiction

To ensure the highest standards of data protection and compliance with GDPR and UK GDPR, Wolleato utilizes European-based infrastructure. Our website and PostgreSQL databases are hosted on Scaleway servers located within the European Union.

This ensures that any data we process—even in its encrypted form—remains within jurisdictions that provide the strongest legal protections for individual privacy.

3.2 Marketing & Analytics

To monitor the performance of our website and the effectiveness of our advertising campaigns, we utilize the following third-party tracking tools:

  • Google Analytics: We use this to understand how users interact with our site, allowing us to optimize the user journey and performance.
  • Meta Pixel: We use the Meta Pixel to track conversions from social media ads and to optimize our advertising reach within the Meta ecosystem.

04. Data Retention & Deletion

We do not retain your data indefinitely. Our systems are designed for minimal persistence:

  • 24-Hour Cloud Purge: Any lead data transmitted through our cloud relay for syncing is RSA-encrypted and automatically deleted from our servers within 24 hours of receipt.
  • User-Initiated Purge: You can request the permanent removal of your account, license history, and referral data at any time via our Data Deletion Portal.
  • Local Wipe: The "Factory Reset" feature within the app settings allows you to instantly wipe all local data, cards, and leads from your device.

05. Beta Program Data

If you voluntarily sign up for the Wolleato Closed Beta Program, we collect and process your email address under the following terms:

  • Collection & Purpose: We collect your Gmail address solely for the purpose of communicating beta updates and provisioning perks, such as the Free Year subscription and early Affiliate Program access.
  • Encryption at Rest: To maintain our strict security standards, your email address is encrypted using RSA-2048 before it is stored in our database. It is never stored in plaintext.
  • Right to Erasure: You may request the deletion of your beta tester status and email from our servers at any time via the Data Deletion Portal.

06. Contact Us

If you have any questions regarding this Privacy Policy, you may contact us using the information below:

Montages Media Labs
[email protected]