privacy policy

01 what the app collects

things you give us:

• an account identifier. sign in with apple hands us apple’s opaque per-app id. sign in with google hands us google’s identifier for your google account. either way our server turns it into your account id with a one-way fingerprint and does not store the identifier itself. a guest is an account on our servers too. when you continue as a guest (and the app does this by itself the first time you reach the main screen without an account, so your first board can be read), our server creates an anonymous account and a session for it: a random account id and a random sign-in token, with no name and no email. we store only a hash of the token. signing in with apple or google later starts a separate account linked to that provider; the server does not merge them. an apple account and a google account are two separate accounts even when they carry the same email, because the server matches the provider’s identifier, never an email.
• your email, only if you choose to share it during sign in with apple, or when you sign in with google. apple lets you hide it; if you hide it we never see it. google always includes it, because the app asks google for it. the app sends no email of its own: it arrives inside the provider’s signed sign-in token. our server reads only the provider’s account id out of that token and does not extract, store or log your email, so we cannot write to you at it. when you email us, we reply to the address you wrote from. no marketing, ever, without your explicit opt-in.
• how sign in with google works, if you choose it. the app opens google’s own sign-in page in apple’s system sign-in sheet. ios first asks whether wodii may use accounts.google.com to sign in. you type your google password into google’s page, never into wodii, and wodii cannot read that page or its cookies; the sheet shares safari’s google session, so if you are already signed in to google you may not have to type anything. the app asks google for exactly two things, your google account identifier and your email address, and nothing else: not your name, not your photo, not your contacts, not your drive, not your gmail. google sends back a one-time code, which the app exchanges directly with google for a signed id token, protected with pkce so the code is useless to anyone else. google also returns an access token, and may return a refresh token; the app throws both away unused, because wodii calls no google service on your behalf. the app sends the id token to our server, which checks that google signed it, that google issued it to wodii’s own sign-in client, and that it has not expired, and signs you in. there is no google sdk in the app. google keeps its own record that you used your google account to sign in to wodii, under google’s own privacy policy, and you can see and remove that connection in your google account settings.
• usage data, linked to your account, and you can switch it off. the app records a small number of events about how you use it: that you opened the app, signed in, logged a session (and whether it came from a photo, a manual entry or an old photo import, and the name and city of the place you chose), checked a board and how many movements you changed, started or finished an import, shared a session card, tapped an invite, created or joined a gym, or started or bought a subscription. each event is sent to our own servers and stored with your account id, so we can tell whether wodii is working, for example whether people log a second session. an event never carries what you wrote, your photos, your location, a score or a movement name. it is never sold, never sent to anyone else, never combined with data from other companies’ apps or websites, and never used for advertising. there is no third-party analytics or advertising service in the app and no advertising identifier. it is on by default. in settings, “share usage data” turns it off: the app stops recording and deletes any events it has not sent yet. events already on our servers are kept for the life of your account and deleted with it (sections 07 and 08).
• board photos. the whiteboard images you send us to read. before one leaves your phone it is re-encoded and its exif metadata is stripped, so the gps coordinates, capture time and camera details your phone recorded are removed and never reach us. we keep our copy, so a board survives a phone you no longer have. see section 04.
• the camera roll scan, only if you choose it. if you choose to scan your camera roll, wodii looks through your photos on your phone to find workout boards. the looking happens on the phone, with apple’s on-device recognition. only the boards you confirm are uploaded, the same way as a board you photograph; their camera details, and the location stored inside the image, are removed from the image first. for a photo from your past, the app sends two small things beside the image: the day it was taken, and the place it was taken, rounded to about a kilometre, so wodii can suggest the gym you were at. our server holds the reading, with that day and rounded place, against your account until your phone confirms it has saved it, or for 30 days at most. photos that are not confirmed as boards are not uploaded and nothing about them is kept.
• the text on the board, and our reading of it. before a board photo leaves your phone, the app runs apple’s on-device text recognition over the whole image and sends every line it found along with the photo, as a hint for the model. that includes anything else written on the board: a coach’s name, or a results column with other athletes’ names and scores. our server passes that text to the model with the image and keeps only a short one-way fingerprint of it, not the text. what we do keep is the model’s reading of the board: the workout, its movements, reps and loads, the date and class time written on it, and a transcript the model writes back, filed against your account.
• corrections you make to a board we read. when the app reads your whiteboard and gets something wrong, “not right? fix it” lets you correct it. if you correct a movement’s name, remove a movement we invented, or add one we missed, and then save the session, we keep that correction: the corrected board, which fields you changed, the id of the parse it applies to, and your account id. we use it for one thing, making the reading better, and we never show it to anyone else. two limits worth stating plainly. we only keep corrections to a board you sent us, and the server checks that before it stores anything. and we keep only the parts that map back onto the board we read: if you rewrite the rep scheme or the prescribed weight as free text, that edit stays on your phone and is never sent, because we cannot turn it back into a number without guessing. your own session always records what you typed, whether or not any of it reaches us.
• which box you are in, and which workout you logged there. if you have joined a box, the app sends a one-way fingerprint of that box’s invite code with each board you send us to read, plus a fingerprint of the workout the board turned out to contain. we use the pair to count how many different people at your box logged the same workout on the same day, which is the number you see on the parse screen. the row is the box fingerprint, the date, the workout fingerprint and your account id, and nothing else: no score, no time, no ranking, no name, no board text, and the workout fingerprint cannot be turned back into a whiteboard. that count on the parse screen never shows who logged a workout, only how many, and it does not appear at all until at least five different people are behind it, because a small number in a room where everyone knows each other is not anonymous. rows are deleted after 14 days. if you are not in a box, none of this is sent or stored. leaderboards are a separate thing and they do show names: see section 01a.
• your workout log. movements, reps, weights, times, notes, the place, timestamps. the app keeps it on your iphone and also uploads each session you save to our server, whether you are a guest or signed in with apple or google. that is what lets a new phone or a reinstall get your history back, and what makes the community features work. the full session is yours: we show it to nobody else. what other athletes can see is a short card, described in section 01a, and only if that session’s audience allows it.
• your profile, if you use the community features. a display name, an optional handle (like @maya.lifts) and an optional profile photo. you choose all three and can change or remove them in settings, under “your profile”. other wodii athletes see them next to anything of yours they are allowed to see, and on your gym’s member list. a profile photo you add is shown to the other athletes in your box, in your friends feed, and next to your comments and results. you can remove it any time in the app.
• your gyms. which gyms you joined, your role in each (owner, coach or member) and when you joined. you join a gym with its invite code. a gym’s member list, with names and roles, is visible to its other members. if you register a gym, we keep that you registered it; we do not check the claim unless we review it by hand.
• workouts a coach posts. if you are a gym’s owner or coach and post the day’s workout, we keep the workout, its class times, any notes you add and that you posted it, and the gym’s members see it.
• who you follow. the athletes you follow, and who follows you. following is one-way and needs no approval.
• cheers. which posts you cheered. people who can see a post see how many cheers it has, never who gave them.
• reports, blocks and hides. when you report a post or a person, we keep the report, the reason you picked, any note you typed and who it is about. when you block someone, we keep the block so it works on every device. when a coach or we hide a post, we keep who hid it and why. section 01b says how all three work.

things the app collects and does not send us:

• memory photos, the extra photos you attach to a session. not uploaded, not parsed, not on our servers. they sit in wodii’s own folder on your iphone.
• progress photos. same. stored on your phone with file protection, so they cannot be read while the phone is locked. never uploaded, never sent to the model that reads your board. deleting the weigh-in deletes the photo.
• crash and performance reports. the app writes apple’s metrickit reports into its own folder on your device. there is no upload and no third-party crash-reporting service in the app.

things apple handles:

• your subscription. purchases go through apple. the app checks your subscription with apple on your phone and sends no receipt or transaction to us, and our server has no way to receive one. your card number, apple id email and billing address stay with apple.
• app attest, apple’s check that a request comes from a genuine copy of wodii. it is built into the app and our server, and we will switch it on, but it is not enforced yet. switching it on needs an apple team id we do not have yet, so today every copy of the app sends the same placeholder and our server turns nothing away for lacking a real one. once it is on, a key id is created once per install, lives in your device keychain, and is used only to reject requests that are not from the app. it says nothing about you and cannot be used to recognise you in any other app.

01a who sees what you log

every session you save has an audience, and you choose it. the choices are the ones the app shows:

• everyone. any wodii athlete.
• my gym. athletes who are members of any gym you are a member of. if you leave a gym, its members stop seeing these sessions.
• people i follow. only the athletes you follow. someone following you does not let them see these sessions; you following them does.
• only me. nobody else, ever. the session stays in your record and nowhere else.

the default is “my gym”. new sessions use your default, which you change in settings, under “who sees your sessions”. you can also pick an audience for a session when you save it, and change it later from the session itself (“who sees this session”). to keep a session private, set it to “only me”. to keep everything private from now on, set your default to “only me”. every session saved in the app before the community update is set to “only me” on your phone when the app updates, and reaches our server as “only me” when it syncs. it stays that way, even if you edit it, unless you change it yourself. only sessions you save from now on start with your default.

what another athlete sees is a card, never the whole session: your display name, handle and profile photo, the gym, the date and class time, rx or scaled, your score on the gym’s posted workout, a title and a one-line summary of the session, any personal bests set in it, and how many cheers it has. your notes, your sets and the rest of the session stay private.

leaderboards. when your gym posts the day’s workout and you log your result against it, your name and score appear on that workout’s leaderboard, for the gym’s members, if the session’s audience is “everyone” or “my gym”. “people i follow” and “only me” sessions never appear on anyone else’s leaderboard. you always see your own result. to keep your score off a leaderboard, set that session to “people i follow” or “only me”.

your profile. any signed-in wodii athlete can look up your display name, handle and photo, unless you have blocked them or they have blocked you. leave the handle and photo empty if you would rather not have them. your photo appears to other athletes in your box, in your friends feed, and next to your comments and results. you can remove it any time in settings, and if someone reports a photo, we can remove it.

01b blocking, reporting and moderation

• block. every post, profile and member list has a block option. blocking someone hides everything of yours from them and everything of theirs from you, on feeds, leaderboards and profiles, straight away. you can see and undo your blocks in settings, under “blocked users”.
• report. every post, profile and posted workout has a report option. a report comes to us with the reason you picked and any note you typed. we review every report within 24 hours. the person you reported is not told who reported them.
• hide. a gym’s owners and coaches can hide a post from their own gym: it leaves that gym’s feed and leaderboards. we can hide a post from everyone. either way you still see your own post.
• what we can do after a report. hide the post, remove a gym or change who runs it, and suspend or close an account, as the terms describe.
• text filter. names, handles, gym names, posted workouts and the card text other athletes see are checked against a list of abusive words. a profile or gym name that fails is refused so you can change it; card text that fails is dropped from the card, and the session still saves.

02 apple health stays on your phone

wodii can read workouts from apple health and write the workouts you time in wodii back to it. this is off unless you turn it on, in settings, health & fitness. none of it ever leaves your iphone. no workout, no heart rate, no energy, no distance is sent to our servers, written to our database, or shared with anyone. flip the same switch to stop it, and you can revoke read or write access separately in the health app at any time.

02a your location: the reminder stays on your phone, gym suggestions use a rounded place

wodii can nudge you to log the board when you arrive at your gym. a whiteboard gets wiped at the end of the day, so walking in is the only moment that reminder is worth anything. it is off unless you turn it on, and the reminder never sends your location to us. separately, wodii can suggest the box you are at when you log a workout; that is the last bullet below.

• you turn it on, twice. settings, reminders, “nudge me when i arrive at the box”. that switch on its own asks for nothing. under it is a button, “use my current location”, and tapping that button is what makes ios show you the location prompt. nothing about location happens when you open the app.
• while using the app, and nothing more. we do not ask for always-on location and wodii has no background location capability at all. ios itself watches for the arrival and wakes wodii only to show you the reminder. wodii is not running in the background following you around.
• one coordinate, on your iphone. the spot you were standing when you tapped the button, saved in wodii’s own settings on the device. there is no copy on our servers, none in icloud, none on any other device you own. get a new phone and you set your gym again, because we have nothing to restore.
• the reminder sends nothing. no coordinate, no arrival, no gym, no map. the reminder is scheduled and delivered by your phone; we are not told it fired.
• turning it off. flip the same switch, or tap “forget my gym” to erase the coordinate. you can also revoke location entirely in ios settings; if you do, wodii stops registering the reminder and tells you why it is not firing instead of pretending it still works.
• finding your box, only when you tap the button. when you log a workout, the “use my location” button sends one approximate location to our server for a single search of nearby boxes. your phone rounds it to about a kilometre before it leaves the phone, so we never receive your exact spot. it is used for that search and is not stored. only the box name, its city and its id are saved with your session. for a photo from your past, the photo’s own location is used instead, rounded the same way (section 01), and your phone’s position is not asked for. say no, or turn location off in ios settings, and you can pick or type your box instead.

apple’s app privacy questionnaire records coarse location for gym suggestions: not used for tracking, used only for the app’s function. the live box search is not stored; the rounded place of a past photo is held against your account only until your phone confirms the reading, or 30 days. the reminder coordinate is not part of it, because it never leaves your phone.

03 what the app does not collect

• your contacts
• your camera roll, beyond the specific photos you pick and the boards you confirm after a scan you chose to run (section 01)
• any advertising identifier. the app never asks for tracking permission because it has nothing to ask for
• any third-party analytics or attribution identifier
• other people off your whiteboard, as far as a model can be told. a gym board often carries a coach’s name and a results column with other athletes’ scores. to be straight about it: the text recognition on your phone reads every line, names included, and that text goes to the model with the photo (section 01). the model is instructed not to extract any person’s name and not to transcribe a results column in the reading it sends back. that is an instruction to a model, not a filter we run afterwards, so we do not promise it never slips. the photograph itself still contains whatever was written on the board, and section 04 says where that photograph lives and who can fetch it.

there is no third-party analytics sdk in wodii and no third-party tracker of any kind. the usage data in section 01 is our own, sent only to our own servers. no facebook or meta sdk, no tiktok sdk, no google analytics, no firebase, no mixpanel, no amplitude, no segment, no appsflyer, no adjust, no branch. this is checked, not assumed: a test fails the build if one appears.

04 where app data lives

our servers. a swift backend and a postgres database that we run ourselves on fly.io, in fly’s singapore region. a daily backup of the database is written to our cloudflare r2 storage and kept for 30 days.

object storage, for board photos. a board image is written as one object in cloudflare r2 under a key that belongs to you. we keep it after the read succeeds, so the board is still there on a reinstall or a replacement handset. three things worth being exact about:

• only you can read it back. the only way to fetch a board is a request that returns a link which stops working after five minutes, and the server recomputes your prefix from your signed-in session before it signs anything. a key that is not yours is refused before storage is touched, so the request cannot even be used to find out whether someone else’s board exists.
• there is no gallery and no browse. no endpoint lists your boards. the app fetches one board whose key it already remembered.
• a deployment with no object storage keeps nothing. if storage is not configured, no board photo is written on either path, nothing is kept, and the app is told there is no server copy. the copy on your phone is then the only one.

profile photos are the exception to “only you can read it back”, because a profile photo is meant to be seen. if you add one, it is stored in the same object storage, and the server hands a short-lived link to it to any athlete who is allowed to see your profile (section 01a). remove the photo in settings and the link stops being handed out.

your synced sessions, profile, gyms, follows and cheers live in the same database on fly.io as everything else, and go into the same daily backup.

progress photos and memory photos never reach object storage at all.

on your phone. the app keeps a local mirror in a sqlite database inside its own sandbox, with your board, memory and progress photos in folders beside it under complete file protection. that local copy is what every screen shows. delete the app and everything on the device goes with it.

05 third parties the app sends data to

• apple. sign in with apple, storekit, app attest. platform services that ship with ios.
• google, for sign in with google, only if you choose it. your phone talks to google directly: it opens google’s sign-in page, asks for your account identifier and email address and nothing more, and receives google’s signed id token (section 01). we send google nothing about you; our server only fetches the public keys google publishes for checking those tokens, a request that carries nothing about you or anyone else. google runs the sign-in as your own account provider, under its own terms and privacy policy, not on our instructions, and no board photo, workout or other content of yours goes to google through sign-in.
• fly.io. runs our backend server and our database, in its singapore region. everything our server holds about you is on fly.io’s machines, processed on our instructions.
• openrouter, routing to google gemini. your board image is sent to openrouter, which routes it to google’s gemini vision model to read the workout off the board. it is sent from our backend, not from your phone, and no account identifier, email or device identifier is attached to that call. the exif metadata was already stripped on your phone. the full text your phone read off the board goes with it (section 01), which can include names and results written on the board.
• cloudflare. hosts this site and the waitlist api behind it, and stores board photos and our database backups in r2, as described in section 04. it also answers the dns for the app’s api address, but the app’s api traffic goes straight to fly.io, not through cloudflare.
• google, for the waitlist sheet and its drive backup described in part two. the app does not touch either.

other wodii athletes are not on this list because they are not processors, but they are people who see what your audiences allow (section 01a). the community features add no new company: profiles, gyms, follows, cheers and synced sessions stay on the same fly.io database and cloudflare storage named above. we do not share community data with anyone else, and never for advertising.

we do not use your data to train ai models, and we do not permit anyone who processes it for us to. the one place your data meets an ai model is the board reader above, and every request to it is restricted to endpoints that neither keep it nor train on it. fly.io and cloudflare run and store our systems, and process your data only to do that, on our instructions. this is not a promise that we keep nothing: we keep what section 07 lists, your account, your board photos, our readings of them, your corrections, your synced sessions and your community data, because that is the service, and only for as long as section 07 says. how all of it is protected in transit and at rest is section 11.

what openrouter and google keep, and whether they train on it. checked on 26 september 2026:

• openrouter does not store the board image, the transcript or the reading. openrouter keeps the content of a request only if the account opts in to its prompt and response logging, or to letting openrouter use prompts to improve its product, and our account has neither switched on. what openrouter does keep for every request is metadata about it, such as when it was made, which model and provider answered, how many tokens it used, how long it took and what it cost, and that metadata contains no image and no text. openrouter also sorts a small sample of requests into topic categories for its usage statistics; for an account like ours that category is stored anonymously and never linked to us.
• every request asks openrouter to use only zero-data-retention endpoints that do not collect data. our server sends each board with openrouter’s zero-data-retention and no-data-collection routing settings, so openrouter may only hand it to an endpoint that it lists as keeping no copy of the request and not training on it. if no such endpoint is available the request fails, and our server does not retry it without those settings. today that endpoint is google’s vertex ai: openrouter lists it as not retaining prompts and not training on them, and google’s terms for vertex ai say google will not use the data to train or fine-tune any ai model without permission. so the model provider does not keep your board or train on it. one qualification, so that “does not keep” is exact: to answer faster, gemini on vertex ai may hold a request in memory, never written to disk, for up to 24 hours, and google and openrouter both treat that as consistent with zero data retention.
• what this does not change. the image and the transcript still travel to openrouter and google for the few seconds it takes to read the board, and our own copies are kept as sections 04 and 07 describe.

google appears twice in this list, for two unrelated things. signing in with google tells google nothing about your boards, and reading a board through openrouter and gemini tells google nothing about your account.

skadnetwork. if you install wodii after seeing an ad, apple may send the ad network a privacy-preserving install notification. that notification comes from apple, not from wodii, and it carries no identifier for you. wodii reads no advertising identifier and asks for no tracking permission.

06 sharing a card to instagram stories

if you tap the button that shares a card to instagram stories, the card is handed to the instagram app on your phone together with an identifier for wodii, so instagram, and therefore meta, knows which app the story came from. nothing is sent unless you tap it, and the card is drawn on your phone: it goes from your phone into instagram on the same phone, never through us.

the card is your workout, so sharing it shares your workout. depending on the card it shows the workout’s name, your score, time or load, a line such as how it compares with last time, the rep scheme, up to three movement names, a personal-best badge, the date and the venue name. behind that sits the photo you chose in the share sheet: a memory photo, a progress photo, a board photo, or none. a board photo is never picked for you, because a whiteboard can carry other people’s names and scores; you have to choose it. once the card is in instagram, what happens to it is between you, instagram and whoever you post it to.

what does not travel with it: your account id, your email, your sign-in token or any other record of ours. there is no meta sdk in wodii, and meta is not processing anything on our behalf here, which is why it is not in the list in section 05. we are telling you because “we send meta nothing” would be technically true and misleading.

07 how long the app keeps things

• your account, for the life of the account, guest or not. nothing expires while you are still using wodii. a sign-in session lasts 30 days.
• your workout log and sessions, for the life of the account, or until you delete a session. deleting a session on one device deletes it on our server, together with the cheers on it, and your other devices remove it at their next sync. changing a session to “only me” takes it off every feed and leaderboard straight away.
• your profile, gyms, follows and cheers, for the life of the account, or until you change or remove them. leaving a gym ends your membership; unfollowing or taking back a cheer removes it.
• workouts a coach posts, for as long as the gym keeps them. deleting a posted workout removes it from the gym; the sessions athletes logged against it stay in their records.
• reports, blocks and hides, for the life of the account that made them. a block lasts until you undo it. a hide lasts until whoever hid the post undoes it, or until the post is deleted.
• our reading of a board (section 01), for the life of the account. when you delete your account we remove every link between you and it and keep the reading with no owner and no date (section 08).
• board photos, our copy, for the life of your account. there is no expiry rule on the stored object, because the whole point of keeping it is that it is still there years later on a different phone. your copy, on your phone, for as long as you keep the session.
• memory and progress photos, no retention period on our side, because we never have them.
• class participation rows (section 01), 14 days. the count they answer is a per-day one, so an older row cannot answer any question we ask of it. deleting your account removes yours straight away, which can take a class’s count back below the five-person threshold and make it disappear for everyone else. that is the deletion working, not a fault.
• corrections to a board read (section 01), for the life of the account. a correction is only useful next to the parse it corrects, so it lives as long as your account does and goes when your account goes.
• subscription purchases, no retention period on our side, because we never receive them. apple keeps its own records.
• usage events (section 01), for the life of the account. they are deleted with it. turning off “share usage data” stops new events and deletes the ones still waiting on your phone; it does not remove events already on our servers, which go when you delete the account.
• photo import results (section 01), until your phone confirms it has saved them, or 30 days at most.
• after you delete your account, everything tied to it is purged from our infrastructure within 30 days. copies can remain in the daily database backups until those backups age out, which takes up to 30 days more.

08 deleting your account really deletes it

the app has a delete account button. it deletes your account on our servers, every record attached to it, and every board photo stored under your prefix in object storage. it is a purge, not a flag.

the server cannot reach the rest, so the app does that half itself: once our server confirms the account is gone, the app empties every row and every photo folder on the device, including board photos it had fetched back from us. your progress and memory photos were never uploaded, so the phone is the only place they ever were, and that is where they are removed.

your usage events go too, along with any photo import jobs still held for you.

the community data goes too: your profile and profile photo, your gym memberships, your follows in both directions, the cheers you gave, and every session you synced, with the cheers on it. your name and score leave every feed and leaderboard at the same moment.

a few things are de-identified rather than deleted, because they belong to other people as much as to you. none of them points back to you afterwards:

• our reading of a board you sent sits in a cache shared by everyone who sends the same image, so the purge strips your account, the date and the image fingerprint off it and keeps the reading with no owner.
• a report you filed about someone else’s content is a safety record about another person, so it stays with your account id replaced by a placeholder and any note you typed removed.
• a workout you posted as a coach stays on the gym’s board, with your name removed and its board photo deleted, because other athletes logged results against it.
• a gym you registered stays for its members, with your name removed. if you were its only owner, its longest-standing coach, or if there is none its longest-standing member, becomes the owner.
• a post you hid as a coach stays hidden, with your name removed from the hide.

09 your rights, and how to use them

you can ask for access to what we hold, correction of anything wrong, deletion, and an export in a portable format. you can object to processing we base on legitimate interest, and you can complain to your local data-protection regulator.

there is no self-service export in the app. no export screen and no export endpoint exists in this release. access and portability requests are handled by hand, by email, which is why the address below is load-bearing rather than decorative. if a self-service export ships later, this section will describe it.

email hello@wodii.ai. we reply within 30 days.

10 children

wodii is for athletes aged 13 and up, or the equivalent minimum age in your country, whichever is higher. we do not knowingly collect personal data from anyone under 13. if we learn we have, we delete it.

11 security

• in transit. every connection that carries your data between machines is encrypted. the app talks to our server only over https (tls). board photos go to and from our object storage over https. our server calls openrouter over https, and google’s front end encrypts the traffic it receives from openrouter with tls or quic. our server reaches its database over fly.io’s private network, which fly.io runs over encrypted wireguard tunnels, not over the public internet.
• at rest. our database lives on a fly.io storage volume with fly.io’s encryption at rest switched on. everything in our cloudflare r2 object storage, your board photos and the daily database backups, is encrypted at rest by cloudflare with aes-256.
• what that encryption is not. the keys are held by fly.io and cloudflare, not by you or by us, so it protects your data on their disks and on the wire. it is not end-to-end encryption: our server can read what it stores, because it has to in order to read your board and give it back to you. the daily database backups are protected by r2’s encryption at rest; we do not add a separate layer of encryption of our own to them.
• on your phone. the photos the app keeps on your iphone are stored with ios’s complete file protection, so they cannot be read while the phone is locked (section 04).

credentials are rotated on a schedule. app attest is built in and will let us reject requests that are not from a genuine copy of the app on a real device once we switch it on; it is not enforced yet (section 01). no system is perfect. if we suffer a breach that affects you, we will notify you and the relevant regulator inside the legally required window.

12 where in the world your data goes

you could be anywhere. the controller is established in india. our backend and our database run on fly.io in singapore; our object storage, which holds board photos and database backups, is cloudflare r2; and the model that reads your board is reached through openrouter and google in the united states (section 05). so your data can cross a border more than once: from you to the servers in singapore, from there to the controller in india when the service is administered, and to the united states when a board is read.

if you are in the eu or the uk, transfers of your data out of those places are made under the safeguards that apply to each provider named above; this section will carry the specific transfer tool and its date when they are finalised.

13 changes to this part

when this part changes, the version number and the effective date at the top change, and the new version is published at this same url. if a change is material, for example a new category of data or a new processor, we tell you in the app or by email, where we have one, at least 15 days before it takes effect.

• 1.4.1, effective 2026-10-13. profile photos. we now say plainly where a profile photo you add is shown (your box, your friends feed, comments and results), that you can remove it any time, and that we can remove reported photos.
• 1.4.0, effective 2026-10-09. first-party usage data. the app now records a small set of product events, such as a session logged, a scan started, a share or an invite tap, with your account id, on our own servers (section 01). it is never sold, there is no third-party analytics or advertising service and no advertising identifier, and a “share usage data” switch in settings turns it off and deletes events not yet sent. events are kept for the life of the account and deleted with it (sections 07 and 08). this version also states exactly how location is used for gym suggestions: your phone’s approximate location, or for a photo from your past that photo’s own location, both rounded to about a kilometre (sections 01 and 02a). part two adds an optional waitlist question about where you train. no new processor.
• 1.3.1, effective 2026-10-09. two new things the app can do, both optional. an optional camera roll scan finds workout boards on your phone, and only the boards you confirm are uploaded (section 01). logging a workout can search for your box with one rounded coordinate that is not stored (section 02a), which narrows the earlier statement that wodii never receives your location: the arrival reminder still never leaves your phone. no new category of stored data and no new processor.
• 1.3.0, effective 2026-10-07. community. the app now uploads your workout log so it survives a new phone, and adds profiles, gyms, workouts a coach posts, leaderboards with names, a feed with cheers, follows, and blocking, reporting and hiding. new data: display name, handle, profile photo, gym memberships and roles, follows, cheers, and your synced sessions (section 01). new sections 01a, on who sees what you log and how to keep a session private, and 01b, on blocking, reporting and moderation. sections 04, 05, 07 and 08 cover where this data lives, that it goes to no new company, how long it is kept and how account deletion removes it. this reverses two statements in 1.2.0: that the app does not upload your workout log, and, by narrowing the box-count paragraph, any reading of it as a promise that wodii never shows names or scores. the box count itself still shows no names. sessions logged before this version are set to “only me” and never pick up the new default. no new processor. the wodii app is not yet released on the app store.
• 1.2.0, effective 2026-09-26. reading a board is now restricted to zero-data-retention endpoints that do not collect data for training, and section 05 says exactly what openrouter and google keep. section 05 also states that we do not use your data to train ai models and do not permit those who process it for us to, and section 11 says how your data is encrypted in transit and at rest, and what that encryption is not. before this version nothing in our requests stopped openrouter from sending a board to an endpoint that keeps requests for a limited time (openrouter lists google ai studio, for example, as keeping prompts for up to 55 days); from this version our server does not allow it. no new category of data and no new processor. the wodii app is not yet released on the app store, so there was no app user to notify in advance.
• 1.1.0, effective 2026-09-26. sign in with google added as an option (sections 01 and 05). it adds no new category of data and no new processor: it is one more way to create an account, and nothing changes for an account that does not use it. this version also records the corrections published on 24 september 2026 without a version change, which made this part describe what the app and our servers already did: the backend runs on fly.io in singapore, a guest is an account on our servers, app attest is built in but not enforced, the text your phone reads off a board goes with the photo, what an instagram card carries, board corrections, and which data never reaches us. the wodii app is not yet released on the app store, so there was no app user to notify in advance.
• 1.0.0, effective 2026-09-01. first version.

01 what we collect

when you join the waitlist, we collect:

• email, the one you type in
• utm_source, utm_medium, utm_campaign, where the click came from
• ref, the referral code, if any
• landing url + referrer, which page you arrived on, and the page before that
• ip address, from the request
• country, inferred from ip via cloudflare
• user agent, browser and device string
• timestamp, when you signed up
• where you usually train, only if you answer the optional question: class gym, open gym, online programme or home

that is the full list. no other fields, no hidden trackers, no fingerprinting.

02 why we collect it

two reasons only:

• one email when wodii ships, so you can be first in.
• traffic understanding, knowing which channels bring which athletes helps us build the right product for the right people. that is the entire analytics use case.

we do not use your data to build advertising profiles. we do not sell it. we do not use it to train models.

03 where it lives

all waitlist data is stored in cloudflare workers kv, which is the source of truth, encrypted at rest. access is limited to sandeep patra, the controller named at the top of this page, and nobody else.

two copies exist alongside it, both in google workspace and both readable only by that same person: every signup is appended as a row to a private google sheet, and a weekly job writes a snapshot to a private google drive folder, kept for 90 days. no other dashboard, and no copy leaves those three places.

04 what we don’t do

• no sale of data to third parties
• no ad networks, no retargeting pixels
• no cross-site tracking
• no tracking cookies (we only use short-lived session storage for form state)
• no shadow analytics, no segment, no mixpanel, no facebook pixel

05 third parties

two, and only two.

• cloudflare, which hosts the site (pages), serves the api (workers), and stores the data (kv).
• google, which holds the sheet and the drive backup described in section 03.

each company’s own privacy terms apply to how they handle it. that is the entire external footprint: no analytics vendor, no email platform, no crm, no ad network.

06 your rights

you can request:

• access, a copy of what we hold on you
• correction, fix a wrong email
• deletion, remove everything

email hello@wodii.ai from the address you signed up with. we will honor it within 30 days.

07 retention

we keep waitlist data until you unsubscribe, ask for deletion, or wodii shuts down, whichever comes first. once you convert into an app account, part one is what governs that account.

08 children

wodii is for athletes aged 13 and up, or the equivalent minimum age in your country, whichever is higher. if you are younger than that, please do not sign up. if we learn a signup is from a minor, we delete it.

09 updates

when this policy changes, the “last updated” date at the top will change, and we will announce it on the landing page. we will not silently expand what we collect.

10 contact

privacy questions, data requests, security reports, for either part: hello@wodii.ai. one human reads it.

postal notices: email first. a postal address for service of notices is supplied on request at hello@wodii.ai.