Privacy Policy

Your notes about your people are yours alone. They are never sold, never used for advertising, and never visible to the people they describe. Nothing syncs in from your email, your contacts, or social networks; the only personal content in Wavepal is what you type or upload yourself.

Account information. Your email address and a password (stored hashed, never in plain text).

Content you create. The people you add and everything you record about them: names, birthdays and key dates, notes, tags, contact details, locations, reminder rhythms, and your history of waves and reminders. This may include personal information about people other than you; see “Information about your people” below.

Images. Avatar photos you upload for people in your Wavepal. Uploaded avatars are stored on Amazon S3 and served from a URL that is technically reachable by anyone who has the exact link, so avoid uploading images you would not want accessible that way.

Billing information. Payments are processed by Stripe. Card numbers never touch our servers; we store only a Stripe customer identifier and which plan you are on.

Usage and diagnostics. We record product events (for example that an account created a person or sent a wave) tied to your account id, and performance and error diagnostics, to understand and improve the Service. The marketing site uses Plausible, a cookie-free analytics tool that collects no personal information.

Wavepal exists so you can remember things about friends and family. That information is private to your account. We do not contact the people you add, do not notify them that they are in your Wavepal, do not build profiles of them across accounts, and do not use their information for anything except showing it back to you. You are responsible for using the Service lawfully with respect to information about others.

We use the information above to provide and improve the Service: delivering nudges and reminders, sending transactional email (password resets, receipts, notification emails you have enabled), processing payments, fixing bugs, and understanding which features matter. We do not sell personal information and we do not use your content for advertising. We do not use your notes to train AI models.

We share data with a small set of processors, only as needed to run the Service: Fly.io (application hosting, United States), Amazon Web Services (file storage), Postmark (transactional email), Knock (notification delivery and preferences), Stripe (payments), Mixpanel (product analytics), AppSignal (error and performance monitoring), Google (location autocomplete queries when you type a location), and Vercel with Plausible (marketing site hosting and cookie-free analytics). Each provider receives only what it needs for its function.

You can request a copy of your data or deletion of your account and all associated data by emailing privacy@wavepal.app from your registered address. We verify identity before acting. Deletion removes your data from our database and instructs each service provider above to erase what it holds for you; some providers (for example analytics) may take several days to complete erasure on their side. These rights are available to everyone, not only where laws such as the CCPA require them.

We keep your data while your account is active. When your account is deleted, your data is purged as described above. Routine encrypted backups age out on a fixed schedule.

Data is encrypted in transit, passwords are hashed, and access to production systems is restricted. No online service can promise perfect security, and we do not, but we treat your notes with the care we would want for our own.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them.

If we make material changes, we will update the effective date above and, for significant changes, notify you by email or in the app before they take effect.

80bit, Inc. · privacy@wavepal.app for privacy matters, hello@wavepal.app for everything else.