WattarooBeta waitlist

Wattaroo Privacy Policy

Effective October 20, 2026. Wattaroo LLC, 30 N. Gould St, Sheridan, Wyoming 82801. Questions: hello@wattaroo.co

The short version

1. Who we are and what this covers

Wattaroo helps households read their energy bills, find programs they may qualify for, and fill in the forms. "We" means Wattaroo LLC. We are not a utility, a government agency or a law firm, and we are not affiliated with any of them.

This policy covers:

Some features are built but switched off, or not set up in every version. For each one this policy says what would happen if it is on. If you do not see a feature in your version (for example "Sign in" or photo reading), it is off for you.

2. What stays on your device

Most of what you give Wattaroo never leaves your device. We do not receive it, and we cannot read it. This includes:

Forms and letters are made on your device. We do not receive them. To email a form, the app opens your own mail app with a draft addressed to the program, and you press Send. A letter is copied or saved as a PDF, and you send it yourself. If you choose to send a Watch vote, your own mail app emails hello@wattaroo.co.

Clearing your browser data, erasing the app or deleting it removes this information. We cannot restore it, unless you turned on Backup (section 6).

3. Bills are read on your device

When you scan or upload a bill, your device reads the text. The web app reads PDF text in your browser. The iPhone app uses Apple's built-in text reader. The bill is not sent to us, and it is not sent to any AI service. We keep only what we need to fill in a form, and of an account number only the last four digits.

4. The website and the waitlist

If you join the waitlist at wattaroo.co, we store:

We do not ask for a utility password, your precise location, a photo or payment details.

The website sets no cookies. While you browse it keeps campaign labels in your browser's session storage until you close the tab.

Page statistics. Unless your browser sends Do Not Track or Global Privacy Control, the site records simple events: page view, button clicks, scroll depth, demo use, form start, form complete, an error category, whether the visit was on a phone or computer, and the campaign labels. These records have no email, no full address of the page, no persistent visitor ID and no IP address. We keep them 30 days.

Abuse protection. To limit repeat signups we keep a counter under a scrambled form of your IP address (a keyed hash with a secret we hold). It is deleted after about 24 hours and the address itself is not stored.

Email. Each email from us says who we are, includes our postal address and has a link that removes you. The link removes you as soon as you confirm. We send nothing else to the waitlist today.

Text messages. We text you only if you ticked the box that says so, and only about your beta access and app updates. Message frequency varies. Message and data rates may apply. Reply STOP to a text to stop them, or HELP for help. You can also email hello@wattaroo.co. Agreeing to texts is not a condition of joining the beta. We do not sell or share your phone number for anyone else's marketing. As of this writing we have not sent any texts.

Our web host and its email service process this information to run the site. Hosts normally keep request logs that include IP addresses. We have not confirmed how long ours keep them.

5. Photo reading (optional, and never for bills)

Some features read an appliance, or its nameplate label, from a photo. In versions where it is set up, it works like this:

6. Sign-in and Backup (optional)

Where your version offers it, you can sign in with Apple or Google to keep your applications, dates and bills if you clear your browser or change device. Signing in is never required.

If you sign in, we hold the account ID and the email address that Apple or Google shares. We ask Apple for the email address only. Google's sign-in may also pass along your name and profile picture. We do not use them, and if our sign-in service keeps them, deleting your account deletes them. If you turn on Backup, we also hold a copy of your Household file. It is locked with AES-256-GCM encryption on your device before it is sent. The key is made on your device and is never sent to us, so we cannot open your Backup. If you lose the key, we cannot get your Backup back for you.

What is inside the locked Backup: ZIP code, household size, whether you rent, your price per kWh, each bill's dates and amounts, kWh, the last four digits of the account number, the utility, any bill credit, shutoff-notice details, appliances (from our list; a name you typed is saved only as "Appliance"), your applications and their dates, the documents you said you have, your setup answers, and whether you allowed photo reading.

Never in Backup: your name, address, full account number, bill photos or PDFs, document photos, income, the names of people you share a bill with, who owns which appliance, the "someone at home" answer, call notes, signing records, language, or tip history.

If you say yes to reminders, we store up to 20 dates, each with a general kind (bill, window or deadline). We do not store the program, an amount or a title. We do not send reminder emails today.

On our servers each person can read only their own rows. Changes go through restricted functions.

7. "Help improve Wattaroo" (optional, off by default)

This is optional and off by default. Nothing is sent until you tap Turn on on the Help improve Wattaroo screen. That screen lists exactly what would be sent, and the See what we share screen shows the actual next upload before it goes.

If you turn it on, your device sends at most once a day (after a random wait of up to 24 hours, so the time says nothing about you):

It never sends your name, street address, phone, email, account number, bill pictures or bill text, ID or award-letter photos, room photos, exact dollars or kWh, your ZIP, apartment number, city or state, income, household size, who lives with you, call notes, signings, shutoff notices and dates, life-event answers, your IP address or your device model.

Who gets it: only our own database, run on Supabase. Nobody else receives these rows. We never sell or share them one row at a time. A separate switch, Research totals, lets your code count toward monthly totals. A total is shown only when at least 15 households are in it. We may share such totals with utilities, agencies, researchers and funders. A total of 15 or more is a product rule. It does not make anything anonymous, and we say "pseudonymous" for that reason.

Who could work out who you are: the quarter of the year the bill covers, the utility and the bill layout together can narrow things in a small area. That is why the rows carry no ZIP, no address and no name, and why we delete them after 180 days (bill facts after 90 days).

Counts can be made up by anyone who sends rows, so we do not treat small counts as exact.

Taking it back. Turn it off in Account at any time. Your device stops sending and asks us to delete every row for your code. The screen says "Deleting" until we confirm. If you delete the app first, the code is lost and the rows expire on the dates above. Counts that were already added into monthly totals carry no code, so they cannot be pulled back out. Turning it off does not change what you pay or the help you get.

8. Crash reports

When crash reporting is on in a released version, an error sends a report to Sentry so we can fix it. Before a report leaves your device the app strips it: it keeps only the error type, the screen name, the app version, the phone model and the iOS or browser version, and a trail of screen names. It drops error message text, user details, request details and extra data. If any text still looks personal (a long number, a dollar amount, an email, a street address, a file path or a large block of data), the report is not sent at all. Screenshots are never attached. Crash reports are off in test builds and in any build that has no Sentry address set.

A filter can miss something. Sentry may also see your IP address when it receives a report. We have not confirmed its retention period or storage region.

9. Other requests the app makes

The app downloads the current program list from wattaroo.co and a weather forecast from weather.gov for a fixed point in your borough. These requests carry no name, address or bill. Like any request, they show your device's IP address to those sites.

10. Who else handles data

We use these providers only to run Wattaroo. We do not sell your data and we do not share it for ads. We may share information when the law requires it, such as a valid court order, and we will tell you first unless the law forbids it. If Wattaroo LLC is ever sold or merged, we will tell you before your data moves, and the new owner must keep these promises or let you delete it.

11. How long we keep things, and how to delete them

We do not delete inactive accounts automatically.

Copies in our hosts' backups, delivered email and provider logs follow those providers' own schedules. We have not confirmed those schedules and do not promise a date.

Copy of your data. There is no export button yet. Forms and letters you make can be saved as PDFs. For a copy of anything we hold, email us.

12. Your rights

Everyone gets the same rights, wherever you live. You can ask us to:

Email hello@wattaroo.co from the address on the record (for the waitlist) or tell us your account email. We answer within 45 days, usually much sooner. You will not be treated worse for asking. If we say no, we will tell you why and how to appeal by replying to us. You can also contact your state attorney general. In New York that is ag.ny.gov.

State laws. California, Virginia, Colorado, Connecticut, Texas and other states give residents rights over their data. Most of these laws apply only to businesses above a size or a data-volume line. Wattaroo is small and, as far as we know, is below those lines. We give you the same rights anyway. For the purposes of those laws:

New York. New York's SHIELD Act requires reasonable safeguards for private information and notice after a breach. See sections 13 and 14.

13. Security

These are the measures that exist today. No system is perfect.

We have not had an outside security audit or certification, and we do not claim one.

14. If something goes wrong

If a breach affects your information, we will tell you without unreasonable delay and within 30 days of finding out. For New York residents we will also notify the Attorney General, the Department of State and the State Police, as New York General Business Law section 899-aa requires. We follow other states' notice laws for residents of those states.

15. Children

Wattaroo is for people 18 and older. It is not directed to children. We do not ask your age, and we do not knowingly collect information from anyone under 18. If you think a child has used Wattaroo, email us and we will delete what we hold.

16. Texts and calls

Wattaroo does not send text messages or make calls. If we ever add them, we will ask for your written permission first, and replying STOP will end them.

17. Changes

We will change this policy when our practices change. The date at the top shows the latest version. If a change matters, we will tell you in the app and on this page before it takes effect. If a change would collect more than you agreed to, we will ask again, and the optional settings stay off until you turn them on. Earlier versions are available on request.

18. Contact

Wattaroo LLC, 30 N. Gould St, Sheridan, Wyoming 82801 Email: hello@wattaroo.co