waveJoin the waitlistPrivacy policy
Last updated 14 October 2026
Wave is made by Bb4k Solutions SRL, which decides what happens to your data and answers for it — the controller, in the law’s word. This page says what Wave keeps about you, why, where it lives, who else handles it and how you erase it. It is written to be read, not scrolled past.
The short version: Wave stores your account and what you tell it about your cravings, so it can show you your waves. Your answers are kept only once you agree to it, nothing is sold, nothing is used for ads, and deleting your account erases everything at once.
What Wave keeps
Only what the app needs to work:
- Your account: the email address you sign up with and a password, kept only as a hash.
- If you sign in with Google: Google’s identifier for you, your email address, and the name and profile-picture link Google sends with them. Wave stores these as Google sends them and shows only the email.
- If you sign in with Apple: Apple’s identifier for you and the email address it passes on, which can be a relay address instead of your real one. The first time, Apple can also share your name: Wave uses only the first name, to fill in the name Kai asks for, and you can change it before going on.
- The name you tell Kai, the otter. It appears on your profile and in the chat.
- Your interview answers: the habit you track, how often or how much, when, what sets it off, your meals and dieting (for food habits), how soon after waking (for smoking), your age range, and your sex if you choose to say.
- Your consent: when you gave it, and under which version of this policy.
- Every wave you log: when it started and ended, how strong it was, what set it off, where you were (picked from a short list — Wave never reads your location), what you were doing, which exercise you used and whether you rode it out.
- Sign-in records: for each session you are signed in, the IP address and the kind of device and browser it came from. The servers’ logs also note the IP address of each request.
Wave does not read your location, contacts or photos. It has no advertising identifier, no analytics and, in this version, no crash reporting.
Why Wave keeps it
Each use rests on its own ground in the GDPR:
- Your account — to run it, keep your waves with you from one phone to the next, and send you sign-in codes and password resets. That is the service you asked for: a contract (Art. 6(1)(b)).
- Your interview answers and your waves — to draw your day, your patterns and your streak. They say something about your health, so Wave keeps them only with your explicit consent (Art. 6(1)(a) and 9(2)(a)), which you give by ticking the box at the end of the interview, before any answer leaves your phone.
- Sign-in records and server logs — to keep accounts secure and stop abuse. That is Wave’s legitimate interest (Art. 6(1)(f)), and you can object to it by writing to us.
You can withdraw your consent at any time by deleting your account. That ends the processing from then on; it does not make what came before unlawful.
No law requires you to give Wave anything. But without an account Wave can’t keep your waves, and without your consent it can’t keep your answers, so the app doesn’t work without both.
Wave makes no automated decisions about you, builds no advertising profile and shares nothing with data brokers.
Where it lives
- On Wave’s servers at Supabase, in the European Union (Ireland). Every row is protected by row-level security: your account can read your rows and nobody else’s.
- On your phone: a copy of the last week, so Wave opens at once and works offline, and the interview until you finish it. Both are encrypted with AES-256-GCM, and the key stays in your phone’s secure key store. Signing out erases them.
- In the browser, if you use Wave on the web: the same copy, in the browser’s own storage. No cookies, no trackers.
Who else handles it
Wave runs on a few services. Each handles only what its job needs, under a contract that forbids any other use:
- Supabase — the database and the sign-in service, hosted in the EU (Ireland).
- Resend — sends the sign-in and password emails, from the EU (Ireland), so it sees your email address and the code.
- Google and Apple — only if you sign in with them. They tell Wave who you are; they also know you signed in to Wave.
- Expo — delivers updates to the app’s code. When Wave checks for one, Expo sees the app version, the platform and a random installation id, never your account.
- The app store you got Wave from delivers the app itself, under its own privacy policy.
Nobody else. Wave does not sell personal data and never has.
How long
- As long as your account exists.
- Delete your account (Profile › Delete account) and your profile and every wave are erased immediately, on the server and on your phone. If you signed in with Apple, Wave also tells Apple to end its link to your Apple ID. There is no grace period and no way back.
- A sign-in record goes when you sign out of that session or delete your account. Server logs roll over within a week.
- Database backups kept for disaster recovery roll over on a short schedule, and are never used to bring back an account that was deleted.
- Resend keeps a log of sent emails for a few days.
Your rights
Wherever you live, you can ask Wave to show you the data it holds about you, correct it, give you a copy in a machine-readable form, delete it, limit what it does with it, or stop a use that rests on Wave’s legitimate interest. Write to development@bb4k.co and you will have an answer within a month.
In the European Union, the United Kingdom and Switzerland these are your rights under the GDPR and the laws modelled on it. You can also complain to a data protection authority: the one where you live or work, or Wave’s own, Romania’s ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, dataprotection.ro).
In California, the CCPA gives you the right to know, delete and correct; Wave does not sell or share personal information, so there is nothing to opt out of. Exercising a right never changes how Wave treats you.
The fastest way to delete everything is the app itself: Profile › Delete account.
Children
Wave is not for anyone under 18. Before Wave keeps anything you tell it, you confirm that you are 18 or older, and it does not knowingly keep data about anyone younger. If you believe someone younger has made an account, tell us at development@bb4k.co and it will be erased.
Security
Everything travels over TLS. Passwords are hashed, never stored. Sign-in codes expire after fifteen minutes. Your rows are walled off by row-level security, and what Wave keeps on your phone is encrypted with a key the device guards. Nobody at Bb4k Solutions SRL reads your waves, except to fix a problem you ask for help with. If a breach ever touches your data, you and the authorities will hear about it as the law requires — in the EU, within 72 hours.
Data outside the EU
Wave’s data is stored in the EU. Supabase and Resend are US companies, whose staff may reach it from outside the EU to run and secure their service; Google, Apple and Expo may process the little they handle in the United States. Each of these transfers rests on the European Commission’s standard contractual clauses or one of its adequacy decisions. Write to development@bb4k.co for a copy of the safeguards that apply.
Changes
When this policy changes, the date at the top changes with it. A change that matters to you is announced in the app before it applies, and a new use of your answers waits for your consent.
This website and the waitlist
Everything above is about the app. This website is run by Bb4k Solutions SRL too, and keeps much less:
- Your email address, when you join the waitlist, along with which form you used and when you joined.
- How the site is used, only if you allow analytics: pages viewed, how far you scroll, clicks on links and buttons, time on the page, your browser, device type, screen size, language and an approximate location (country and city, worked out from your IP address). Google Analytics does not store your full IP address.
Your email is used only to tell you when Wave launches, invite you to try it early and share important news about it, never for anything else, and it is never sold or rented. Analytics show how many people visit and which parts of the page help, so we can improve it. Both rest on your consent (Art. 6(1)(a)): you give the first by submitting the form, and the second in the cookie banner.
Both are handled by Google’s Firebase, as our processor: waitlist emails are stored in Cloud Firestore in Frankfurt, Germany, and analytics are processed by Google Analytics. Google may process some of it in the United States, under the EU–US Data Privacy Framework and the standard contractual clauses.
Your email is kept until you unsubscribe or ask us to delete it, and no longer than 12 months after Wave launches if you have not started using it. Analytics data is deleted automatically after 14 months. Every email we send has a way to unsubscribe, and the rights above apply to this data too.
The waitlist, like the app, is for people 18 or older.
Contact
Bb4k Solutions SRL, the maker of Wave: development@bb4k.co.