Privacy, in plain language.

Summary

W1 sends your request and the bounded project context needed for the current model call to the hosted W1 service. Full local run traces stay on your computer by default. Remote product analytics are structural: counts, timing, cost, tool categories, outcomes, versions, and pseudonymous identifiers - not raw prompts, file contents, paths, shell commands, or model responses.

What W1 processes

• Account information: your WorkOS account identifier, email address, and authentication session.
• Billing information if you subscribe: your plan, the Payfast subscription token and payment references, amounts and dates, and the receipts we sent you. Never your card number.
• Inference context: your message and the portions of project files, documents, prior conversation, tool results, and task state selected for a model request.
• Usage records: provider, model, input/output/cached token counts, latency, reasoning tier, exact provider cost when available, and the W1 thread/run/attempt identifiers needed for idempotent accounting.
• Structural product analytics: app version, platform, run status, tool names and counts, file extensions, command categories, cache facts, checkpoints, errors represented by safe codes, and pseudonymous installation, session, user, thread, turn, run, and attempt identifiers.
• Support information: messages and files you deliberately send to support.

What stays local by default

Your full run transcript and detailed trace stay on your own machine, in W1’s state folder under your home directory — not in the project folder. Run traces are written to ~/.w1/userdata/workspaces/<project>-<id>/runs/, where <project> is your project folder’s name and <id> is a short hash of its full path. Your conversation history itself is kept separately again, under ~/.w1/engine/. Versions of W1 before local state was isolated wrote traces into a .w1/ folder inside the project itself; if you have used W1 for a while, that folder may still exist and is now only ever read, never added to.

W1 does not send raw prompts, model output, file contents, full file paths, shell command strings, tool observations, bearer tokens, provider keys, or user documents to PostHog.

W1 does not scan your whole computer. Project tools operate against the folder you open and the access mode you select. Some commands chosen for your task may invoke software already installed on your machine; their effects are visible in the run.

How we use data

• Provide authentication and the hosted inference service.
• Perform the project work you request and preserve thread continuity.
• Meter usage, enforce beta limits, detect duplicate billing attempts, and show your usage.
• Diagnose crashes, transport failures, cache regressions, and product reliability using structural events.
• Respond to support, security, deletion, and access requests.
• Prevent abuse and protect the service and other users.

W1 does not sell your project content or use it for targeted advertising.

Service providers

W1 uses specialized providers to operate the service:

• Cloudflare for the public website, API, storage, and edge infrastructure.
• WorkOS for account authentication.
• Payfast to take card payments for paid plans. Your card number never reaches W1: Payfast holds it, and we receive a subscription token, the amount, and a payment reference. Resend delivers receipts and account mail.
• OpenRouter and the selected model provider to process model requests.
• PostHog for privacy-sanitized product analytics.
• Resend for account, beta, support, and product email where applicable.
• Microsoft and Apple for application distribution and updates on their platforms.

These providers process data under their own terms and privacy commitments. W1 sends each provider only the information needed for its role.

Retention

• Local traces remain until you delete them or remove the project.
• Authentication sessions expire and may be revoked when you sign out.
• Usage records are retained long enough to operate the beta, reconcile cost, prevent duplicate charging, and meet legal/accounting requirements.
• A detailed trace is uploaded only when you deliberately share it for support or enable an explicit internal diagnostic mode. Support traces are scheduled for deletion after 30 days unless a security or legal need requires longer retention.
• Account contact information remains until the account relationship ends or you request deletion, subject to legal requirements.

Your controls

• Choose which project folder W1 can access.
• Select the access mode and review important changes before shipping them.
• Turn off optional telemetry in the application settings where available.
• Delete local run traces in the desktop app: Settings → Privacy & data → Clear now, which removes stored run traces and per-thread logs immediately. Deleting the runs/ folder named above by hand does the same thing, but note that it does not remove your conversation history, which lives under ~/.w1/engine/.
• Delete everything W1 has stored locally, conversation history included, with Settings → Remove W1 data, or by removing the ~/.w1 folder. If an older version of W1 left a .w1/ folder inside a project, remove that too.
• Sign out to revoke the local session.
• Request access, correction, export, or deletion by emailing support.

Some data is required to provide inference, authentication, security, and usage accounting. If you do not want that processing, do not submit the request or use the hosted service.

Contact and changes

Email support@w1lab.com for privacy questions or data requests. W1 operates from South Africa and serves beta users in multiple countries. We may update this policy as the beta changes; the effective date above will change when the policy does.