← Back to home

Privacy Policy

Last updated: 15 March 2026

Wavara is a weight tracking app that shows how your weight relates to your menstrual cycle. This policy explains what data the app handles, where it goes, and what choices you have.

Waitlist

If you sign up on our website before the app launches, we collect your email address so we can notify you when Wavara is ready. This email is stored securely in Supabase, a cloud database provider hosted in the EU. We use it only to send you a launch notification — we will not send marketing emails or share it with third parties. You can ask us to remove your email at any time by contacting admin@wavara.app.

Health data is local-first

When you use Wavara, you can enter:

  • Your name (optional, for the greeting on the home screen)
  • Weight entries
  • Period start and end dates
  • Your typical cycle length

By default, this health data is stored locally on your device in a SQLite database and is not transmitted over the internet.

You may choose to enable cloud sync to back up your data and access it across devices. Cloud sync is entirely opt-in — it is off by default, and you can turn it off at any time. If you keep cloud sync disabled, no health data ever leaves your phone.

If you uninstall the app or lose your device without cloud sync enabled, your data will be lost. This is by design — we only store your data where you tell us to.

Usage Analytics

Wavara includes optional, anonymous usage analytics to help us understand which features are useful and where the app can improve. Analytics are completely separate from your health data and require your explicit consent.

How consent works

After you finish onboarding, the app asks whether you would like to share anonymous usage data. You can choose "Help improve Wavara" or "No thanks." If you decline, no analytics data is ever collected or transmitted.

You can change your mind at any time: go to Settings > Privacy > Analytics and toggle the switch. Turning analytics off takes effect immediately — the analytics SDK is disabled and no further events are sent. Turning it back on resumes anonymous event collection from that point forward.

What IS collected (if you consent)

All analytics events are anonymous and contain no health data. The categories of information collected are:

  • Session information — that the app was opened or backgrounded, session duration, and how many screens were viewed during a session
  • Onboarding funnel — which onboarding steps were completed, skipped, or where the flow was abandoned, and time spent on each step
  • Feature usage — which tabs you view, chart interactions (tap, drag, range changes), settings changes, export actions, and whether you opened the phase guide
  • First-activation milestones — that you logged your first weight entry or first period entry (not the values themselves), and time elapsed since install
  • General context — your chosen weight unit (kg or lbs), cycle length bucket (short/average/long/very long — not the actual number), device platform, OS version, and app version

What is NEVER collected

  • Your weight values
  • Your period dates
  • Your cycle length (only a general bucket like "average" or "long")
  • Your name or any personally identifiable information
  • Device identifiers that could identify you personally
  • Location data
  • Any other health or medical information

To be explicit: if you log a weight of 65.4 kg on 11 March, the analytics event records only that a weight was logged, whether it had a decimal, and what day of the week it was. The number 65.4 and the date 11 March are never transmitted.

Third-party processor

Analytics data is processed by PostHog, a product analytics platform. PostHog is configured to use their EU data centre in Frankfurt, Germany. No analytics data is routed through or stored in the United States.

PostHog's privacy policy is available at: https://posthog.com/privacy

PostHog acts as a data processor on our behalf. We do not sell, share, or provide analytics data to any other third party.

Data retention

Anonymous analytics data is retained for 24 months from the date of collection, after which it is deleted. You can stop contributing new data at any time by turning off the analytics toggle in Settings.

Consent withdrawal

To withdraw your consent for analytics at any time:

  1. Open Wavara
  2. Go to Settings > Privacy > Analytics
  3. Turn off the analytics toggle

This takes immediate effect. The PostHog SDK is disabled, no further events are queued or transmitted, and no new data is collected. Previously collected anonymous data remains on PostHog's servers until the retention period expires, but since the data is anonymous, it cannot be linked back to you or your device.

Third parties

Apart from PostHog (described above, and only if you consent to analytics), we do not share your data with anyone. No advertisers, no other analytics providers, no third-party SDKs that transmit your data.

Health data under data protection law

Period dates and cycle information count as health data under UK and EU data protection law (GDPR Article 9, special category data). By default, all health data is processed locally on your device and is not transmitted. If you enable cloud sync, your health data is encrypted and transmitted only to provide the backup service. The optional analytics described above are designed specifically to exclude all health data regardless of your sync settings.

Your rights

You can:

  • See your data — all your health data is visible in the app
  • Export it — Settings has CSV and JSON export options for your health data
  • Delete it — "Delete All Data" in Settings removes all health data permanently from your device
  • Control analytics — consent to or withdraw from anonymous analytics at any time via Settings > Privacy > Analytics

These features exist in the app today. You do not need to email us or file a request.

Under GDPR and UK data protection law, you also have the right to lodge a complaint with your local data protection authority if you believe your data has been handled improperly.

Children

Wavara is not designed for children under 13. We do not knowingly collect data from anyone under 13.

Changes to this policy

If we update this policy, we will change the date at the top and note what changed. For anything significant (like adding cloud features or changing what analytics collects), we will let you know in the app before it takes effect.

Contact

Questions about your privacy? Email admin@wavara.app.