In a Wave

Privacy

Local first. Clear about the exceptions.

Effective September 24, 2026

What lives where

Scores, tags, notes, and preferencesPlaintext in this browser’s local storage. No automatic diary upload.
PremiumA random access code and signed receipt in this browser. Server: hashed code, random account ID, Stripe IDs, paid-through date, and subscription status.
Optional backupOne encrypted snapshot plus revision, size, and timestamp on the server. Encryption and decryption happen here. The encryption key is not stored by the app after you leave the page and is never sent to the server.
Partner cardsSelected needs, optional message/status, and date encoded in the URL fragment. Anyone with the full URL can read or forward it. No expiry or revocation.
PaymentsStripe handles checkout and billing details. No diary content is supplied to Stripe.
AnalyticsDisabled. If enabled: aggregate daily counts for home, pricing, and about only; no diary activity, visitor ID, or content.

Your browser is not a vault

Anyone with access to this unlocked browser profile, a malicious browser extension, or compromised site code may read local data. Diary storage is not encrypted at rest. Use a trusted device. Browser clearing, private mode, cleanup, or device loss may erase local data. The offline cache stores application files, not your diary or API responses. All code on this origin must remain trusted; no third-party ad or analytics scripts are included.

Recovery and encrypted backups

Your recovery kit contains an access code and a separate random encryption key. Treat it like a password: anyone holding both can retrieve and decrypt your cloud backup. Losing the encryption key means support cannot recover the contents. Backup encryption protects stored snapshots; it does not protect against compromised code running while you enter a key or use the diary. Cloud backups are optional, manual, and limited to one snapshot of up to 4 MB before encryption.

Backup status stores the last confirmed server timestamp, revision, and salted content fingerprints with check-in dates in this browser, scoped to your site and access code. These comparison details stay local and contain no encryption key; they are not included in API requests or analytics. Only a verified comparison or restore can establish a content baseline on a new device. File export records indicate a download request, not proof that a file was saved.

Logs and retention

The host may log IP address, browser type, URL path, and request time. Partner fragments are not part of normal HTTP requests, but can be saved by recipients, browser history, browser sync, or messaging services. The app’s hourly anti-abuse counters use short-lived hashed network identifiers. Public-page aggregate counts are retained for up to 90 days. Billing and webhook records are retained to operate subscriptions and meet applicable obligations. Existing encrypted backups remain available after expiry until deleted; availability is not a guarantee of indefinite retention.

Deletion and choices

Settings lets you export and import without payment, delete local data, or separately delete a cloud backup. Local deletion does not cancel billing, erase downloaded files or partner links, or delete a server backup. Use Manage billing to cancel renewals. Hosting backup copies may retain deleted ciphertext under the operator’s backup policy. Ask Site Operator at support@example.com about billing records, hosting-log retention, server backups, and your applicable data rights. Identity verification may be needed for account requests. Mandatory payment records may need to be retained.

Delete everything?

This permanently removes all check-ins, notes, settings, and Premium activation stored by this app in this browser. Export first if you want a backup. This does not cancel Stripe billing or delete a cloud backup. Do those separately before removing your access code.

Restore Premium

Paste the access code from your recovery kit. Only this code is sent—not check-ins or notes. For an old version’s activation key, contact support for an exchange.