Effective and last updated: August 28, 2026 ยท Version 2026-08-28.3
Important sensitive-data notice
Wiped is not an ordinary content website. Optional features can process precise real or simulated location, routes, stable device identifiers, iPhone pairing information, and Apple Account credentials used for app signing. This information can reveal movements, routines, devices, and accounts and is treated as sensitive.
This Privacy Policy applies to wiped.me and Wiped-branded accounts, dashboards, installers, desktop applications, mobile applications, location-simulation features, support systems, and related services that link to it (the "Services"). It does not govern an unrelated third party's independent handling of information.
Wiped, the operator of the Services, is responsible for personal information under its control. The designated Privacy Officer can be reached at support.wiped@gmail.com. Include "Privacy Request" in the subject line. We may verify your identity and authority before disclosing or deleting information.
The Services may be offered to adults worldwide, subject to availability and applicable law. This Policy applies regardless of where a user accesses the Services, while additional mandatory rights may apply in a user's jurisdiction.
This Policy is a factual description of our practices, not a waiver of rights provided by privacy, consumer-protection, or other applicable law. Our Terms of Service govern use of the Services.
The Services are intended only for people who are at least 18 years old. We do not knowingly permit minors to create accounts or use the Services. If you believe a minor provided information to us, contact support.wiped@gmail.com so we can investigate and delete it where required.
Some information is stored locally and is not part of Wiped's hosted account database unless you actively submit it, start a server-assisted feature, or a third-party map/service receives it. Local information can include saved routes and favourites, home coordinates, selected locations, known device names and UDIDs, pairing files, app preferences, cached maps, logs, signed applications, provisioning profiles, certificates, signing keys, and login state.
Wiped desktop software stores certain login state and identifiers in the system Keychain and other settings in local application storage. Local pairing and runtime logs may remain on the computer. The desktop diagnostic builder keeps a limited local history and shows what an optional report contains before upload.
Account deletion on the website cannot reach into a Mac, Windows computer, iPhone, browser profile, backup, or Keychain. You must remove local information using the application's controls, Keychain Access or device settings, and by deleting the application and its support files where appropriate.
Apple Account processing is optional and used only for installation, signing, provisioning, and an optional renewal workflow. Wiped Setup accepts the Apple Account email, password, and two-factor code on your Mac. The password is used locally to create Apple's secure authentication proof; the authentication and developer-service requests go directly from your device to Apple domains such as gsa.apple.com and developerservices2.apple.com. Wiped's website, Clerk account database, and support queue do not receive the Apple password through this flow.
Wiped may hold the entered password in application memory long enough to finish the authorized signing and, if selected, the encrypted phone-bound transfer. It is cleared after completion or failure. The installer asks separately before saving the Apple email and password in the Mac login Keychain. If you decline, they are not deliberately retained there by Wiped Setup.
If you enable automatic renewal, the Mac encrypts the login to a one-time public key from the connected iPhone. The iPhone stores the resulting credential in a non-synchronizing, device-only Keychain item and destroys the transfer key. The credential remains until you disable/remove it, reset the device, erase the Keychain item, or another documented lifecycle event removes it. An optional remote anisette service hosted with Cherry Servers in Amsterdam, Netherlands processes a random renewal identity, Apple attestation material, IP/network metadata, locale, time zone, and device/client headers; it is not intended to receive the Apple email, password, or two-factor code.
Apple independently receives and controls Apple Account, device registration, certificate, profile, App ID, and authentication information under Apple's policies. Removing Wiped does not automatically revoke Apple sessions, certificates, device registrations, or profiles. Use Apple's account and developer controls when revocation is needed.
Map features may send searches, map bounds, coordinates, routes, waypoints, and network/device information directly to Mapbox to load maps, geocode places, calculate routes, identify traffic controls, or obtain speed-limit data. When Apple Maps is selected, Apple may receive equivalent map requests under Apple's policies. Imported route files are read locally unless you use a feature that submits their coordinates to a map provider or Wiped service.
Depending on the law and context, processing is based on your consent, steps you request before or under a contract, performance of our agreement, compliance with legal obligations, or Wiped's legitimate and proportionate interests in security, fraud prevention, support, and service operation. Where express consent is required for sensitive or unexpected processing, we request it separately and do not treat a buried policy statement as that consent.
Support submissions are stored in Wiped's private support queue and delivered to private Discord channels. Replies may be sent through Gmail. A signed-in submitter may be matched to the account's Clerk ID, account email, and plan so support can identify the correct account even when the form uses an email alias.
Support replies are written or selected by a human operator. Wiped does not send support messages, screenshots, or diagnostic logs to a generative-AI model for reply drafting. Do not include passwords, access tokens, pairing keys, private signing keys, full payment-card data, government identifiers, medical information, or another person's private information in support text or screenshots. Discord, Google/Gmail, Vercel, and Upstash process submitted support information under Wiped's account configuration and their applicable processor terms and policies.
Wiped may disclose the minimum information needed to the following recipients:
Wiped does not sell personal information or use it for cross-context behavioural advertising. Wiped does not rent customer lists. We require service providers to protect information through contracts or platform terms appropriate to their role, but their independent services may also collect information as separate controllers.
Wiped and its providers may process information in Canada, the United States, the Netherlands, and other jurisdictions outside your province, territory, state, or country. Upstash is configured in a North American region, and the optional anisette host is located in Amsterdam, Netherlands. Other authentication, hosting, payment, map, support, analytics, email, and Discord processing may occur in the United States or other provider locations. Provider routing can change over time.
Information processed abroad is subject to the laws of the receiving jurisdiction and may be accessible to courts, law-enforcement, national-security, or regulatory authorities there. Wiped remains accountable for personal information transferred to a processor for processing on its behalf and uses contractual and technical safeguards appropriate to the sensitivity and service. Contact the Privacy Officer for current information about significant service-provider locations or safeguards.
We use the following operational retention rules unless a longer period is required for law, tax, payment disputes, fraud, security, a legal hold, or the establishment or defence of claims:
A third party that receives information as an independent controller, including Apple or a map provider, applies its own retention rules. Wiped cannot guarantee deletion from their systems.
Subject to applicable law, you may ask us to:
You can update some account information through Clerk controls, omit support attachments, disable Apple credential saving or renewal, remove Keychain items, and delete your Wiped account. You may also contact support.wiped@gmail.com. We will respond within the period required by applicable law and explain any lawful refusal.
Withdrawing information that is necessary to authenticate, bill, secure, or operate a requested feature may prevent that feature or the account from working. We will not deny a product merely because you refuse an unnecessary use of sensitive information.
When website account deletion succeeds, Wiped first attempts to cancel all identified Stripe subscriptions. It then removes matched records and private attachments from Wiped's support queue, deletes active Stripe customer details, and deletes the active Clerk user record, including stored device identifiers. If billing cancellation cannot be confirmed, deletion stops and shows an error so you can retry; the account is not silently deleted while a charge may remain.
Account deletion does not automatically:
Before deletion, stop active sessions and save any records you need. After deletion, remove local Wiped data and credentials, revoke third-party access where appropriate, and confirm billing cancellation and restoration of real location.
Clerk and Stripe may use cookies or similar browser storage needed for authentication, fraud prevention, checkout, and security. Wiped uses Vercel Web Analytics for aggregated page statistics. According to Vercel, Web Analytics does not use third-party cookies, associate events with an individual or IP address, or reconstruct browsing across different applications; it can store the page/route, referrer, filtered query parameters, city-level geolocation, browser, device, operating system, and time.
Wiped does not use cross-site behavioural advertising, so a browser "Do Not Track" signal does not change an advertising profile at Wiped. Browser privacy tools may block analytics. Blocking essential Clerk or Stripe storage may prevent login or checkout.
Wiped uses safeguards appropriate to the sensitivity of the information, including encrypted transport, private Blob storage for support attachments, Keychain storage for local secrets where described, short-lived authorization grants, access controls, rate limits, hashing for selected anti-abuse identifiers, and separation between ordinary app data and credential workflows.
No system is perfectly secure. Keep devices, email, Apple Account, authentication factors, tokens, and Keychains protected. Contact us immediately if you suspect compromise. We investigate incidents and provide notices to affected people and regulators where required by law.
Send privacy questions, requests, or complaints to the Privacy Officer at support.wiped@gmail.com. We will investigate and explain our response. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial, territorial, state, national, or regional privacy regulator. Exercising a privacy right will not result in unlawful retaliation or discrimination.
We may update this Policy when our Services, providers, or legal duties change. The effective date and version appear above. We will provide prominent in-product or account notice when a change is material and seek renewed consent where required, especially before a new sensitive use that is not reasonably expected. Continued use alone will not substitute for express consent where applicable law requires express consent.
Privacy Officer, Wiped
Email: support.wiped@gmail.com
For postal correspondence, email the Privacy Officer to request the current mailing address.