Workly

Legal

Privacy Policy

Last updated: October 9, 2026. This policy applies to the Workly web app, the Workly app for Android and the Workly app for iOS.

1.About Workly and this policy

Workly is a workplace app made by The Wolf Stack (Private) Limited (“TWS”, “we”, “us”), based in Multan, Pakistan (thewolfstack.tech). Organisations use it to manage attendance, team chat, tasks and boards, tickets, projects, finance, end-of-day reports, employee records and shared work credentials.

Workly accounts are created by your organisation's administrator; you can't sign up on your own. Your organisation decides which features you can use and which information is entered about you. This policy explains what information Workly collects, why, who it is shared with, and the choices you have.

2.Information we collect

Account and profile

Name, work email address, username, password (stored only as a one-way hash), profile picture, role and permissions, department, designation, work mode (onsite or remote), and account status.

Employment records (entered by your organisation)

Depending on what your organisation records: phone numbers, date of birth, gender, address, national identity card number (CNIC), bank name, bank account number and account holder name, and documents such as offer letters and non-disclosure agreements. These are visible only to people your organisation authorises.

Attendance

Check-in and check-out times, leave and attendance status, and the results of onsite location checks. See Location below for how your location is used.

Messages and files

Messages you send in direct messages, channels and threads, files and photos you attach, reactions, pinned messages, mentions, read markers (what you've read), and the channels and sections you belong to. While you use Workly, others can see whether you are online or away, and when you are typing.

Work you create

Workspaces, boards, tasks, comments and labels; tickets; projects and their payments; finance accounts, categories and transactions; subscriptions; portfolio items; and end-of-day reports.

Credentials vault

Work account credentials your organisation stores in Workly. Passwords and secrets are encrypted (AES-256-GCM) before they are saved.

Notifications and devices

Your notification history and preferences; for each phone or browser where you enable notifications, its push token or subscription, platform, a device name (such as “iPhone”) or, for browsers, the browser's user agent, and when it was last used.

Technical information

Like any online service, our servers process your IP address and basic request information to deliver the service and protect it from abuse (for example, rate limiting). We don't use it to identify or track you.

On your device

Your sign-in token is kept in your phone's secure storage (iOS Keychain, Android Keystore) or in your browser's local storage, with your theme preference and a cache of images and recent data so Workly loads quickly and the app can show what you last loaded when you're offline (never your vault credentials). Signing out removes your sign-in token and that saved data; uninstalling the app removes everything Workly stored on your phone.

Workly does not use advertising, does not include analytics or tracking tools, does not use your device's advertising identifier, and does not access your contacts, calendar, microphone or health data.

3.App permissions and why we need them

Workly asks for a permission only when a feature needs it, and you can change your mind at any time in your device or browser settings. Denying a permission only affects the feature it's for.

Location (precise and approximate)

Android: ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION · iOS: Location When In Use · Web: browser location

Why: To verify that you are at your office when you check in onsite for attendance.

Workly reads your location only at the moment you tap Check in for an onsite check-in. It is sent to our server once, compared with your office's location, and only the result (inside or outside the office area) is used. Your coordinates are not stored, are never collected in the background, and are never used to track you. You can deny or revoke this permission at any time; onsite check-ins can't be verified without it.

Notifications

Android 13+: POST_NOTIFICATIONS · iOS: Notifications (alerts, sounds, badges) · Web: browser notifications

Why: To tell you about new messages, mentions, task assignments, comments, due dates and other activity, and to show your unread count on the app icon.

Notifications are optional. You can turn them off entirely in your device or browser settings, or choose which kinds you receive, in-app and push, under Notification settings in Workly. Each phone and browser you enable receives a push token that we store with your account so we can deliver them; it is removed when you sign out.

Camera

iOS: Camera · Android: opens your phone's camera app (no camera permission is requested)

Why: To take a photo and send it in a chat, only when you choose to.

The camera is used only when you choose Camera while attaching something to a message. Workly never accesses the camera in the background, and only the photo you take and send is uploaded.

Photos, files and storage

iOS: Photo Library (and Add to Photos, for saving) · Android: the system photo picker and file picker; storage only on Android 9 and older, for saving · Web: your browser's file picker

Why: To attach photos, videos and documents to chat messages and other records, and to save a chat's photos and files to your phone when you tap Download.

You pick each file yourself. Workly only receives the files you select and send; it does not read, scan or upload anything else from your device. When you tap Download, photos and videos are saved to your gallery and other files to your Downloads folder (or, on iPhone, wherever you choose in Files); Workly asks for the permission to add to your photo library only then, and only writes the file you chose to save.

Internet and network state

Android: INTERNET, ACCESS_NETWORK_STATE

Why: To connect to Workly's servers, and to reconnect live updates when your network changes.

Used only to communicate with Workly's servers and our service providers listed below.

Background notification delivery

Android: Firebase Cloud Messaging (com.google.android.c2dm.permission.RECEIVE), WAKE_LOCK, VIBRATE · iOS: remote notifications background mode

Why: To receive notifications while Workly is closed, and to keep the unread count on the app icon correct.

These let the operating system deliver Workly's notifications to your device. They don't give Workly access to any other data on your device.

App icon badge

Android: launcher badge permissions (Samsung, Huawei, Honor, Xiaomi, Sony, HTC, Vivo and others)

Why: To show your number of unread notifications on Workly's app icon.

Used only to set that number; it gives Workly no access to other apps or data.

Local network

iOS: Local Network

Why: Used only by internal development builds that connect to a test server on the same network.

The released app connects only to Workly's servers over the internet and does not use your local network.

4.How we use information

  • To provide Workly's features to you and your organisation, and to sign you in securely.
  • To record attendance and verify onsite check-ins against your office location.
  • To deliver messages and files, and to send the notifications you've chosen to receive.
  • To enforce the roles and permissions your organisation sets.
  • To keep Workly secure, prevent abuse, fix problems and provide support.
  • To comply with legal obligations.

We do not sell your information, use it for advertising, or build profiles of you for any purpose outside Workly.

5.How information is shared

Within your organisation

People in your organisation see information according to their role and permissions: for example, members of a channel see its messages, anyone in your organisation can read public channels, and administrators can manage employee records and attendance.

Service providers

We use trusted providers that process data only to run Workly for us:
  • Cloud hosting for our servers and web app.
  • MongoDB Atlas, for our database.
  • Amazon Web Services (Amazon S3), for files and photos you upload.
  • Google Firebase Cloud Messaging and the Apple Push Notification service, to deliver notifications to phones, and your browser's push service for web notifications. A notification's title and a short preview (for example, the first part of a message) pass through these services to reach your device.

Legal reasons

We may disclose information if required by law, or to protect the rights, safety and security of our users, your organisation or the public.

6.How long we keep information

We keep your information for as long as your account is active and your organisation uses Workly. When a message, file or record is deleted it is removed from Workly, and when your account is deleted your personal information is deleted or anonymised, except where we must keep it to meet legal obligations, resolve disputes or enforce agreements. Copies in backups are removed as those backups expire. Location coordinates are never kept (see Location above).

7.How we protect information

  • All communication between the apps and our servers is encrypted in transit (HTTPS/TLS).
  • Passwords are stored only as one-way hashes, and vault credentials are encrypted (AES-256-GCM).
  • Access to information is limited by role-based permissions.
  • On phones, your sign-in token is kept in the operating system's secure storage.

No method of transmission or storage is completely secure, but we work to protect your information.

8.Your choices and rights

  • Permissions: allow or revoke location, notifications, camera and photos at any time in your device or browser settings.
  • Notifications: choose which notifications you get, in-app and push, in Workly's Notification settings, or mute individual conversations.
  • Access and correction: view your profile in Workly, and ask your administrator or us to correct information that's wrong.
  • Deletion: ask for your account and data to be deleted (see below).

Depending on where you live, you may have further rights under local law, such as to object to processing or to receive a copy of your data. Contact us to exercise them.

9.Deleting your account and data

Because Workly accounts are managed by your organisation, you can ask your organisation's Workly administrator to delete your account. You can also request deletion directly from us:

  1. Email abdullah@wolfstack.tech from your work email address, with the subject “Workly account deletion”.
  2. Tell us your name and your organisation.
  3. We confirm the request with you or your organisation, and complete it within 30 days.

Deleting your account deletes your profile, employment records, notification history and devices, and removes you from conversations. Messages you sent in shared conversations, and work records your organisation needs to keep (such as tasks, tickets or attendance history), may be kept by your organisation in anonymised form or as required by law. Uninstalling the app does not delete your account.

10.Children

Workly is a workplace tool for employees of organisations and is not intended for anyone under 16. We do not knowingly collect information from children.

11.International processing

Our service providers may process information in countries other than yours, such as the United States. We use providers that protect information in line with this policy.

12.Changes to this policy

We may update this policy as Workly changes. We'll change the “Last updated” date above, and tell you in the app or by other means if the changes are significant.

13.Contact us

Questions or requests about your privacy: abdullah@wolfstack.tech

The Wolf Stack (Private) Limited (TWS)
Multan, Pakistan
thewolfstack.tech

Back to Workly