Privacy Policy

1. Our promise

We never see card numbers. Buyers enter them only on the payment processor's own page.
We never hold anyone's money. Buyers pay into the developer's own payment account.
We never sell personal data, and we never share it for advertising.
We never store a watch's ID. We keep only a keyed one-way hash of it. That hash still counts as personal data, so we protect it as personal data.
Exports are encrypted on the watch, and we never have the key.

The rest of this policy explains what we collect, why, how we protect it, how long we keep it, and your rights.

2. Who we are, and the roles we play

WearCheckout ("we", "us") provides a hosted service that lets developers sell paid features in their Garmin watch apps, watch faces and data fields through their own Stripe or PayPal account. You can reach us about privacy at contact@wearcheckout.com.

Privacy law calls the party that decides why and how personal data is used the controller. It calls the party that handles personal data on the controller's behalf the processor. We play both roles:

We are the controller for developer accounts, our own billing, the security of the service, our website, and messages people send us.
We are a processor for buyers' data. Each developer is the seller, and the controller of their buyers' data. We handle that data only on the developer's instructions, under the data processing terms in our Terms of Service.
Payment processors are independent controllers. Stripe and PayPal collect and handle payment data, such as card details, under their own privacy policies. Each developer contracts with their processor directly. The processors are not our sub-processors. Stripe also handles the payments developers make to us for our plans.

Watches reach us over their own Wi-Fi connection, or through the Garmin Connect app on the phone. Garmin's own privacy policy covers Garmin's part in that.

3. Who this policy covers

Developers who have a WearCheckout account, and their team members.
Buyers: people who use a developer's app on their watch, or buy from it. The developer's own privacy notice is the main notice for you. This policy explains what we do on the developer's behalf.
Visitors to our website, and anyone who contacts us.

4. What we collect, and why

Developers (we are the controller)

Data	Why	How we protect it	How long we keep it
Email, name, country, whether you are a business, business details and VAT number	Run your account; send notices and statements; work out tax on our fees; check developers against sanctions lists at sign-up and monthly	Encrypted at rest by our host	While your account exists; tax records as long as tax law requires
Two pieces of location evidence for tax: your billing country, and the country your IP address is in (not the address itself)	Tax law on our fees	Encrypted at rest by our host	As long as tax law requires
Passkey and security-key public keys, the names you give them, and their use counters	Sign-in and 2-step sign-in	A public key can't sign anyone in without your device. The private key never leaves your device.	Until you remove the key or delete your account
Authenticator app secrets (the setup key behind your 6-digit codes), the names you give them, and the last code used	2-step sign-in, and refusing a code that was already used	Stored encrypted; never shown again after setup	Until you remove the app or delete your account
Recovery codes	Get back into your account if you lose your authenticator app or security keys	Stored only as one-way hashes	Until used or replaced, or until you delete your account
Sign-in links	Sign in by email	We store only a hash of the link's secret. The link works once, for 15 minutes.	Useless after 15 minutes or one use
Sessions: a hash of the session token, browser type, country, start and last-seen times, and how often you sign in	Keep you signed in; show your list of sessions; spot account takeovers	The token is stored only as a hash	30 days after the session ends
Your data exports: the file you make in Settings, Your data	Let you download everything we keep about your account	Reached only through the link we email you; encrypted at rest by our host	24 hours, then deleted
Processor connection secrets (API keys, access tokens and webhook secrets) and processor account IDs	Create checkouts on your account and receive its payment events	Our own encryption on top of our host's: AES-256-GCM, with a separate key for each developer	Until you disconnect the processor; then deleted at once
Your apps: names, icons, colors, texts, prices, seller name, support email, and links to your terms, refund policy and privacy notice	Show them to your buyers on the watch and the pay pages	Encrypted at rest by our host	Until you delete the app or your account
Our billing: your plan, extras, statements, invoices and payments to us, and how many data feed requests your live watches and keys made each day and month	Bill you and keep our accounts	Card details go to Stripe, never to us	Daily counts: 400 days. Bills: as long as tax law requires
Payment history you import from your Stripe or PayPal connection or a file: for each payment, its source and ID, label, amount, currency, refunds, disputes, country and dates. No buyer names, emails or card details.	Show your history; recognise watches that already paid, so they stay unlocked	Encrypted at rest by our host. A watch ID in a payment is kept only as its keyed hash (section 5).	While your account exists, or until you delete the import
Your apps' public store data, for apps you link to their listing: rating, number of reviews, downloads, version, and the text of reviews (never the reviewer's name)	Show how your apps do on Garmin's app store	Public data, read only for your own apps	Reviews: 1 year. Daily figures: 2 years
API keys and their calls: each key's name, mode and last four characters, and each call's time, method, address asked (which can include a place you ask a data feed about) and result	Let your servers use our API; show you your calls	The key itself is stored only as a hash	Calls: 30 days. Keys: until you delete your account
A record of actions taken in your account, including any action our own staff take on it	Security and accountability	Readable only by us	While your account exists

Buyers and their watches (we act for the developer)

Data	Why	How we protect it	How long we keep it
Hashed watch ID (see section 5)	Recognise the watch; tie purchases to it; stop a reinstall from restarting a trial	A keyed one-way hash. The ID itself is never stored, never logged, and never put in a web address.	Unpaid watch: 400 days after we last saw it. Paid watch: while the app exists.
Watch record: the watch code in its QR link, when we first saw the watch, the country its first check came from (two letters, never the IP address), its language, when it should check next, its model and app version (kept only for developers with the Watch statistics extra, and for test watches), whether the developer gave it Premium free and who on their team did, and whether it was shown a review request	Draw the right screens in the right language; time the watch's checks; run trials; count installs by country for the developer; help with support	Encrypted at rest by our host	As for the hashed watch ID
Purchase records: amount, currency, status, the processor's payment, checkout and subscription IDs, and times	Unlock and lock features; handle refunds and disputes; count sales; make statements	Encrypted at rest by our host	As long as tax law requires, then cut down to totals
Consent records: the words a buyer agreed to and when, such as an EU buyer's request for immediate access, or a subscription's renewal terms	The developer's proof under consumer law	Encrypted at rest by our host	3 years, or as long as the purchase record if that is longer
A buyer's email, only when the processor sends it with a payment	Support for that purchase; the developer's list of their buyers	Sealed with our own encryption; found only through a keyed hash	While the developer's account exists; deleted with it
Feedback a buyer sends to the developer: a star rating, a message of up to 2,000 characters, and an optional email for a reply	Pass it to the developer	The reply email is sealed with our own encryption	Until the developer deletes it, or deletes the app or account
EU withdrawal requests: the name and purchase email the buyer types, the watch code if they give it, and the time	Tell the developer, and keep a record for their refund	The name and email are sealed (encrypted by us); everything is encrypted at rest by our host	As long as the purchase record
Moving a purchase to a new watch: the receipt or payment ID the buyer gives us	Look the purchase up with the processor, then move it	Used only for that look-up	Only the result is kept, with the purchase record
Exports: data a buyer sends from the watch to their phone, where the developer has the Export to phone extra	Let the buyer download their own data	The watch encrypts the data before it leaves. The key travels only in the link the watch sends to the buyer's phone through the Garmin Connect app, after "#", which browsers never send to servers, so we can't read the parts we hold. The phone's page checks every part, then decrypts it into a spreadsheet on the phone.	15 minutes, then deleted
A place, when the developer's app asks a data feed about one: the latitude and longitude the watch sends, such as for weather or prayer times	Answer the request	Used only in memory to work out the answer. Only a copy rounded to 2 decimal places (about 1 km) goes to a source or names a cached answer. Never written to our database or our logs.	Not stored. A source's answer stays in a short-lived cache, named by the rounded place, for up to 3 hours.
Carry-over checks, only where a developer moving from KiezelPay or PayToUse turns them on: the watch's ID as the app has it, its model, and the old service's unlock code	Ask the old service whether this watch already paid, so it stays unlocked with nothing for the buyer to do	Sent straight to that service over HTTPS and never stored. We ask at most once a day per watch while the answer is no.	Not stored. Only the answer, and when we asked, stay with the watch record
Test-mode log lines: fixed phrases with the watch code	Show the developer their test as it happens	No watch IDs, keys or emails	7 days
Statistics: counts of events such as scans, checkouts, payments, refunds, trials, active watches and review answers, by day, app, country and price, and by watch model and app version for developers with the Watch statistics extra	The developer's sales dashboard	Counts only, with no watch IDs. Any count below 3 shows only as "fewer than 3".	Raw events: 3 months. Daily totals, which identify no one: while the developer's account exists.

Security across the service (we are the controller)

Data	Why	How we protect it	How long we keep it
IP addresses of requests from watches and browsers, and the country they come from	Rate limits; stopping abuse and card testing; blocking countries and regions under comprehensive sanctions; counting sales by country	Never stored in our database	Minutes, in memory and short-lived counters; up to 30 days in logs
Error logs	Find and fix faults	Only listed fields are logged: never a watch ID or an email, and a watch code only as a short hash	30 days
Database backups	Recover from a disaster	Encrypted at rest by our host	30 days

Our website (we are the controller)

Data	Why	How we protect it	How long we keep it
What every browser sends with a request: IP address, browser type and the page asked for	Deliver the site and protect it from attacks	Handled by our host, Cloudflare. No analytics and no ad trackers.	Up to 30 days in logs
Sign-in and sign-up forms: your email, whether you are signing in or signing up, and the plan you picked, if any	Email you a one-time sign-in link	We store only a hash of the link's secret	Your email becomes part of your account when you sign in. An unused request is deleted within 30 days.
Contact form: the topic, your name (optional), your email and your message. Cloudflare Turnstile also checks the form is sent by a person, using your IP address and signals from your browser; Cloudflare handles those under its own Turnstile privacy terms.	Reply to you, and keep out spam	Delivered to our support mailbox	As long as we need it to answer you and follow up, then deleted

No trackers. Our website has no analytics and no ad trackers. Its fonts are on our own server, so its pages contact no font service.

Finding your inbox. After you ask for a sign-in link, the page can show a button that opens your email. For well-known email services, such as Gmail, the page recognises your address's domain by itself. For other domains, your browser asks Cloudflare's public DNS-over-HTTPS service for the domain's mail server (its MX record). Only the domain is sent, such as "studio.com", never your full address. Cloudflare sees your IP address, as with any web request, and answers under its own privacy policy for that service. The answer stays in your browser; we don't receive it. If you tap the button, it opens your email provider's site or app. For some providers, such as Gmail and Outlook, the link includes your email address so the right inbox opens. That address goes only to your own email provider, and only if you tap.

Cookies. Signed-in pages use one cookie: a session cookie that holds a random token and keeps you signed in. It expires after 12 hours without use, and after 30 days at most. It is strictly necessary for signing in. Our pay pages set one cookie, "pass": a random token that lets the phone that paid unlock that purchase on a watch again with one scan. Page scripts can't read it (HttpOnly). It lasts 400 days and holds no name, email or card details, and we use it only for that. We use no other cookies, and no tracking or advertising cookies. Your processor's checkout page, and Stripe's payment form when it shows inside our buy page, are the processor's own, under its own cookie policy.

Email we send. We send developers service email only, such as sign-in links, alerts, statements and notices. Our emails contain no tracking pixels and no tracked links.

5. Watch IDs: hashed, but still personal data

Garmin gives each app its own ID for each watch. It stays the same when the app is reinstalled. We never store this ID. When a watch asks our server, we combine its ID with a secret key that only our server holds, and keep only the one-way result: a keyed hash. The watch sends its ID only inside the body of the request, never in a web address, and we never write it to our logs. One exception: where a developer moving from KiezelPay turns on carry-over checks, we pass the ID to KiezelPay in the web address of its status check, as KiezelPay's own watch code does. KiezelPay already has that ID from the developer's old app.

That hash is not anonymous. Because we hold the key, we can match the hash to the same watch every time it asks. Under EU and UK law, that makes it pseudonymous personal data: data that can't be linked to a person without extra information. We treat it as personal data, and everything in this policy about personal data applies to it.

6. Our legal reasons for using data

Where we are the controller, EU and UK law requires a legal reason for each use. Ours are:

Our contract with you: running your account and the service, and billing you.
Legal duties: keeping tax records and location evidence, checking sanctions lists, blocking sanctioned regions, and answering lawful requests.
Legitimate interests: keeping the service, developers and buyers safe (logs, rate limits, card-testing defences and session records); replying to messages; and making counts that identify no one, to run and improve the service. We weigh these interests against your rights. You can object, as section 13 explains.

Where we handle buyers' data for a developer, the developer decides the legal reason.

Some security checks run automatically, such as pausing an app's checkouts during a card-testing attack, and blocking access from regions under comprehensive sanctions. A person decides any suspension of a developer's account. We don't use personal data for profiling or advertising.

7. What we never do

We never sell personal data.
We never share personal data for advertising, and we show no ads.
We never track you on pay pages or in email. Pay pages load no analytics, and no third-party scripts but Stripe's own payment form (Stripe.js), which shows inside the buy page of apps paid through Stripe. Emails carry no tracking pixels or tracked links.
We never see or store card numbers.
We never ask buyers to create an account.
We never send buyers marketing email.
We never put watch IDs or sign-in tokens in our own web addresses, and we never write watch IDs or emails to our logs. (KiezelPay's status check, which a developer can turn on, is the one outside address that takes a watch ID: see section 5.)
We never use buyers' data for our own purposes, except to keep the service secure, to meet our legal duties, and to make counts that identify no one.

The developer of the app you use. They see their own buyers' purchase records, watch codes, consent records, feedback and requests, and statistics with small counts hidden. Developers never see other developers' buyers.
The developer's payment processor. To create a checkout, we send the processor the app, the price, the currency and the watch code. You then give your payment details to the processor directly.
Public data sources, for data feeds: only a place rounded to about 1 km, a country or a tide station, sent from our servers. Never a watch ID, an IP address or anything else about the buyer. They are MET Norway, the US National Weather Service, NOAA and Nager.Date. The US Geological Survey's earthquake list and NOAA's aurora data we fetch whole, sending nothing about anyone.
KiezelPay or PayToUse, only where a developer moving from that service turns on carry-over checks: what section 4 lists. Each is an independent company, under its own privacy policy.
Our sub-processors, listed in section 9.
Authorities, when the law requires it. We check every request. Where the law allows, we tell the developer or the person concerned first.
A new owner. If WearCheckout or the service is sold or merged, personal data passes to the new owner under this policy. We tell developers before it happens.

9. Sub-processors

Sub-processor	What it does for us	Where
Cloudflare, Inc.	Hosting, database, file storage, backups and logs; sending our email; forwarding mail sent to our addresses; delivering and protecting our website	Cloudflare's global network. Cloudflare, Inc. is based in the United States.

We give developers at least 30 days' notice, by email and on this page, before we add or replace a sub-processor. Developers may object, as our Terms of Service explain.

10. International transfers

Our host runs a global network, so personal data may be handled in the United States and in other countries outside the one where you live.

When personal data from the European Economic Area goes to a country without an adequacy decision, we protect it with the European Commission's Standard Contractual Clauses. For UK data we add the UK International Data Transfer Addendum, and for Swiss data we make the changes Swiss law requires. Where a US recipient is certified under the EU-US Data Privacy Framework, or its UK or Swiss extension, we may rely on that as well. You can ask for a copy of these safeguards at contact@wearcheckout.com.

11. How long we keep data

We keep data only as long as we need it. The tables in section 4 give each period. In short:

Developer account data: while the account exists.
Processor secrets: deleted at once when you disconnect a processor.
Sessions: 30 days after the session ends.
Watch records: 400 days after we last saw an unpaid watch; while the app exists for a paid watch.
Buyer emails: while the developer's account exists.
Your data exports: 24 hours.
Buyers' exports from the watch: 15 minutes.
Test-mode log lines: 7 days.
Places asked about by data feeds: not stored; a source's answer, named by the rounded place, is cached for up to 3 hours.
Imported payment history: while the developer's account exists, or until they delete the import.
Store data: reviews 1 year, daily figures 2 years.
API call logs: 30 days.
Logs and backups: 30 days.
Raw statistics: 3 months.
Purchase, fee and billing records: as long as tax law requires, then cut down to totals.

When a developer deletes their account, we disconnect their processors and delete those secrets at once. We delete their apps and watch records. We keep purchase and fee records only as long as tax law requires, cut down to amounts and IDs. We confirm the deletion by email. Copies in backups are deleted within 30 days.

We may keep data longer only when the law requires it, or for as long as we need it to establish or defend a legal claim.

12. How we protect data

In transit: HTTPS only, with TLS 1.2 or newer (1.3 preferred) and HSTS.
At rest: our host encrypts our database, file storage and backups.
Our own layer: processor secrets, buyer emails and other sensitive fields are sealed with AES-256-GCM, with a separate key for each developer. Those keys are sealed in turn by a master key that exists only as a server secret. Each sealed value is bound to its place, so a copy moved elsewhere won't open.
One-way hashes: watch IDs, session tokens, sign-in links and recovery codes are stored only as hashes. Emails are looked up through a keyed hash.
End to end: exports are encrypted on the watch and opened in the buyer's browser. The key never reaches us.
Pay pages: they load no third-party scripts but Stripe's payment form on the buy page, under a strict Content Security Policy. We check them every hour for any change we didn't make.
Separation: each developer's data is kept apart, and tests check that one developer can't reach another's.
Our own access: our accounts are protected with hardware security keys. Every admin action is logged. Viewing any decrypted field needs a written reason, which is logged too.
Card data never reaches our servers.

No system is perfectly secure. If you find a vulnerability, please report it to contact@wearcheckout.com.

13. Your rights

Depending on where you live, you have the right to:

see the personal data we hold about you;
correct it;
delete it;
get a copy to take elsewhere;
object to how we use it, including uses based on our legitimate interests;
ask us to restrict how we use it;
withdraw consent, where we rely on consent; and
complain to a data protection authority.

Developers

You can export your data, correct your email and business details, and delete your account yourself in the dashboard. For anything else, write to contact@wearcheckout.com.

Buyers

The developer of the app is the seller, and the controller of your data. Their name and support email appear on the pay pages and in the app's store listing. Please send your request to them. If you write to us, we point you to the developer. We help them find your records by the watch code or by the processor's payment ID, and we delete what the law allows. For payment details, such as your card, ask the payment processor.

Visitors and people who contact us

Write to contact@wearcheckout.com.

How we handle requests

We may ask you to confirm the request from the email address we hold, so we know it is you.
We answer within one month. If a request is complex, we may take up to two more months, and we tell you why.
Requests are free, unless they are clearly unfounded or excessive.
If you are in the EU, the EEA or the UK, send your request to contact@wearcheckout.com. If we appoint a representative in the EU or the UK, we will name them here.
You can complain to the data protection authority where you live or work, or where you think the law was broken. In the UK, that is the Information Commissioner's Office.

14. Children

WearCheckout is not aimed at children. Developer accounts are for adults aged 18 or over. We don't knowingly collect children's personal data for our own purposes.

Some developers may make apps for children. Those developers must tell us, and they are responsible for the Children's Online Privacy Protection Act (COPPA) in the US, Article 8 of the GDPR (often called GDPR-K) and similar laws. That includes notices to parents and any consent parents must give. We use watch IDs only to run the service: to recognise the watch, to unlock what was bought, and to keep the service secure.

If you believe we hold a child's personal data for our own purposes, write to contact@wearcheckout.com and we will delete it.

15. California

We do not sell or share personal information, as the California Consumer Privacy Act defines those words. We have not done so in the last 12 months. We don't use sensitive personal information to infer anything about anyone.

Where we are the business deciding how data is used, we collect these categories: identifiers (name, email and IP address); commercial information (your plan and invoices); internet activity (sessions and security logs); approximate location (country); and professional information (business details). They come from you, your browser and our own systems. Section 4 gives the purposes and how long we keep each one.

California residents may ask to know, correct and delete their personal information. We won't treat you differently for asking. You may use an authorised agent. Write to contact@wearcheckout.com. For buyers' data, we act as the developer's service provider, and we pass your request to them.

16. If something goes wrong

If a personal data breach affects developers' or buyers' data, we tell the affected developers without undue delay, aiming for 72 hours from when we learn of it. We tell them what happened, what data is involved, what we are doing, and what to rotate or change. Where we are the controller, we also tell the data protection authority and the people affected when the law requires it. We keep a record of every incident.

17. Changes to this policy

We post the current version here, with the date it was last updated. If a change matters to you, we email developers at least 30 days before it takes effect. Changes to the sub-processor list follow section 9.

18. Contact

Write to contact@wearcheckout.com about privacy and data requests, security problems, your account or billing. Developers can also use Message support under Help in the dashboard.

If you are in the EU, the EEA or the UK, send privacy requests to contact@wearcheckout.com. If we appoint a representative in the EU or the UK, we will name them here.

The short version