Privacy

Privacy Policy

Last updated: October 11, 2026

The short version

We collect what you log so we can show it back to you. We never sell it. You can export it, share it read-only, and ask us to delete it.

1. What we collect

Account details: your email address and the profile and targets you set.
What you log: food, portions, workouts, weight and body measurements, supplements, water, notes, and health events or injuries you choose to record.
Data from devices you connect: for example steps, sleep, heart rate and weight from Health Connect or a smart scale, only for the categories you approve.
Basic technical data needed to run the service, such as sign-in sessions and error logs.
Invite requests: if you ask for an invite on our website we save your name, email and the reason you give, plus your IP address, approximate location (city level, worked out from the IP address), time zone, language, screen size, browser, operating system and device type, and the page you came from. We use this to review requests, prevent spam and abuse, and reply to you. It is visible only to us and our service providers (Supabase for storage, Postmark for the notification email). We keep it while we review requests and delete it on request: write to admin@wovelin.net.

2. Consumer health data

Most of what you log is health information. Under Washington's My Health My Data Act, Nevada's consumer health data law and similar laws, this is "consumer health data". We collect it only to provide the features you use (logging, scores, trends, reports and sync). We do not use it for advertising, and we will not share it with anyone beyond the service providers listed below without your separate, explicit consent.

3. How we use it

To show your logs, scores, trends and reports; to sync between your phone and the web; to calculate estimates such as your real calorie burn; and to keep the service secure and working.

People you choose: family members you share with can view your log read-only. You can revoke this at any time.
Service providers that run Wovelin for us: hosting and database (Supabase, Vercel) and email delivery (Postmark).
AI helper (Anthropic): when you type food, workout or weight into the smart box and press Add, the words you typed are sent to our AI provider (Anthropic, Claude) to turn them into log entries. The helper is on by default; you can turn it off any time in Settings. We keep a record of each request (the text, the result, its cost and whether you accepted it) to enforce usage limits and improve accuracy, and it is deleted with your account.
Website analytics, only if you say yes: Microsoft Clarity and Google Analytics, to see which pages and buttons people use (see section 9).
We never sell your data, we don't use advertising pixels, and we never send your logged food, weight or health numbers to analytics.

5. Your choices and rights

You can view and edit your entries, export your data, stop sharing, disconnect devices, and delete your account and data yourself (Settings, then Privacy, then Delete my account; steps at wovelin.net/delete-account.html) or by asking us. Depending on where you live, you may have extra rights, such as access, correction, deletion, and withdrawing consent. Contact us at admin@wovelin.net and we'll respond within the time the law requires.

6. Security

Your data is sent over encrypted connections and protected by account-level access rules, so each person can see only their own data and data shared with them. No system is perfectly secure. If a breach affects your data, we will notify you as the law requires.

7. HIPAA

Wovelin is a consumer app that you use for yourself. It is not a doctor, hospital or health insurer, so it isn't covered by HIPAA. We still treat your health data as sensitive, as described above.

8. Children

Wovelin is not intended for children under 13, and we don't knowingly collect their data.

9. Website analytics, cookies and tracking

Analytics only with your permission: the first time you visit, we ask whether you're happy for us to use Microsoft Clarity and Google Analytics. If you tap "No thanks", or your browser sends a Global Privacy Control or Do Not Track signal, neither is loaded. If you tap "Allow", they set their own cookies and record which pages you open, where you click and scroll, your browser and device type, and approximate location (from your IP address). We use this only to make Wovelin easier to use.

Inside your dashboard we protect your health data: the whole screen is masked for Clarity, so it sees layout, clicks and scrolling but never the food, weights or numbers you log; typed entries are always masked; and Google Analytics only receives the name of the page (for example "Food"), never what is on it. We never send your name, email or account id to either service. Microsoft and Google process this data under their own privacy terms. Google Signals and ad personalisation are switched off.

Changing your mind: clear this site's data in your browser to be asked again, or write to admin@wovelin.net.

Cookies and browser storage: apart from the analytics cookies above (only if you allow them), we set no cookies. When you sign in, the dashboard and app store a few things on your device that they need to work: your sign-in session, your display settings (theme, text size, collapsed cards and saved grid views), your analytics choice, and, on your phone, entries waiting to sync. We don't use advertising cookies. The phone app does not use Clarity or Google Analytics.

Global Privacy Control: we don't sell or share your personal information for advertising. We treat a Global Privacy Control signal as a request not to sell or share, and we don't load analytics when we see one.

10. Changes

If we make material changes, we'll tell you in the app and update the date above.

11. Contact

admin@wovelin.net