Security & Privacy

No. Your passwords and identity details are encrypted on your device using zero-knowledge encryption before reaching our servers. We mathematically cannot decrypt your data - only you hold the keys. No one at WIGGWIGG can see your passwords.

Even in the unlikely event of a breach, your passwords and identity data remain protected. They're encrypted with keys only you control, so attackers would only get encrypted gibberish. We also use industry-standard security practices to prevent breaches in the first place.

WIGGWIGG combines zero-knowledge password management with Canadian phone numbers and complete identity management. You can organize passwords by identity (work, personal, business) and each identity can have its own phone number. It's a privacy-first digital identity platform.

Zero-knowledge encryption means your data is encrypted on your device before it's sent to our servers, using keys derived from your master password. We never see your master password or encryption keys. This is the same approach used by security-focused services like 1Password and Bitwarden.

We minimize what we collect from communications. We choose to perform certain safety checks, including spam filtering and detection of known illegal content, in memory at receive time. Preservation or reporting duties can apply if review confirms the content is illegal. Under our current method, message content is sealed on Canadian servers to the account communication key, which a supported client opens after sign-in and unlock. Voicemail audio is sealed the same way when Listen-by-phone is off and a usable account communication key resolves. For a communication sealed this way, we keep no key that can read it. A small set retained from the private beta remains readable under our older server-side encryption until a separate re-sealing process. A few exceptions stay readable by our servers, and we name them: voicemail while Listen-by-phone is on or when the account has no usable communication key, the other party's number in a call log when the account has no usable key or key lookup fails, the intros your callers record, automatic-reply text, the text and audio of your voicemail greeting, of the announcement we play to you on pickup, and of the prompt your callers hear before they identify themselves. We never record your calls. A call-recording add-on is on the roadmap; if it ships, recordings will be sealed to you like voicemail. For end-to-end encryption between sender and receiver (we never see plaintext at all, even in transit), use Signal with your WIGGWIGG phone number.

Your encrypted identity data is stored in Canada, subject to Canadian privacy laws (PIPEDA). VoIP communications are transmitted through Telnyx (US-based, SOC 2 Type II compliant). Remember: your identity data is encrypted on your device first, so location matters less when the data is unreadable anyway.