Privacy policy

Wado helps applicants ask for recommendation letters and other outside materials, share files, and track what happens. Doing that requires handling some of your information. This page explains what we collect, why, and what we do with it, in plain language. If anything here is unclear, email support@request.usewado.com and we’ll explain it.

What changed in this version

The version before this one was written in June. It predates recommender accounts. Three things are different now:

• Recommender accounts are covered. This version says what we hold for a recommender who creates one, and what we hold for a recommender who doesn’t.
• Deletion is described per role. Applicants delete their account in settings. Recommenders email us, and the requests applicants sent them stay.
• Email collection is stated accurately. We keep every address on a recommender account, verified or not, including the one you sign up with.

What we collect

If you’re an applicant

• Account details: your name, email address, and password (your password is stored only as a secure hash, never saved in plain text).
• Application details you enter: program or opportunity names, organizations, deadlines.
• Request details: your recommender’s name, email, and relationship to you, your message, and submission instructions.
• Files you upload to share with recommenders, such as a resume, transcript, or personal statement.

If you’re a recommender

• Your name and email address, provided by the applicant who sent you a request.
• Your responses to that request: accepting, declining, or marking it completed.
• Any file you upload to complete a request, if the applicant chose the upload-back method.

You don’t need an account to respond to a request. Without one, we hold your contact details only as part of the request the applicant created. If you create a recommender account, we also hold your profile details (your name, and any title and institution you add) and every email address on the account: the one you sign up with, plus any you add later. We keep an address whether or not you verify it. Verifying is what lets us show you the requests sent to that address.

Automatically

• Product analytics (via PostHog) and performance data (via Vercel Analytics): pages visited, features used, and technical information like browser type. We use this to understand what’s working and fix what isn’t.
• Cookies needed to keep you logged in. Session cookies expire after one hour; refresh cookies after seven days.

What we use it for

• Running the product: creating requests, sending request and notification emails, storing files, showing statuses.
• Sending transactional email only: request links, status notifications, and reminders. We don’t send marketing email without separate, explicit consent.
• Keeping the product safe: rate limiting, abuse prevention, debugging.
• Improving the product, using aggregated analytics.

We do not sell your information. We do not show ads.

Who can see what

• Your recommender sees only the request you sent them: the application name, organization, deadline, your message, instructions, and files you attached to that request. Never your dashboard or other applications.
• You see your recommender’s responses and, for upload-back requests, the file they uploaded.
• Files are private by default. They’re accessible only through authorized, time-limited access tied to your account or the recommender’s request link. We never attach your files to emails.

Who helps us run Wado

We use a small set of service providers, each handling only what their job requires:

• Supabase: database and file storage.
• Resend: sending transactional email.
• Vercel and Render: hosting.
• PostHog: product analytics.

How long we keep things

We keep your data while your account is active. What deletion means depends on which kind of account you have.

If you’re an applicant

You can delete your account in settings. Your applications, requests, and files are deleted with it.

If you’re a recommender

There is no delete button in your settings. Email support@request.usewado.com and we’ll delete your account and the email addresses on it. The requests applicants sent you stay. They’re the applicant’s records, not yours, so deleting your account removes your account’s link to them rather than the requests themselves. The applicant’s copy of a request still shows the name and email they used to reach you. If you want your contact information taken off a request too, say so in the same email.

Your choices

• If you’re an applicant, you can view and edit your account details in settings.
• If you’re an applicant, you can delete your account in settings, which deletes your data as described above.
• If you’re a recommender, you can add and remove email addresses in settings, apart from the one you signed up with. Your name, title, and institution are not editable there today. To delete the account itself, email us.
• You can ask us what we hold about you, or ask us to correct or delete it, by emailing support@request.usewado.com.

Security

Your data is encrypted while it travels to and from us. Passwords are stored only as a secure hash, never in plain text. We check who you are before showing any file, and each recommender link opens only one request. No system is perfectly secure, but we treat your application materials as carefully as we’d want ours treated.

Children

Wado is not intended for children under 13. If you believe a child has created an account, contact us and we’ll remove it.

Changes

If we change this policy in a way that matters, we’ll update the date at the top and say what changed. We won’t quietly weaken it.

Questions? support@request.usewado.com. See also our terms of service.