Privacy Policy

What WebActivity collects from developers, from the people whose phones show their activities, and from visitors to this site. Why we collect it, who else sees it, and how to have it corrected or deleted.

Last updated 17 October 2026.

Who We Are

WebActivity is made by Eldrbreak LLC. This policy covers the website at webliveactivity.com, the dashboard, the developer API, the embed button and QR pages developers place on their own sites, and the Web Live Activities apps for iPhone and Android, including the App Clip. Questions about any of it go to [email protected].

Who This Covers

Three groups of people use WebActivity, and we hold different data about each.

Developers and their team members, who create an account, build activities and call the API.
End users, whose phones run the Web Live Activities app and show the activities and notifications a developer sends.
Visitors, who browse this site, try the builder, or open a page that embeds one of our buttons.

Developers and Team Members

Account details

Name, email address and password when you sign up with a password. Passwords are stored as a salted hash, never in a readable form. Signing in with a password also requires a code we email to you.
Sign-in provider details. If you sign in with Google, Apple or GitHub, the provider sends us your name, email address, a profile picture link and the sign-in tokens it issues, and we store those on your account. We do not read your contacts, files or anything else from those providers.
A mobile phone number, which we verify by text message when you create your account. We keep it to hold each person to one free team and to reach you about your account. Twilio checks that the number is a real mobile line before any text is sent, and numbers that fail that check are refused.
Sign-in sessions. Each session records the IP address and browser it came from, and lasts up to 400 days from your last visit.

Team details

The team name, who is on it and their role, and the email address of anyone you invite. Invitations expire after 48 hours, but the record of the invitation stays with the team.
Team members can see each other’s name, email address, role and join date.

What you build

Activities, push groups and their branding. The text, colors, links, images and settings you send through the API or set in the builder. The live content of an activity is encrypted before it is written to our database.
Uploaded images, with the original file name, size and dimensions. Uploaded images are served from a public address, so anyone who has the link can view one until you delete it or the team is deleted.
API keys and webhook signing secrets. These are stored as issued so the dashboard can show them back to you. Treat them like passwords, and roll a key from the dashboard if it leaks.
Webhook endpoints you register, with a record of what we sent to them and whether they answered.

Billing

Your plan, how many pushes your team delivered this month, and the identifiers Stripe assigns to your team and subscription. Card numbers and billing addresses are entered on Stripe’s pages and never reach our servers. The dashboard shows the card brand and last four digits by asking Stripe each time.

Logs

A delivery log for every activity update, notification and webhook: which activity or group, when, which platform, and whether it succeeded. Failure entries include the reason Apple, Google or your server gave. Logs are kept for 90 days and then deleted.
A copy of each notification you send: its title, text, image and link, encrypted, so we can investigate abuse. Kept for 90 days, like the logs.

End Users

The apps are built to work without an account. We never learn your name, email address, phone number, contacts or precise location.

A device identifier. The app generates a random identifier the first time it opens. It is not your Apple or Google identifier and it is not derived from your hardware.
Push tokens. Apple and Google issue these so we can reach your phone. Device tokens are stored encrypted with a separate key for each device. The per-activity update token Apple issues for each Live Activity is stored as issued and deleted with the activity.
Which platform your device is, iPhone or Android.
The activities you track and the notification groups you join. The content of an activity, such as an order status or a score, is written by the developer who sent it, not by us. We deliver it and store the latest version, encrypted, so the app can show it again.
Images shown in an activity are downloaded by your phone directly from the developer’s server or from our image host, so those hosts see your phone’s IP address the way any website you visit does.
Notification history is kept on your phone only. Nothing in it is sent to us.
Camera. Scanning a QR code uses the camera on your phone only. No image leaves the device.
Usage analytics. The iPhone app, the App Clip and the Android app include Microsoft Clarity, which records taps, screens viewed, app errors and general device information such as model, operating system version and screen size, so we can see how the apps are used and fix problems. Clarity is paused on the notification history screen so notification content is not recorded. It is the only third-party analytics anywhere in the product. Microsoft processes this data on our behalf and does not sell it or use it for advertising.

Visitors

This website and the dashboard use Microsoft Clarity, which records clicks, scrolling, pages viewed and general device information, and sets its own cookies, so we can see how the site is used and fix problems. There are no advertising cookies. Fonts and the loading animation are served from our own domain.
Your light or dark theme choice, the builder you last used, and anything you save in the builder live in your browser’s storage. Saved builder documents are not sent to us until you launch or send them.
If you ask the phone builder to email you a desktop link, we send that one email through Resend and do not keep your address.
The demo activities on the home page create an activity record on our servers, with nothing linking it to you unless you launch it on your phone.
Video and some demo images on this site are loaded from DigitalOcean and, on the pricing page, from Pexels. Your browser fetches them directly from those hosts.
The embed button and QR code a developer places on their own site set no cookies and store nothing about you, apart from your Apple or Android choice on the QR page, which stays in your browser. They tell our server which activity you opened, and the address of the website the button is on (the domain, not the full page). The app shows that website with the activity so you know where it came from.
When a request to our servers fails with a server error, the error log includes the IP address of that request.

How We Use It

To deliver activities and notifications to the phones they are meant for.
To run your account, your team and your billing.
To answer support requests and investigate problems or abuse.
To review the content developers send, as Apple and Google require. See Why We Can See Content below.
To keep the service secure, including rate limiting by IP address.
To understand aggregate usage. We look at counts and totals, not at anyone’s content.

We do not sell personal data. We do not share it with data brokers. We do not use it for advertising, and we do not profile you or track you across other apps or websites. We read activity and notification content only to review it for abuse, as described below, or when you ask us to look at something for you.

Content Sent by Developers

A developer decides what goes into an activity or notification, and we process that content on the developer’s behalf to deliver it. If you are an end user with a question about something an activity showed you, the developer who sent it is the right first contact. We ask developers to keep personal data out of activity content beyond what the activity needs. An activity is addressed by the link that launched it, and anyone holding that link can view the activity’s content, so a developer should put nothing in an activity they would not put in a link. If you would rather we removed something, email us and we will.

Why We Can See Content

Apple and Google require apps that show content from other people to review that content, remove harmful content and block the people who send it. If we could not do this, Apple or Google could remove our apps from their stores, and every developer's activities and notifications would stop working for everyone.

Our staff can see the content developers send: each activity’s latest card, every notification from the last 90 days, the links and images in them, how many phones each reached, and which account sent it. Content is encrypted when stored, and staff can decrypt it for this review.
We look at content to find phishing, scams and other abuse, and when someone reports it.
An account that breaks our Terms of Service can be suspended. We can also take its activities off the phones they reached and shut down its links and notification groups. Notifications already delivered cannot be recalled.

Who We Share It With

Nobody, apart from the services it takes to run the product and get an activity onto a phone. Each of them processes data only on our instructions.

Service	What it does for us	What it receives
Apple Push Notification service	Delivers activities and notifications to iPhones	Device push tokens and the content being delivered
Google Firebase Cloud Messaging	Delivers activities and notifications to Android phones	Device push tokens and the content being delivered
DigitalOcean	Hosts our servers, database and delivery queue in the United States	Everything we store
Cloudflare	Stores and serves uploaded images	Uploaded images
Stripe	Payments, invoices and card storage, as our payment processor and merchant of record	Team name, the team owner’s name and email, identifiers for your team and its owner, usage counts, and whatever you enter on Stripe’s own pages
Twilio	Checks and verifies phone numbers by text message	Your phone number
Resend	Sends account emails	Your email address and the contents of the email
Microsoft Clarity	Usage analytics in the mobile apps, this website and the dashboard	App and page interaction data and general device information
Google, Apple and GitHub	Sign-in, only when you choose that option	The sign-in identifiers exchanged during login

A push is a readable channel by nature. The content that reaches a phone passes through Apple’s or Google’s push service in readable form, the same as any push notification, so it is not encrypted in transit the way it is at rest.
When a developer sets no logo, the app shows the favicon of the developer’s website, fetched from Google’s favicon service. Your phone makes that request directly.
If we are legally required to hand something over, we will, and we will tell you unless we are barred from doing so.
If Eldrbreak LLC is acquired or merges with another company, your data may transfer with the service and stays under this policy.

How Long We Keep It

Data	Kept
Account, team, phone number and sign-in records	While your account exists. A session ends after 400 days without a visit.
Verification codes	Minutes. Codes expire after 5 to 10 minutes and are deleted when used.
Activities, push groups and their content	Until the end user removes them in the app, the developer deletes them, or the team is deleted. Ending an activity does not delete it.
Device identifiers and push tokens	Until the device is removed, or Apple or Google tells us a token is no longer valid.
Uploaded images	Until you delete them or the team is deleted.
Activity, notification and webhook logs, and the copy of each notification sent	90 days.
Billing records	Plan and subscription records stay for our accounting after a team is deleted. Stripe keeps its own records under its policy.
Backups	Encrypted database backups hold deleted records until each backup ages out. Activity content and device tokens are already encrypted inside them.

Security

All traffic to the site, the dashboard, the API and the apps is encrypted in transit.
Activity and notification content and device push tokens are encrypted at rest with AES-256-GCM. The key for each team’s content and each device’s tokens is derived separately, and the master key lives outside the database, so a copy of the database alone cannot be read.
Passwords are stored as salted hashes, and a password sign-in also needs a code emailed to you.
Content waiting to be delivered sits briefly in an in-memory queue in readable form, normally for under a minute, before it goes to Apple or Google.
Access to production systems is limited to the people who run the service. Our staff pages show account emails, phone numbers, plans and usage, and the content developers send, for the review described in Why We Can See Content. They never show passwords or card details.
No system is perfect. If something does go wrong we will tell affected accounts promptly.

Cookies and Browser Storage

One session cookie once you sign in. It is HttpOnly, sent only over HTTPS, and lasts up to 400 days from your last visit. A Google, Apple or GitHub sign-in also sets a cookie for the five minutes the sign-in takes.
Browser storage for your theme, your last-used builder, your saved builder documents and, on the QR page, your platform choice.
Microsoft Clarity sets analytics cookies on this website and the dashboard. There are no advertising cookies. The embed button sets no cookies on the site that hosts it.

Your Choices

Developers

Sign out from any page. Signing out ends that session, and resetting your password ends every other one.
Roll or revoke an API key, delete an uploaded image, remove a webhook or a team member, and delete a whole team from the dashboard. Deleting a team removes its activities, groups, logs, keys and uploads and cancels its subscription.
To change your name or phone number, get a copy of your data, or delete your account, email [email protected]. We complete verified requests within 30 days. Records we have to keep for accounting stay until the law lets them go.

End users

Remove any activity or leave any notification group from the app. Turning notifications off for a group tells our server to stop sending, not just the app to stop showing.
Clear All Data in the app resets it and gives it a new identifier. On Android this also erases the device record on our servers. On iPhone the old record stays until you ask us to remove it.
Email us to have a device, its tokens and its activities erased, or to have analytics data about your use of the app deleted. Include the device identifier shown in the app so we can find the right record.

Depending on where you live, you may have legal rights to access, correct, delete or port your personal data, to object to how it is processed, and to complain to a regulator. Email us to exercise any of them. We will not treat you differently for doing so.

Children

WebActivity is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us data, email us and we will delete it.

Where Data Is Processed

Our servers and database are hosted by DigitalOcean in the United States. If you use WebActivity from elsewhere, your data is transferred to and processed in the United States.

Changes to This Policy

We may update this policy as the service changes. The current version is always on this page with the date at the top, and if a change matters to you we will say so by email rather than expecting you to notice.

Contact

Eldrbreak LLC, [email protected]. A person will answer.