Widgy for Android: Privacy Policy
Widgy, the widget app by Woodsign · Effective 24 October 2026
This policy covers the Widgy app for Android. If you have questions, email bojan@woodsign.hr.
The short version
- Widgy works without an account. You can create widgets, add them to your home screen and import widgets from Explore without signing in.
- Most of what your widgets show (your calendar, your Health Connect data, your battery, the song that is playing) is read and drawn on your phone and never sent to us.
- Some widget data needs an online service. For example, weather needs your location to be sent to a weather service. Those services are listed below.
- We store data on our server only when you sign in and publish a widget, create a share link, or report a widget.
- Widgy has no ads, no analytics or tracking SDKs, does not use the advertising ID and does not sell your data.
Data that stays on your phone
Widgy reads the following only to show it on the widgets you design. It is processed on your phone and is not sent to us or anyone else (except inside a preview image you choose to publish or share, see Publishing and sharing):
- Calendar events (Android calendar permission)
- Health and fitness data from Health Connect (see Health Connect)
- Battery, storage, Wi-Fi and Bluetooth state
- What is playing, read from media notifications if you grant notification access
- Your widget library, settings and the photos you add to widgets
- Files you pick for a widget (Files text and pictures, CSV From Files, Contents Of File). Widgy reads them on your phone. A Files picture is uploaded, scaled down, only when you publish or share the widget (like your photos); every other file is never uploaded, and publishing or sharing removes the reference to it
Widgy asks for a permission the first time a widget you open needs it. You can turn any of them off in Android's settings; the widgets that need them will then show no data.
Data sent to services that provide widget data
| What | Sent to | When | Why |
|---|---|---|---|
| Your location (latitude and longitude) | Open-Meteo (open-meteo.com) | A widget shows weather, elevation, sun or moon data | To get the forecast for where you are. Open-Meteo does not receive any account or device identifier from Widgy. |
| Your location | Android's geocoder (provided by Google) | Same | To show your city's name |
| The map area you look at | OpenFreeMap (openfreemap.org) | You use the map in Location For Weather | To draw the map |
| Artist and album or title of the song that is playing | Apple's iTunes Search API | A widget shows album art | To find the cover image |
| The coin and stock symbols you pick | CoinPaprika, Yahoo Finance | A widget shows crypto or stock prices | To get prices |
| Nothing personal | jsDelivr (currency rates) | A widget shows currency rates | To get exchange rates |
| The web addresses you enter | Those websites | A widget uses the Web URL data source, an RSS feed, a CSV From Web URL chart or a Contents Of Web URL tap action | To load the content you chose |
| The web address, headers, parameters and token of a JSON Endpoint, as you or the widget's author entered them | That server, and the website of the picture address it answers | A widget uses JSON Endpoint (text, chart, tap action or picture) | To load the data or picture you chose |
| Your IP address | ip-api.com | A JSON Endpoint keeps its default address | The service reads it from the request; its default answer describes your connection's location |
| Nothing personal | raw.githubusercontent.com, gist.githubusercontent.com, randomfox.ca | A CSV chart, a Contents Of Web URL tap action or a JSON Endpoint picture keeps its default address | To load that sample |
| Nothing personal | reddit.com | An RSS widget keeps a default feed (r/widgy, and r/iOSsetups for a dark-mode picture) | To load that feed |
| Nothing personal | The websites an RSS feed's pictures are on | A widget shows an RSS picture (RSS #1 - Image … RSS #10 - Image) | To load the picture the feed links to |
| The zodiac sign the widget shows | e-tarocchi.com | A widget shows a horoscope | To get that sign's horoscope |
| Nothing personal | NASA, TheMealDB, TheCocktailDB, TMDB (and image.tmdb.org), TheCatApi, Random Fox, xkcd, the Chuck Norris API, Cat Facts, Advice Slip, Evil Insult, icanhazdadjoke, JokeAPI, and the websites their pictures are on | A widget shows one of these API List items (text or picture) | To get the text or picture it shows |
| The words you search for, and which photo you pick | Unsplash (unsplash.com) | You search or pick a photo in the Unsplash picker. A widget then loads that photo from images.unsplash.com | To show photos to choose from and load the one you chose. Unsplash is told that a photo was picked, as its terms ask |
| Your location (latitude and longitude) | USGS (earthquake.usgs.gov) | A widget shows Last Earthquake Nearby | To find the latest earthquake near you |
| Your country (from your Date Language, else your phone's region) | Nager.Date (date.nager.at) | A widget shows a public holiday | To get your country's holidays |
| Your IP address | ipapi.co | A widget shows your External IP Address | The service reads it from the request, which is the value the widget shows |
Instead of your current location you can set a fixed location in Settings → Location For Weather.
Health Connect
If a widget shows health or fitness data, Widgy asks for permission to read it from Health Connect, and only for the data types that widget shows. Widgy only reads; it never writes to Health Connect.
Widgy can read these data types, each only to show it on a widget you design:
- Activity: steps, distance, active calories burned, exercise (workout duration) and floors climbed, for today's totals, charts of past days, weeks and months, and move and exercise progress rings
- Heart and vitals: heart rate, resting heart rate, heart rate variability, oxygen saturation, blood pressure, blood glucose and VO2 max, for the latest reading and charts of recent readings
- Body measurements: weight, height and body fat, for the latest value, BMI (from weight and height) and charts
- Sleep: how long you slept, for last night's sleep and sleep charts
Health Connect data is used only to show it on the widgets you design. It is read and drawn on your phone and is never sent to our servers. It is never used for advertising, never sold, and never shared with third parties. Widgy does not keep a separate copy of it: it reads the values when it draws a widget, and the drawn widgets stay on your phone until you uninstall Widgy or clear its data. The only way Health Connect data can leave your phone is inside the preview image of a widget you choose to publish or share, as described below.
Widgy's use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. You can see and revoke what Widgy may read at any time in Health Connect's settings.
Your account (optional)
You can sign in with Google to publish widgets to Explore. When you do, Google gives Widgy a sign-in token that contains your Google account ID, name and email address. Our server checks the token and then stores only your Google account ID and a random Widgy user ID. We do not store your name or email address on our server. Your email address is kept on your phone so the app can show which account is signed in.
Publishing and sharing
When you publish a widget to Explore, we upload and store the widget's design (its layers, text, the name and author name you enter), the photos used in it, and a preview image. Published widgets are public: anyone using Widgy can see, download and report them.
The preview image shows the widget as it currently looks on your phone, so it can include the data the widget displays, such as your city, your step count or a calendar event title. Check the preview before you publish.
The design includes every layer's settings, so a JSON Endpoint's web address, headers, parameters and token go with it. Don't publish or share a widget whose JSON Endpoint uses a private token. A picture you picked through Files is uploaded, scaled down, like your photos. References to other files you picked on your phone are removed.
When you share a widget as a link or QR code, the same design, photos and preview image are uploaded so the link works. Share links are not tied to an account. Anyone with the link can open the widget.
When you report a widget, we store which widget you reported and the reason you gave.
We count how often each published widget is downloaded. The count is not linked to you.
Google services
- ML Kit scans QR codes when you import a widget from a QR code. Google's ML Kit sends Google diagnostic information such as the device model, Android version, app version, performance metrics and a per-installation identifier. See Google's ML Kit data disclosure.
- Google Play services provides Sign in with Google.
The Goodies tab
The Goodies tab shows the r/widgy community from reddit.com. Reddit's own privacy policy applies to what you do there. Links outside Reddit open in your browser.
Keeping and deleting your data
- Published widgets are kept until you delete them (the trash icon on your widget in Explore) or delete your account.
- Delete your account in the app under Settings → Account → Delete account. This permanently deletes your account and every widget you published, with its design and preview image. You can also ask us without the app: see widgy.icu/delete-account.
- Photos you placed inside published widgets are stored separately and are not removed when the widget or account is deleted. Email bojan@woodsign.hr with the widget links to have them removed.
- Share links are kept until you ask us to remove them. Email us the link.
- Server logs used for troubleshooting and security can contain your IP address and your Widgy user ID, a number that isn't your name or email address.
- Everything stored on your phone is removed when you uninstall Widgy or clear its data.
Children
Widgy is not directed at children under 13, and we do not knowingly collect data from them.
Security
Widgy talks to our server and to the services above over HTTPS, so the data is encrypted in transit. The only exceptions are web addresses that start with http://: an RSS feed, image, JSON or CSV address you or a widget's author entered, and JSON Endpoint's default address (ip-api.com). Health Connect data and the other data listed under "Data that stays on your phone" stay inside Widgy's private app storage, which Android keeps from other apps.
Changes
We will post changes to this policy on this page and update the effective date. For significant changes we will also tell you in the app.
Contact
Woodsign, bojan@woodsign.hr