Privacy policy
WStation · wstation.app
This says what WStation holds about you and your business, where it is kept, who else can see it, how long it is kept, and how to get it back or have it deleted. It applies to the WStation application at wstation.app and to nothing else.
Who this is about
WStation is a tool for keeping the records of a small business: customers, quotations, invoices, bookings, stock, income and expenses. You are the person using it. The business records you enter belong to you, and this policy is a description of how they are looked after — not a claim on them.
What is collected
- Your account. Your name and your email address. If you sign in with a password, only a cryptographic hash of it is stored — never the password itself. If you sign in with Google, see the section below.
- Your business records. Everything you type in: customers and their contact details, products, quotations, invoices, receipts, bookings, expenses, the names you file money under, and any files you upload.
- Sessions. A record that you are signed in, so you are not asked again on every screen. It expires on its own after thirty days.
- Failed sign-in attempts. Your email address and the network address it was attempted from, kept briefly so that repeated guessing at a password can be slowed down.
There is no advertising network, and nothing you enter is sold, rented, or used to advertise to you or to anybody else. There is one third-party script: Google Analytics, described next.
Google Analytics
This site loads Google Analytics (measurement id G-HRTX1TMPV3) on every page, and it starts on the first page load rather than after asking. It tells Google which pages were opened, roughly which part of the world the visit came from, and what device and browser was used, and it sets the two cookies named on the cookies page. It is there so we can see which parts of the product people actually use.
What it does not send is anything you keep here: no customer, invoice, quotation, booking, expense or business record, and no email address or password, is passed to Google. If you would rather not be counted, a browser or extension that blocks analytics scripts will stop it, and the site works exactly the same with it blocked.
Signing in with Google
If you choose Google sign-in, WStation receives three things from Google: your email address, your name, and your profile picture. Nothing else. No contacts, no calendar, no files, no Gmail.
They are used for one purpose: to create your account and to show who is signed in. They are never sold, never shared with anyone else, and never used for advertising. WStation's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect WStation from your Google account at any time at myaccount.google.com/permissions. Doing so stops you signing in that way; to remove the account itself, see having it deleted below.
Using Google sign-in is optional. An email address and a password does the same job, and no Google data is involved at all.
How it is used
Only to run the service you are using it for:
- to sign you in and keep you signed in;
- to store, show and total the records you enter;
- to produce the documents you ask for — quotations, invoices, receipts, reports;
- to keep one business's records apart from another's.
It is not used to profile you, score you, train anything, or market to you.
Where it is kept
Records are stored in Cloudflare D1, and uploaded files in Cloudflare R2, both scoped to the business they belong to. Cloudflare processes this data on behalf of the service in order to store and serve it, and is the only third party that ever holds your records — Google Analytics measures visits to the site and is never sent any of them. Everything travels over HTTPS.
Trying it without an account
If you use WStation without signing in, nothing you enter leaves your browser. It is held in that browser's local storage and is never sent anywhere. Clearing your browsing data clears it. Signing in afterwards offers to bring that work across, and you are free to refuse.
Who else can see it
Anyone you invite into a business can see that business's records, at the level of access you gave them. An owner or admin can see and change everything in it, including the money. That is the whole of the sharing: your records are not passed to anyone else, except where the law requires it.
How long it is kept
As long as you keep it. Records you delete are deleted. Deleting a business deletes the records belonging to it. Sessions expire after thirty days. Failed sign-in records are discarded within the hour.
Getting it back, or having it deleted
Settings has an export that takes a copy of everything in a business, in a form you can keep or move elsewhere. You can delete any individual record from the screen it appears on.
To have your account and everything under it removed entirely, write to outdoorscommerce@outlook.com from the address on the account. It is deleted, not archived.
Cookies
Three that are strictly necessary to sign you in, two set by Google Analytics that are not, plus a few things remembered in your browser. There is no advertising cookie of any kind. Every single one is named on the cookies page.
Children
WStation is a tool for running a business and is not intended for children. Accounts are not knowingly created for anyone under 18.
Changes
If this policy changes in a way that matters, it will be said in the app rather than altered quietly. The date below is when it was last reviewed.
Asking about any of this
WStation is built and operated by Outdoors Commerce, a web development studio in Windhoek, Namibia.
- Email outdoorscommerce@outlook.com
- Telephone +264 85 282 8822
- Windhoek, Namibia
Last reviewed 20 September 2026.