Privacy Policy

Last updated: 22 July 2026

Welcome

WavyWays is a gentle wellness companion for building a kinder relationship with food and your body. To be that companion, you trust us with some quiet, personal things — how you're feeling, what you ate, a few private words you write down for yourself. We don't take that lightly.

Everything we do here has one purpose: to give you a calmer, kinder WavyWays experience. So we want to be plain with you about a few principles that guide how we handle your data:

• Your private writing is yours. Your mood, your food notes, and your diary live in your account, stored for you so you can look back on your own journey.
• We never sell your data, and we never share it with advertisers. There are no ads in WavyWays.
• We never use the content of your logs to advertise to you, to profile you, or to train AI models.
• We collect only what we need to run the app and gently improve it, and we're honest about what that is.

This policy explains, plainly, what we collect, why, who we work with, and the choices and rights you have. It covers the WavyWays mobile app and the services inside it. It doesn't cover any third-party service you reach through the app — for example, your app store — which has its own separate privacy policy.

A note on what WavyWays is. WavyWays is a general wellness and self-help app, not a medical device or a medical service. It does not diagnose, treat, or cure any condition. This policy is about how we handle your data; how the app itself works is covered by our Terms of Service.

Information We Collect or Store

We collect only what we need to be your companion. Here's each kind, in plain terms.

Sign-in and account information. You can sign in with your email, with Google, or with Apple — whichever you prefer. However you choose, we create an account for you and receive the basics to set it up: your email address, and — if you sign in with Google or Apple — your name and basic profile information. Each account has its own unique user ID.

Your private logs — the personal heart of the app. When you use WavyWays to reflect and track, we store only what you choose to record: your food logs (meals, where you were, who you were with, and any photos you upload), your mood logs (a mood category and how strongly you felt it), and your diary entries — the free-text words you write yourself. Your diary is the most personal thing here; it can hold anything you put into it, including health information and private thoughts. All of this lives in private areas of your account. It is yours.

Questionnaire answers. If you answer the in-app onboarding questionnaire, we store your responses so we can shape a gentler experience for you.

Profile and progress. We store the things that make the journey yours — such as your username, goals, avatar, streaks, achievements, and your Pearls balance — so the app can remember where you are and pick up where you left off.

App activity and diagnostics (collected automatically). To keep WavyWays running smoothly and fix problems, our analytics and error tools gather basic information about how the app runs — the app version, your general device type and operating-system version, crash and error diagnostics, and a pseudonymous identifier used only to count usage in aggregate (never linked to your name in our analytics). If you turn on notifications, we also store a push notification token so we can send gentle reminders, like a daily-task nudge or a note before your trial ends.

Subscription and trial status. We keep a record of whether you have an active subscription and your trial end date. These are set by our servers, not edited by you.

Information We Do NOT Collect

We want to be just as clear about what we never gather. This matters to us, and we hope it reassures you.

Passwords. However you sign in — with email, Google, or Apple — your password is handled securely by the authentication provider, in encrypted form. WavyWays never sees or stores your password.

Financial or card information. When you subscribe, payment is handled entirely by the Apple App Store or Google Play. WavyWays never collects or stores your card number or billing details.

Your location. We do not collect your GPS or precise location, and we do not track where you are.

The content of your logs — never sent to analytics. Your mood category, mood intensity, meal type, whether a photo was attached, and the words in your diary are never transmitted to our analytics tool. That content stays only in your private account records. We also do not use the content of your logs to train AI models.

How We Use Your Information

We use your data only for the purposes below, and — where the GDPR / UK GDPR applies — only where we have a lawful reason to.

• To deliver the service you asked for — create and run your account, and save and show back your profile, progress, and Pearls. This is necessary to provide the service (our contract with you).
• To be your reflective, personal companion — store and show back your mood, food, and diary logs. We do this with your explicit consent — it's essential; without it we can't hold this content for you.
• To make the experience feel handcrafted for you — personalize your journey, such as which tasks appear next. To provide the service, and — for anything health-adjacent — with your consent.
• To help you keep your rhythm — send push notifications like daily reminders and trial nudges. With your consent (the notification permission you grant).
• To run the paid service safely and fairly — manage your subscription and trial and prevent fraud or abuse. To provide the service, and in our legitimate interest in keeping it secure and sustainable.
• To keep the app working and gently improve it — understand aggregate, non-content usage and fix errors through privacy-reduced analytics. With your consent where required, and/or in our legitimate interest in improving the app.
• To keep the service secure — diagnose crashes and errors and protect you and the app. In our legitimate interest in a safe, reliable service.

What our analytics actually receives (and doesn't). We use analytics to understand, in aggregate, how the app is used and where it breaks — so we can fix problems. Our analytics is deliberately privacy-reduced. It receives only a pseudonymous identifier (not your name or diary), non-content engagement events — for example, that a food log or a mood log happened, that an onboarding step was completed, or that an error occurred, without the content — and standard measures like days since you installed the app, a bucketed (rough range, not exact) measure of days since your last log, and whether your account is free or premium. It does not receive your mood category or intensity, your meal type or whether a photo was attached, or the words in your diary.

What we never do with your data. We do not sell your data or share it with advertisers. WavyWays shows no third-party ads. We do not share your personal information for cross-context behavioral advertising (this is also the meaning of “do not sell/share” under the CCPA/CPRA), and we do not use your diary, mood, or food content to train AI models or for any purpose beyond running the app — unless we ask you separately and you say yes.

A Special Word About Your Sensitive Information

Some of what you record here — your mood, your food logs, your diary entries, and the simple fact that you're using an app in the food-and-body space — is deeply personal. Under laws like the GDPR and UK GDPR, this may count as special-category (health) data; under the CCPA/CPRA it may be sensitive personal information.

We want you to feel safe writing it down. So, plainly: we process this data only to be your companion — to save your reflections and show them back to you — on the basis of your explicit consent. We never sell it, never share it for advertising, never use it to advertise to you or profile you, and never use it to train AI models. Its content stays private to your account and is never sent to our analytics tool. And you stay in control: you choose whether to record it, and you can withdraw your consent and delete it at any time (see “Your Rights” and “Data Retention and User Controls”).

Sharing of Information

We don't sell, rent, or lease your personal information, and we never share it for third-party or cross-context advertising. To run the app, we rely on a small set of trusted service providers. They act on our instructions and are required to protect your data. Here's who they are and what each one does:

• Google (Firebase) — provides the secure cloud infrastructure that powers WavyWays: sign-in, the database that holds your account and private logs, storage for your uploaded photos, push notifications, and our privacy-reduced analytics.
• Our subscription provider — records whether your subscription or trial is active, so the app knows your access. It does not receive your mood, food, or diary content.
• Apple App Store & Google Play — handle your payment and billing when you subscribe. Your card and billing details stay with them; we never see or store them.

We may also disclose data if the law requires it, or where genuinely necessary to protect the rights and safety of our users or others. If our business is ever reorganized (for example, a merger or transfer), your data may move with it under this same policy.

How We Protect Your Data

We take reasonable, industry-standard steps to protect your data:

• Your data is encrypted in transit between your device and our providers, and encrypted at rest on the infrastructure that stores it.
• Your account records and private logs are held under owner-only database rules, so they can be read and written only by you — not by other users.
• Certain fields, such as your subscription and premium status, can be set only by our servers, never by a device or another user.

No app can promise perfect security, and we don't claim protections we haven't actually put in place. We continue to improve our security posture before and after launch.

Your Rights

You have rights over your personal data. Depending on where you live, different laws apply, but we aim to honor these rights for everyone where we reasonably can.

If the GDPR / UK GDPR applies to you (EEA / UK)

You have the right to:

• Access — get a copy of the personal data we hold about you, in a portable, machine-readable format (data portability);
• Rectification — correct data that is inaccurate or incomplete;
• Erasure — have your data deleted (“the right to be forgotten”);
• Restriction — ask us to pause certain processing;
• Object — object to processing based on our legitimate interests;
• Withdraw consent — at any time, where we relied on your consent (this doesn't affect processing already carried out lawfully before you withdrew);
• Lodge a complaint — with your local data-protection supervisory authority (for example, your national authority in the EEA, or the ICO in the UK).

We handle these requests manually through our privacy contact. To make a request other than the in-app account deletion described below, email contact@wavyways.care. We'll take reasonable steps to verify it's really you, and we'll respond within the statutory timeframe (generally one month under the GDPR/UK GDPR, extendable where permitted). There's no charge for a reasonable request.

California Residents' Rights (CCPA / CPRA)

If you're a California resident, you have the right to:

• Know — what personal information we collect, use, and disclose;
• Delete — request deletion of your personal information;
• Correct — request correction of inaccurate personal information;
• Opt out of the sale or sharing of personal information — and please note that we do not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of;
• Limit the use of Sensitive Personal Information — your mental-wellness data (mood, food, and diary logs) is Sensitive Personal Information, and we already use it only to provide the service. We never use it for advertising or profiling.
• Non-discrimination — you will never receive lesser service or pricing for exercising your privacy rights.

To exercise these rights, email contact@wavyways.care. We'll verify your request and respond within the timeframe the law requires (generally 45 days under the CCPA/CPRA, extendable once). You may use an authorized agent to make a request on your behalf.

We do not use your data to make automated decisions that produce legal or similarly significant effects about you. The app personalizes your journey (such as which tasks appear next), but this does not make consequential decisions about you.

For any privacy question or request, reach us at contact@wavyways.care.

International Users and Cross-Border Data Transfer

Because our infrastructure providers operate internationally, your data may be stored and processed in other countries, including the United States. When your data is transferred out of your region, we rely on legally recognized safeguards — such as the European Commission's Standard Contractual Clauses and the UK's equivalent — to keep it protected.

Data Retention and User Controls

We keep your data only as long as we need it. Here's how long, by category:

• Account and profile data — kept while your account is active, so the app can remember your journey, and deleted when you delete your account.
• Your self-tracked content (mood, food, diary, questionnaire answers, uploaded photos) — kept until you delete it or delete your account. If an account stays inactive for 24–36 months, we may delete it and its data, and we'll email you a warning first.
• Anonymous, aggregate analytics — kept indefinitely in a form that is not tied to you.

Some limited records may be kept longer where the law requires it (for example, for tax, legal, or fraud-prevention reasons).

User Controls

You stay in control of your data:

• Notifications — turn email and push reminders off at any time in your device or app settings.
• Delete your account — right inside the app: Settings → Delete account. This permanently removes your user-owned data — your account records and your uploaded meal photos — within 30 days, and severs the association between that data and any analytics identifier. The only things not removed are anonymous aggregate analytics (which are no longer tied to you) and any records the law requires us to keep.

Data Breach Notification

We hope it never happens, but if a data breach occurs that affects your personal information, we will notify you without undue delay — and, where the breach is likely to result in a high risk to your rights, within 72 hours of confirming it, as data-protection law requires. We'll reach you by email and in the app, and explain in plain terms what happened, what data was affected, and what you can do to protect yourself. Where the law requires it, we will also notify the relevant authorities.

Children and Teens

WavyWays is intended for people aged 16 and over. It is not directed to anyone under 16, and we do not knowingly collect personal data from anyone under 16. If we become aware that we have, we will delete it promptly.

Because our subject matter and data are sensitive, this minimum age also helps protect younger users under laws such as the US COPPA and the UK Children's Code (Age Appropriate Design Code), and keeps our consent basis for health-adjacent data clean. If a future version of WavyWays permits younger users, we will add the additional safeguards those laws require before doing so.

Updates to this Policy

We may update this policy as the app grows or the law changes. If we make a significant change, we'll let you know in the app or by another reasonable means. Please check back now and then.

Contact

Questions, requests, or concerns? Email contact@wavyways.care.

← Back to WavyWays