Privacy Policy

Our lead supervisory authority is Poland’s data protection authority. You can also complain to the authority in the EU country where you live or work, or where you think the problem happened.

• UODO - President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), Poland — our lead authority.
• CNPD - Comissão Nacional de Proteção de Dados, for example if you live or work in Portugal.

Account Information: When you sign in with Google, Apple or email, we collect your name, email address, and profile picture (if available). With Sign in with Apple you can hide your email address; we then receive a private relay address from Apple that forwards to your inbox.

Usage Data: We collect information about how you interact with the Service, including spots you track, forecast views, sessions you log, and preferences you configure. For our legitimate interest in operating the Service and supporting accounts (GDPR art. 6(1)(f)), authorised administrators can see account metadata, current feature-use totals, last active day, recent active-day counts and client families. When investigating a specific support issue, they can explicitly load relevant sign-in metadata, push registration details such as app version, locale and timezone, service acceptance records, or up to 14 days of activity by UTC day and client family. Diagnostic access is logged. Daily activity records used for aggregate retention reporting are kept for 400 days and deleted with the account. These views do not include chat text, session notes, GPS tracks, IP addresses, browser details or credentials, and do not link spot-page visits to your account. You may object to processing based on legitimate interest by contacting us.

Device Information: When you sign in, we store the IP address and the browser or app details (user agent) of each signed-in session, to keep you signed in and to spot sign-ins that are not yours. The iPhone app also sends a random identifier for its installation together with the app version and operating system, which we use to apply fair-use limits and to deliver the push notifications you turn on; it is not an advertising identifier. We also collect basic device and browser information to improve service performance and compatibility.

Support requests: When you contact us through the contact form on the website or in the app, we store your name, email address, your message and any files you attach, linked to your account if you are signed in, so we can answer you and keep the conversation.

Billing Information: If you purchase a Pro subscription, Paddle processes your payment details and may share limited billing records with us, such as customer identifiers, subscription status, plan, billing period, renewal or cancellation dates, price, currency, tax status, invoice links, and payment method summary. We do not receive or store full card numbers.

App Store purchases: If you buy Pro in the iPhone app, Apple processes the payment. Apple sends us only what we need to give you Pro, such as the product, transaction identifiers, purchase, renewal and expiry dates, subscription status and refunds. We never receive your payment details.

Location and activity data: Your location when you use a location feature and the GPS track of sessions you record on Apple Watch. Your heart rate stays on your devices and in Apple Health and is never sent to Wavind. See “Location, session recordings and Apple Health” below.

Location: The website and the iPhone and Apple Watch apps ask for your location only when you use a feature that needs it, such as finding the nearest spot or the forecast for where you are. We take a single position to answer that request and do not keep a history of where you have been. Your location is not tracked in the background, except while you record a session.

Session recordings: While you record a session on Apple Watch, the watch records a GPS track: your position, speed, direction of travel, altitude and the accuracy of each reading. When you stop, it uploads the track to your Wavind account, where we use it to detect your rides and waves and to show the session. A recording made while the watch is signed out stays on the watch until you choose to add it to a Wavind account.

Apple Health: The watch app records each session as a workout, which is what lets it keep tracking while your wrist is down, and saves that workout, its route and, if you allow it, your heart rate to Apple Health on your device. Your own workouts are the only thing Wavind writes to Health.

Heart rate: If you allow it in Apple’s Health permission, which the watch shows the first time you record, the watch reads your heart rate during a recording only to show it live on the watch and to save it with the workout in Apple Health. It stays on your devices and in Apple Health: it is never uploaded to Wavind, and we do not store or show it. If an older version of the watch app still sends heart rate with a recording, our servers remove it on arrival, before the recording is stored. The watch reads no other health data from Health and no earlier history. You can turn off Wavind’s Heart Rate access in the Health app at any time.

Legal basis: We use your location and session recordings to provide the features you ask for (GDPR art. 6(1)(b)). We do not keep or use your heart rate or any other health data, so we do not ask for consent to process it: reading heart rate on the watch and saving it in Apple Health happen only on your devices, under Apple’s Health permission, which you control in the Health app.

Who receives it: Your location and session recordings are never used for advertising or marketing, never sold and never shared with third parties. Only the infrastructure providers listed under “Third-Party Services” that host and store your data (Supabase, Railway and Cloudflare) process them, on our behalf. We share your heart rate with no one, because we do not keep it.

How long: We keep a recording until you delete the session or your account. Workouts saved to Apple Health, including their heart rate, stay there until you delete them in Health; they are stored by Apple, not by Wavind.

We use the following third-party services to operate the platform:

• Supabase - Authentication and database hosting
• Google OAuth - Sign-in authentication
• PostHog - Optional cookieless app journey analytics when enabled
• PostHog (Wavind mobile app) - Usage analytics in the mobile app: anonymous events that cannot be linked to each other or to you, with no identifier stored on your device; with your permission, also linked under a random identifier for that app installation, never to your account; you can withdraw that permission at any time in the app's Settings
• Better Stack - Cookieless error and performance (web vitals) monitoring; receives technical data such as error details, page timings, browser/device type, and IP address; also receives crash and error reports from the iPhone and Apple Watch apps, with the device model, operating system and app version, and the error’s stack trace, but never your location or health data
• Cloudflare R2 - Image and file storage
• Paddle - Merchant of record and payment processor for Pro subscriptions, including checkout, taxes, invoices, payment methods, fraud checks, subscription status, cancellations, and refund requests
• Apple - Sign in with Apple, App Store purchases of Pro in the iPhone app, and push notification delivery on Apple devices
• Expo - Sends push notifications to the iPhone app; receives the device’s push token and the notification text
• OpenAI - Runs the AI assistant and voice dictation, and drafts emails to listed businesses; receives what you send to the assistant. Also checks the notes you add to condition reports for abusive content before other riders can see them; receives only the note text
• Perplexity - Web search used to find schools, rentals and other businesses near spots
• Resend - Email delivery: sign-in codes, notifications, booking emails and emails to businesses
• Brevo - Email delivery: sign-in codes, notifications, booking emails and emails to businesses
• Railway - Hosting for the Wavind website, servers and background jobs
• Cloudflare - Network, security and caching in front of the website and app; sees technical request data such as your IP address
• Google Maps (Wavind Android app) - Shows maps in the Android app; receives technical data such as your IP address, device information and the map areas you view, under the Google Privacy Policy (policies.google.com/privacy)

These services have their own privacy policies governing how they handle your data.

What we collect: The business’s name, type, sports, town and website, the contact email and phone it publishes on its own website, its legal form and company tax ID, and short facts from its website, such as the services it offers.

Where it comes from: Public web search results and the business’s own public website. Contact details come only from the business’s own website, or from the business itself. We also check Portugal’s public marketing opposition list (DGC), only to make sure we never email a business on it.

Legal basis: Our legitimate interest (GDPR art. 6(1)(f)) in helping riders find local schools and other businesses, and helping those businesses reach riders. We keep this fair: we use only what the business itself publishes, send at most one email of each kind, and every listing can be removed in one click.

Is this personal data? Data about a company is mostly not personal data. Data about a sole trader, or about a person named as a contact, is — and this section covers it.

Who receives it: Listings are public on Wavind. Behind the scenes, only our processors: Perplexity (web search to find businesses), OpenAI (drafting emails), Resend and Brevo (email delivery), Supabase and Railway (database and hosting) and Cloudflare (network and photo storage).

Transfers outside the EU: Some of these providers are in the United States. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

How long: While the business is listed. If it asks to be removed or objects, we take the listing down and mark it as opted out, so it is never listed or contacted again. Ask us at [email protected] to delete the rest; we keep only the name and contact details needed to respect the objection.

Your rights: You can object at any time, free of charge: use the link in our email or the remove button on the page it opens. You can ask for access, correction or deletion at [email protected], and complain to a supervisory authority (see “Who is responsible for your data”).