Privacy policy

1. Who we are

Warrly is provided by an individual based in Vietnam — Lê Thành Trung — and is not a company. In this policy, “Warrly” and “we” mean that individual.

This is also the personal-data contact point under Decree 13/2023/ND-CP and the Law on Personal Data Protection (Law 91/2025/QH15, in force from 1 January 2026). Warrly has no staff, so there is no separate DPO: the same person is the contact.

Warrly is run from Vietnam and serves users in many countries. Vietnamese law applies to all of its processing, wherever the user is; a user’s own local law still applies on top of that.

Warrly’s role: controller of account data (email, devices, warranties, receipts, wishlist), and processor of the operational data that third-party infrastructure produces while the service runs. For advertising data, Google is an independent controller — see section 5.

Privacy contact: [email protected]. General support: [email protected].

2. What we store

Your email and password (stored as a bcrypt hash — the original password is never kept); the records you enter yourself (devices, warranty plans, subscriptions, wishlist); the attachments you upload (invoice / warranty-slip images); and the device push token, if you turn push on.

Your advertising consent state lives only on your device — localStorage key wv_consent on the web, and held by Google’s SDK in the app. Warrly does not store that state on its own server.

Beyond those items, Warrly keeps no other profile about you: there is no advertising account tied to you, and no behavioural profile used to build an advertising persona.

3. Encryption & storage

Attachments are encrypted with AES-256-GCM on the server, one key per file (each of those keys is wrapped by the system master key). Your session lives in an encrypted cookie (wv_session). All data lives on a database we run ourselves.

That server may sit outside Vietnam — see section 11.

4. AI assistant (opt-in)

This feature is OFF. by default. Only after you enable it in Settings does the AI assistant do two things: read a receipt image or PDF you pick ( decrypted and sent to a third-party AI provider (Anthropic) to fill in the device details), and assess whether a repair is likely covered (sending the claim content, the device details and the warranty contract terms to that same provider). The result is always guidance for you to check — it is not a warranty decision, and nothing is saved automatically. With the feature off, an image never leaves the server decrypted and no content is sent. You can turn it back off at any time.

5. Advertising (Google AdMob)

The free tier carries ads. The paid tier has no ads and is not on sale yet.

When Warrly has ads, they run in the iOS and Android apps and are served by Google AdMob, a Google advertising network. As of this update the app has no advertising SDK integrated and shows no ads; this section describes the model, not a running state. The web has no ads.

• Provider: Google AdMob — Google LLC (United States) and Google Ireland Ltd (Ireland). For advertising data, Google is an independent controller: it decides how that data is used under its own policies, not under Warrly’s instructions.
• Data AdMob receives: your device’s advertising identifier (IDFA on iOS, GAID on Android); minimal device information (model, OS version, coarse region inferred from your IP address); and impression and click events. That data is shared with Google to serve and measure ads.
• Cookies and advertising identifiers: IDFA, GAID, and Google’s advertising cookies or identifiers (for example NID, IDE — depending on which Google product fills the slot). Purpose: selecting ads, frequency capping and measuring performance. Duration: per Google’s policy; Warrly does not set that number and does not control it.
• Advertising data retention: per Google’s Ads/AdMob policy. Warrly stores no advertising data: no table on our servers records which ads you saw or clicked. The only thing Warrly keeps is your consent state, and it stays on your device.

Ads are non-personalised by default. Warrly only serves personalised ads after you agree: on iOS through Apple’s App Tracking Transparency (ATT) prompt, and for users in the EU, the United Kingdom or Switzerland through the Google UMP consent form (a consent-management platform certified under TCF v2.2). If you decline, you still see ads, but non-personalised ones.

Turning ad personalisation off or changing your choice:

• iOS: Settings → Privacy & Security → Tracking, and switch Warrly on or off.
• Android: Settings → Google → Ads, delete or reset your Advertising ID, or opt out of personalised ads.
• EU, United Kingdom, Switzerland: reopen your choice at any time through the “Privacy options” button in the app (Google UMP).
• Web: advertising is off by default — Warrly loads no ad script and sets no advertising cookie before you agree. Change your choice at any time through “Cookie settings” in the footer.

Declining personalised ads does not stop you using the app or the web. How Google uses data for advertising, and how to manage your choices: policies.google.com/technologies/ads.

Warrly does not embed Google Analytics or the Facebook SDK, and does not track you across other sites itself.

6. Your rights

You can export all of your data to a JSON file or a .zip with the encrypted images (Settings → Backup & restore) at any time, and delete your account to permanently erase every device, invoice, image and setting. Deleting cannot be undone.

Under Decree 13/2023/ND-CP and Law 91/2025/QH15 you have the right to: be informed about processing, access, correct and delete your data; withdraw consent; restrict processing; object to processing; claim compensation for damage; and complain to the competent authority — the Department of Cybersecurity, Ministry of Public Security (A05).

If you are in the EEA or the United Kingdom, you have the right to access, correct, erase, restrict or object to processing, port your data, withdraw consent and complain to a data protection authority. To exercise these rights, email [email protected].

To exercise any of these rights, email [email protected]. Warrly may ask for a few details to verify that it is you before deleting or changing data, and will not discriminate against you for exercising your rights.

7. Third parties & data sharing

Warrly shares data only with the parties below, and only the part each of them needs:

• Anthropic — only when you enable the AI assistant (see section 4).
• Resend — sends the password-reset email when you ask for one.
• Apple (APNs), Google (FCM), your browser (Web Push) — carry warranty reminders to your devices, only when you turn push on.
• Google AdMob (Google LLC, Google Ireland Ltd) — advertising in the app, on the free tier only (see section 5). Ad data is shared with Google to serve and measure ads; for that data Google is an independent controller.

Beyond those services, we share your data with nobody.

Warrly does not sell personal data, and there is no advertiser other than Google.

8. Legal basis & consent

We process data on these bases:

• Sign-in session and remembering your language and appearance: performance of the contract and our legitimate interest in keeping your choices.
• Providing the service (account, devices, warranties, receipts, backup): performance of our contract with you.
• Push notifications and the AI assistant: your consent, which you can withdraw at any time in Settings.
• Advertising on the free tier: your consent — ATT on iOS, the Google UMP consent form for users in the EU/UK/Switzerland. If you decline, ads still appear, but non-personalised.
• Security, abuse prevention and rate limiting: our legitimate interest in keeping the service safe.
• Transactional email (password reset, email-change confirmation): performance of the contract and account security.

Consent at Warrly is voluntary, purpose-specific, never bundled and never pre-ticked: each switch is its own decision. You can withdraw at any time — turn tracking off in system Settings (iOS), reopen the UMP form in the app, change “Cookie settings” on the web, or switch push and the AI assistant off in Settings.

9. California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and share, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information.

Warrly does not sell personal information. Ads are non-personalised by default; personalised ads run only after you agree, and you can refuse or withdraw at any time.

To exercise these rights, email [email protected]. You may use an authorised agent. We will verify the request and will not discriminate against you for exercising your rights.

10. How long we keep it

Account data (email, devices, warranties, receipts, wishlist) is kept until you delete your account. Deleting the account removes it from the system; there is no restore button in the app.

Advertising data is kept by Google under Google’s Ads/AdMob policy. Warrly holds no copy, so there is no separate Warrly retention period to state.

Your consent state on the web is remembered for up to 12 months — matching the cookie policy — after which Warrly asks again. Clearing localStorage removes that record and the banner comes back.

11. International data transfers

Warrly runs from Vietnam, but the data does not stay only in Vietnam. Account data sits on a server Warrly runs itself; the rest passes through the parties below, and that is a transfer of data abroad:

• Google — advertising (AdMob) and push on Android (FCM): Google LLC in the United States, and Google Ireland Ltd in Ireland for users in the EU.
• Apple — push on iOS through APNs: Apple Inc. in the United States.
• Resend — transactional email (password reset, email-change confirmation): the United States.
• Anthropic — only when you enable the AI assistant: the United States.

Decree 13/2023/ND-CP and Law 91/2025/QH15 require transfers of personal data abroad to be stated plainly; this section is that statement. Data goes only to the parties in section 7, for the purposes in section 8.

Each party above has its own privacy policy and is bound by the data-protection law that applies to it. Google’s advertising policy: policies.google.com/technologies/ads.

12. Children

Warrly is not directed at children and does not knowingly collect data from anyone under 16. If you believe Warrly has collected a child’s data by mistake, email [email protected] and we will delete it.

If an account turns out to belong to someone under 16, Warrly will delete that account and the data inside it.

13. International users

Warrly is written for users anywhere, not only in Vietnam. Users in the EU, the United Kingdom and Switzerland enjoy the rights their data-protection law grants — see section 6 — and for personalised ads Warrly uses Google UMP, a consent-management platform certified under TCF v2.2.

Warrly has no representative in the EU or the United Kingdom: this is one individual’s app, run from Vietnam, and the contact for every request — including from the EU/UK — is [email protected].

14. Changes

Warrly may update this policy. The new version always carries a new “Last updated” date at the top; read it again after each change. If a change widens what is collected, Warrly will ask for consent again instead of treating silence as agreement.

The Vietnamese and English versions are updated together. If they diverge, the Vietnamese version is the legally binding one.

15. Contact

Questions about your data: [email protected]

General support: [email protected]

Data controller: Lê Thành Trung, an individual based in Vietnam.

Data protection contact: there is no separate DPO; the owner answers every request at [email protected].