privacy policy

01 what the app collects

things you give us:

• an account identifier. sign in with apple hands us apple’s opaque per-app id. as a guest you get a device-local id that is not sent anywhere until you sign in.
• your email, only if you choose to share it during sign in with apple. apple lets you hide it. if you hide it we never see it. we use it for account messages and support replies, never marketing without your explicit opt-in.
• your workout logs. movements, reps, weights, times, notes, timestamps.
• board photos. the whiteboard images you send us to read. before one leaves your phone it is re-encoded and its exif metadata is stripped, so the gps coordinates, capture time and camera details your phone recorded are removed and never reach us. we keep our copy, so a board survives a phone you no longer have. see section 04.
• which box you are in, and which workout you logged there. if you have joined a box, the app sends a one-way fingerprint of that box’s invite code with each board you send us to read, plus a fingerprint of the workout the board turned out to contain. we use the pair to count how many different people at your box logged the same workout on the same day, which is the number you see on the parse screen. the row is the box fingerprint, the date, the workout fingerprint and your account id, and nothing else: no score, no time, no ranking, no name, no board text, and the workout fingerprint cannot be turned back into a whiteboard. we never show who logged a workout, only how many, and we do not show the number at all until at least five different people are behind it, because a small number in a room where everyone knows each other is not anonymous. rows are deleted after 14 days. if you are not in a box, none of this is sent or stored.

things the app collects and does not send us:

• memory photos, the extra photos you attach to a session. not uploaded, not parsed, not on our servers. they sit in wodii’s own folder on your iphone.
• progress photos. same. stored on your phone with file protection, so they cannot be read while the phone is locked. never uploaded, never sent to the model that reads your board. deleting the weigh-in deletes the photo.
• crash and performance reports. the app writes apple’s metrickit reports into its own folder on your device. there is no upload and no crash-reporting service in the app.

things the platform gives us:

• storekit receipts when you buy a subscription. product id, purchase date, apple’s opaque transaction id. no card number, no apple id email, no billing address.
• app attest attestations, which prove a request came from a real, unmodified copy of wodii. the key id is created once per install, lives in your device keychain, and is used only to reject requests that are not from the app. it says nothing about you and cannot be used to recognise you in any other app.

02 apple health stays on your phone

wodii can read workouts from apple health and write the workouts you time in wodii back to it. this is off unless you turn it on, in settings, health & fitness. none of it ever leaves your iphone. no workout, no heart rate, no energy, no distance is sent to our servers, written to our database, or shared with anyone. flip the same switch to stop it, and you can revoke read or write access separately in the health app at any time.

02a your gym’s location stays on your phone too

wodii can nudge you to log the board when you arrive at your gym — a whiteboard gets wiped at the end of the day, so walking in is the only moment that reminder is worth anything. it is off unless you turn it on, and we never receive your location.

• you turn it on, twice. settings, reminders, “nudge me when i arrive at the box”. that switch on its own asks for nothing. under it is a button, “use my current location” — tapping that is what makes ios show you the location prompt. nothing about location happens when you open the app.
• while using the app, and nothing more. we do not ask for always-on location and wodii has no background location capability at all. ios itself watches for the arrival and wakes wodii only to show you the reminder. wodii is not running in the background following you around.
• one coordinate, on your iphone. the spot you were standing when you tapped the button, saved in wodii’s own settings on the device. there is no copy on our servers, none in icloud, none on any other device you own. get a new phone and you set your gym again, because we have nothing to restore.
• we receive nothing. no coordinate, no arrival, no gym, no map. there is no request in the app that carries a location and no place on our servers that could hold one. the reminder is scheduled and delivered by your phone; we are not told it fired.
• turning it off. flip the same switch, or tap “forget my gym” to erase the coordinate. you can also revoke location entirely in ios settings; if you do, wodii stops registering the reminder and tells you why it is not firing instead of pretending it still works.

because none of this is transmitted, apple’s app privacy questionnaire records location as not collected — the same reason health is not collected. the app uses your location; it does not collect it, and those are different things.

03 what the app does not collect

• your contacts
• your camera roll, beyond the specific photos you pick
• any advertising identifier. the app never asks for tracking permission because it has nothing to ask for
• any third-party analytics or attribution identifier
• other people off your whiteboard. a gym board often carries a coach’s name and a results column with other athletes’ scores. wodii is instructed not to read any person’s name and not to transcribe a results column, and there is no field in the data we accept back for one to arrive in. the photograph itself still contains whatever was written on the board, and section 04 says where that photograph lives and who can fetch it.

there is no analytics sdk in wodii and no third-party tracker of any kind. no facebook or meta sdk, no tiktok sdk, no google analytics, no firebase, no mixpanel, no amplitude, no segment, no appsflyer, no adjust, no branch. this is checked, not assumed: a test fails the build if one appears.

04 where app data lives

our own infrastructure. a swift backend we run ourselves, and a postgres database we host ourselves. not a shared managed service.

object storage, for board photos. a board image is written as one object in cloudflare r2 under a key that belongs to you. we keep it after the read succeeds, so the board is still there on a reinstall or a replacement handset. three things worth being exact about:

• only you can read it back. the only way to fetch a board is a request that returns a link which stops working after five minutes, and the server recomputes your prefix from your signed-in session before it signs anything. a key that is not yours is refused before storage is touched, so the request cannot even be used to find out whether someone else’s board exists.
• there is no gallery and no browse. no endpoint lists your boards. the app fetches one board whose key it already remembered.
• a deployment with no object storage keeps nothing. if storage is not configured, no board photo is written on either path, nothing is kept, and the app is told there is no server copy. the copy on your phone is then the only one.

progress photos and memory photos never reach object storage at all.

on your phone. the app keeps a local mirror in a sqlite database inside its own sandbox, with your board, memory and progress photos in folders beside it under complete file protection. that local copy is what every screen shows. delete the app and everything on the device goes with it.

05 third parties the app sends data to

• apple. sign in with apple, storekit, app attest. platform services that ship with ios.
• openrouter, routing to google gemini. your board image is sent to openrouter, which routes it to google’s gemini vision model to read the workout off the board. it is sent from our backend, not from your phone, and no account identifier, email or device identifier is attached to that call. the exif metadata was already stripped on your phone.
• cloudflare. hosts this site, serves the api behind it, and stores board photos in r2 as described in section 04.
• google, for the waitlist sheet and its drive backup described in part two. the app does not touch either.

on retention and model training at openrouter and google, we are going to tell you what we actually know. what those companies do with a submitted image is governed by their own terms. we have not verified a zero-retention or no-training arrangement, so we are not going to claim one. if we put one in place, this section will say so and carry the date. we would rather leave a gap you can see than fill it with a sentence we cannot stand behind.

there is no sign in with google. the app offers sign in with apple and a guest mode. an earlier build carried a button wired to a stub; the button, the stub and the copy are gone. no data goes to google through sign-in, because there is no sign-in to send it through.

skadnetwork. if you install wodii after seeing an ad, apple may send the ad network a privacy-preserving install notification. that notification comes from apple, not from wodii, and it carries no identifier for you. wodii reads no advertising identifier and asks for no tracking permission.

06 sharing a card to instagram stories

if you tap the button that shares a card to instagram stories, the card is handed to the instagram app on your phone together with an identifier for wodii, so instagram, and therefore meta, knows which app the story came from. nothing is sent unless you tap it, nothing else travels with the card, and the card is drawn on your phone: it goes from your phone into instagram on the same phone, never through us.

there is no meta sdk in wodii. none of your workout data, your account or your board photos is involved, and meta is not processing anything on our behalf here, which is why it is not in the list in section 05. we are telling you because “we send meta nothing” would be technically true and misleading.

07 how long the app keeps things

• your account and its sessions, for the life of the account. nothing expires while you are still using wodii.
• board photos, our copy, for the life of your account. there is no expiry rule on the stored object, because the whole point of keeping it is that it is still there years later on a different phone. your copy, on your phone, for as long as you keep the session.
• memory and progress photos, no retention period on our side, because we never have them.
• class participation rows (section 01), 14 days. the count they answer is a per-day one, so an older row cannot answer any question we ask of it. deleting your account removes yours straight away, which can take a class’s count back below the five-person threshold and make it disappear for everyone else. that is the deletion working, not a fault.
• storekit receipts, for the life of the account or 24 months after the last renewal, whichever is longer, in case of a billing dispute.
• after you delete your account, everything is purged from our infrastructure within 30 days, subject to backup rotation.

08 deleting your account really deletes it

the app has a delete account button. it deletes your account on our servers, every record attached to it, and every board photo stored under your prefix in object storage. it is a purge, not a flag.

the server cannot reach the rest, so the app does that half itself: once our server confirms the account is gone, the app empties every row and every photo folder on the device, including board photos it had fetched back from us. your progress and memory photos were never uploaded, so the phone is the only place they ever were, and that is where they are removed.

09 your rights, and how to use them

you can ask for access to what we hold, correction of anything wrong, deletion, and an export in a portable format. you can object to processing we base on legitimate interest, and you can complain to your local data-protection regulator.

there is no self-service export in the app. no export screen and no export endpoint exists in this release. access and portability requests are handled by hand, by email, which is why the address below is load-bearing rather than decorative. if a self-service export ships later, this section will describe it.

email hello@wodii.ai. we reply within 30 days.

10 children

wodii is for athletes aged 13 and up, or the equivalent minimum age in your country, whichever is higher. we do not knowingly collect personal data from anyone under 13. if we learn we have, we delete it.

11 security

tls in transit, encryption at rest on the database and on object storage, app attest to reject requests that are not from a real copy of the app on a real device, and credentials rotated on a schedule. no system is perfect. if we suffer a breach that affects you, we will notify you and the relevant regulator inside the legally required window.

01 what we collect

when you join the waitlist, we collect:

• email, the one you type in
• utm_source, utm_medium, utm_campaign, where the click came from
• ref, the referral code, if any
• landing url + referrer, which page you arrived on, and the page before that
• ip address, from the request
• country, inferred from ip via cloudflare
• user agent, browser and device string
• timestamp, when you signed up

that is the full list. no other fields, no hidden trackers, no fingerprinting.

02 why we collect it

two reasons only:

• one email when wodii ships, so you can be first in.
• traffic understanding, knowing which channels bring which athletes helps us build the right product for the right people. that is the entire analytics use case.

we do not use your data to build advertising profiles. we do not sell it. we do not use it to train models.

03 where it lives

all waitlist data is stored in cloudflare workers kv, which is the source of truth, encrypted at rest. access is limited to train hybrid llc, which today is one operator, working from thailand.

two copies exist alongside it, both in google workspace and both readable only by that same person: every signup is appended as a row to a private google sheet, and a weekly job writes a snapshot to a private google drive folder, kept for 90 days. no other dashboard, and no copy leaves those three places.

04 what we don’t do

• no sale of data to third parties
• no ad networks, no retargeting pixels
• no cross-site tracking
• no tracking cookies (we only use short-lived session storage for form state)
• no shadow analytics, no segment, no mixpanel, no facebook pixel

05 third parties

two, and only two.

• cloudflare, which hosts the site (pages), serves the api (workers), and stores the data (kv).
• google, which holds the sheet and the drive backup described in section 03.

each company’s own privacy terms apply to how they handle it. that is the entire external footprint: no analytics vendor, no email platform, no crm, no ad network.

06 your rights

you can request:

• access, a copy of what we hold on you
• correction, fix a wrong email
• deletion, remove everything

email hello@wodii.ai from the address you signed up with. we will honor it within 30 days.

07 retention

we keep waitlist data until you unsubscribe, ask for deletion, or wodii shuts down, whichever comes first. once you convert into an app account, part one is what governs that account.

08 children

wodii is for athletes aged 13 and up, or the equivalent minimum age in your country, whichever is higher. if you are younger than that, please do not sign up. if we learn a signup is from a minor, we delete it.

09 updates

when this policy changes, the “last updated” date at the top will change, and we will announce it on the landing page. we will not silently expand what we collect.

10 contact

privacy questions, data requests, security reports, for either part: hello@wodii.ai. one human reads it.

postal address: train hybrid llc, shams business center, al messaned, sharjah, united arab emirates.