WEWORKBUDDY · PICK TOPIC

Privacy Policy

How WeWorkBuddy collects, uses, retains, and protects account, research, and billing data.

Last updated: October 25, 2026

1. Scope

This policy applies to the WeWorkBuddy website, Pick Topic research workspace, email verification, and subscription features.

2. Information collected

• Account: email, password hash, recovery-code hash, verification status, and creation time.
• Private research: bookmarks, tasks, assessments, opportunity reviews, evidence links, and notes.
• Billing: checkout identifiers, subscription status, period end, and payment events. Waffo/Pancake processes cards; WeWorkBuddy does not store full card numbers.
• Security and email: hashed session tokens, hashed verification codes, rate limits, server logs, errors, and necessary network information.
• Public-source data: titles, summaries, authors, links, dates, and public metrics from public APIs, RSS, Atom, and webpages.

3. Purposes

We use data for authentication, private workspaces, verification, plan limits, subscriptions, source maintenance, security, troubleshooting, support, and product improvement. Public attention metrics are not automatically treated as demand or revenue evidence.

4. Cookies

Authentication uses an essential HttpOnly, Secure, SameSite=Lax cookie. Sessions last up to 30 days. We currently install no advertising trackers.

5. Providers and sharing

Data is disclosed to infrastructure, Resend email, and Waffo/Pancake billing providers only as needed to operate the service. We do not sell personal information. Private workspaces are not published.

6. Retention

Accounts and private research remain while an account exists. Codes expire in about 10 minutes, sessions within 30 days, and rate-limit records at the end of their windows. Billing, audit, and backups may remain longer for security, disputes, and legal duties. Deletion removes active account and workspace data; residual rotating backups may remain for a limited period.

7. Your rights

You may export data, sign out, cancel a subscription, and delete the account after its subscription ends. You may request access, correction, or deletion; identity verification may be required and rights vary by law.

8. Security and international processing

We use password hashing, token digests, HTTPS, access controls, and restricted server permissions. No system is absolutely secure. Providers may process data in other regions subject to applicable safeguards.

9. Children and changes

The service is not directed to children under 13. Material policy changes will update this page and be communicated reasonably.

Contact