UPDATED 17 OCTOBER 2026
Privacy
What Warq keeps, who holds it, and how to have it removed. It covers the Warq app, this website, and the waiting list.
Who is responsible
Warq is run by Faza Amal Sophian, an individual in Malaysia, who decides what is collected and why. Write to hello@warq.app about anything on this page.
The app
Your account
To make an account, you give a username, an email address and a password. Warq keeps the username and email, and a one-way hash of the password, never the password itself. It also keeps when your email was confirmed, which plan you are on, how much storage you use, and, for each device you sign in on, a sign-in token named after the kind of device it is (iPhone or Android).
Right after you make an account, Warq asks once how you heard about it, from a short list. Your answer is kept on your account and used only to count which ways of telling people about Warq work. You can skip it, and then nothing is kept.
To slow down anyone guessing passwords or numbers, the server counts recent attempts to sign in, sign up, confirm an email or reset a password, and keeps the count with the IP address the attempts came from.
What you put in Warq
Your notebooks, the text you write, the codes, and the files you attach: photos, recordings, videos and documents, each with its name, type and size. Text is kept on your devices and synced through the server so every device you sign in on has it. Files are backed up to Warq's storage up to your plan's limit, and fetched back when a device needs them.
Photos and videos can carry details your camera recorded in them, such as the time, the camera and, if your camera adds it, the place. On iPhone, the app removes the place from photos and videos before keeping them, and keeps the time and the camera. When it compresses a photo, which it does by default, it removes the rest of those details too. A document is backed up exactly as it is.
Recognising text in an image happens on your phone. Warq does not send your files anywhere to be read.
Warq uses what you put in it to keep it for you and show it back to you, and for nothing else. It is not read, analysed, sold or used to train anything.
Sharing
When you share a notebook, anyone signed in to Warq with its code can read it: your username (not your email), the notebook's text, and its files, which they can download as they are. Warq records which accounts have opened a shared notebook, and when.
Warq emails you a six-digit number to confirm your address and to reset your password. These are sent through Resend, which receives your address and the email's contents in order to deliver it.
Warq may also send you other emails from time to time. To stop them, choose Unsubscribe at the foot of any of them. That does not stop the six-digit numbers.
Purchases
Purchases in the app are made through Apple's App Store, and Apple handles the payment. Warq uses RevenueCat to check what you bought, identified by your Warq account number, not your name or email. Purchases on the web are made through Polar, which handles the payment and tells Warq the email you bought with and what you bought, so the purchase can be added to your account. Warq never sees your card.
Crash reports
When the app or the server fails, a report of the failure goes to Sentry, in its EU region: what went wrong and where in Warq's code, the app and system version, and the kind of device. It carries no account and no IP address, and none of your attachments or notes; any email address in an error's text is removed before the report is sent. Crashes help fix Warq, and nothing else is done with them.
What the app does not do
The app has no advertising, no analytics and no tracking, and it does not read your contacts or your location. It asks for the camera to scan codes and take photos, the microphone to record, and your photo library to attach pictures you choose, each only when you use it.
Where it is kept
The server runs on Onidel in Sydney, Australia. Accounts and text are stored in Warq's own Postgres database, on a second Onidel server in Sydney. The database is backed up continuously to Cloudflare R2, in its Oceania region, and each backup is kept for up to eight days. Files are stored in Cloudflare R2 and delivered through Cloudflare, which also sits in front of the server and sees the IP address of each request. The servers' own logs and measurements, which contain none of your notes or files, go to Grafana Cloud in Singapore. Email goes through Resend's Tokyo region.
How long it is kept, and deleting it
Everything is kept for as long as your account exists. To delete your account, open Settings in the app and choose Delete account; it asks for your password. Every device is signed out at once, and your shared notebooks stop opening for anyone. For 30 days the account is kept, so that signing in brings it back if you change your mind, or lets you delete it there and then. After 30 days the account, everything in it and every backed-up file are permanently deleted, and the database's backups no longer hold any of it eight days after that. If you cannot use the app, write to hello@warq.app from the account's email address instead.
A subscription has to be cancelled before its account can be deleted, because deleting the account would not stop the App Store or Polar charging for it. Apple, RevenueCat and Polar keep their own records of what was bought, under their own policies; RevenueCat's is identified only by an account number that no longer means anything once the account is gone. Whatever is on your devices stays there until you remove the app.
The waiting list
When you join, Warq keeps:
- your email address
- which form you used, and the time you used it
- the sentence the form showed about what joining means
- the country your connection came from, as Cloudflare reports it
- your browser's user agent, the line that names the browser and device
They are kept to tell you when Warq opens and to send you updates about it, and for no other purpose. They are stored in Warq's own Postgres database, on Onidel in Sydney, Australia. The address is never sold or shared with anyone else.
Warq has not emailed the list yet. Every email it sends will have a way to stop receiving them. To be removed from the list entirely, write to hello@warq.app from the address in question, and it is deleted.
This website
Warq uses Microsoft Clarity to see how this site is used: where people scroll, click and pause, and where the page gets in their way. Clarity records these sessions. It sets two cookies on warq.app, _clck and _clsk, to tie a visit's pages together. It also sets cookies on Microsoft's own domains, MUID, CLID, ANONCHK, MR and SM, which Microsoft uses to recognise the same browser across sites. Microsoft lists them in its Clarity cookie documentation and processes this data under its own privacy statement. Clarity is on the website only, never in the app.
In the UK, the EEA and Switzerland, nothing is recorded and no cookie is set until you choose Accept. Elsewhere, Clarity runs when the home page loads, and Reject stops it. On the blog and on the legal pages, it waits for Accept wherever you are.
Refusing stops Clarity loading from then on, and clears the two cookies on warq.app. The cookies on Microsoft's domains belong to Microsoft, so Warq cannot remove them. Your browser's settings can, for clarity.ms and bing.com.
Either way, your answer is remembered in one cookie of Warq's own, warq_cookies, for six months. You can change it at any time: cookie settings.
The site is served by Cloudflare, which sees each visitor's IP address in order to deliver the page. To stop one person flooding the sign-up form, the site counts requests per IP address in Cloudflare's cache for up to an hour, and the count is then discarded. The IP address is not stored with your email. The fonts come from Google Fonts, so your browser fetches them from Google.
Children
Warq is for people aged 13 and over. Someone younger than the age at which they can agree to this on their own where they live needs a parent or guardian to agree for them, or a school that provides Warq to agree on their behalf. If you believe a child is using Warq without that, write to hello@warq.app and the account is removed.
Your rights
You can ask what Warq holds about you, have it corrected, have a copy of it, or have it deleted, by writing to hello@warq.app. If you are in the UK or the EEA and are unhappy with the answer, you can complain to your data protection authority.
Changes
When this page changes, the date at the top changes with it. A change to what the app keeps or who holds it is also told to account holders by email before it takes effect.