Last updated: October 5, 2026

Privacy Policy

00Widget provides apps and an API service that let you publish structured state from apps, automations, and agents to native widgets, Live Activities, and device dashboards. The apps are available for iPhone, iPad, and Apple TV, and for Meta Quest headsets running Horizon OS. This policy covers all of them and the hosted API.

Information we collect and process

Depending on how you configure and use 00Widget, the hosted service collects and processes API tokens, tenant owner email addresses, device identifiers generated by the app, widget card data, Live Activity state, and action metadata that you or your connected systems submit. The apps for each platform add the platform-specific information described below.

Apple apps

The iPhone, iPad, and Apple TV apps also process Sign in with Apple administrator email addresses, Apple Push Notification service tokens, WidgetKit push tokens, and ActivityKit push tokens.

Meta Quest app

The Meta Quest app shows your widget cards and Live Activities as panels in your headset. It collects the following data when you sign in or buy a subscription, then processes it for the purposes described here:

Meta user ID. The app collects your app-scoped Meta user ID and a single-use sign-in proof from the Meta Horizon Platform SDK and sends them to our server. Our server verifies the proof with Meta and stores the user ID to link your headset to your 00Widget account. The ID is used to recognize your account across sessions and to verify subscription ownership.

Meta profile and age. The SDK response that supplies your user ID may also contain a Meta alias and profile image URL. 00Widget does not use those profile fields, send them to our server, or store them. The app does not call Meta's age category API or collect an age group. It does not request your Meta email address, friends, or followers.

Sign-in codes. Sign-in proofs and the codes used to approve a headset from your phone or a browser are stored only as hashes and expire after 10 minutes. If you link a headset to an existing account, the approval connects your Meta user ID to that account.

In-app purchases and subscriptions. If you buy a subscription through the Meta Horizon Store, the app checks which subscription products you own and sends your app-scoped Meta user ID and the purchased product ID to our server. Meta sends our server the subscription ID, product ID, active and trial status, billing period, renewal and cancellation dates, and current or next price and currency where available. We use these details to verify the purchase, grant subscription access, and keep that access current. Meta handles payment; we do not receive your payment card or billing address.

On the headset. The app stores its API credential and agent token encrypted, along with the server address, any sample cards you generate, and panel preferences. App data is excluded from device backups. Signing in to the headset with a different Meta account clears the stored credential. While a panel is open, the app asks our server for your current cards about once a minute; it makes no requests while no panel is open.

What the Meta Quest app does not collect. The app does not access the camera, passthrough, microphone, hand, eye, face, or body tracking, your play area or boundary, location, or contacts. It contains no analytics, advertising, or crash-reporting SDKs. Apart from internet access, it requests no device permissions.

Information you choose to display

Widget cards and Live Activities can appear on the Home Screen, Lock Screen, Dynamic Island, headset panels, and other supported device surfaces, and in screenshots, recordings, or casts made from those devices. Do not submit secrets, passwords, financial account numbers, sensitive personal data, or other information you would not want visible on those surfaces.

How we use information

We use the information described above to authenticate API requests and app sign-ins, link your devices to your account, store the current widget and Live Activity state for your tenant, deliver push notifications through Apple Push Notification service, keep App Store and Meta Horizon Store subscription status in sync, operate the administrator dashboard, troubleshoot service reliability, and protect the service from abuse. We do not use it for advertising or profiling.

Data sharing

00Widget does not sell personal information and does not use third-party advertising trackers. Data is shared with service providers only as needed to operate the apps and API: Cloudflare for hosting, storage, and edge execution; Apple for push notifications and Sign in with Apple; and Meta for verifying Meta Quest sign-ins, sending headset sign-in links to the Meta Horizon mobile app, and processing Meta Horizon Store purchases. Information that Meta and Apple hold about you is covered by their own privacy policies.

Retention

Widget cards, Live Activity records, API key records, push tokens, and tenant metadata are retained while needed to provide the service or until they are deleted, revoked, replaced, or no longer required for operation. API tokens are stored in hashed form by the service.

A Meta user ID stays linked to your account until you unlink the headset or delete the account. Meta Horizon Store subscription records are kept after an account is deleted, detached from it, so that a purchase can still be honored and reconciled with Meta. A record can also exist before the purchaser first signs in to the app.

Security

00Widget is designed to keep API tokens secret, store tenant API tokens hashed, scope API data by tenant, encrypt credentials stored on Meta Quest headsets, and use HTTPS for network communication. No internet service can be guaranteed to be completely secure, so avoid sending data that should never appear on a personal device or in operational logs.

Children

00Widget is not directed to children under 13, and we do not knowingly collect personal information from children.

Your choices

You can stop submitting data to the API, remove widgets from your devices, or revoke tenant API tokens from the administrator dashboard. On a Meta Quest headset, open Settings → Account and access → Delete account to delete your 00Widget account, its cards and Live Activities, API credentials, and the Meta user ID linked to that account. If your 00Widget account also uses Sign in with Apple, Settings offers Unlink this headset instead; this removes the linked Meta user ID while keeping the shared account. Uninstalling the Quest app removes data stored on the headset. Deleting a 00Widget account does not cancel a Meta Horizon Store subscription.

To request deletion of data we hold, including a retained Meta Horizon Store subscription record, or if you cannot access the app, email hello@00widget.com with “Data deletion request” in the subject. Tell us that you use 00Widget on Meta Quest and provide an account email if one is linked; do not send passwords or API tokens. We may ask you to verify ownership before deleting data associated with the account. If you use a self-hosted or separately operated 00Widget deployment, contact its operator to request deletion of data stored there.

Changes

We may update this policy as the app or service changes. The updated version will be posted at this URL with a new effective date.

Contact

For privacy questions or data deletion requests about the hosted 00Widget service, email hello@00widget.com. You can also contact the project maintainer through github.com/morais/00widget; do not post personal information in a public issue.