Legal · Wane

Privacy Policy

Last updated: October 24, 2026

Wane (the "Service") is operated by TUNE SCORE S.R.L. ("TUNE SCORE", "we", "us", or "our"), a Romanian limited liability company, with registered office at Strada Apicultorilor 56, Ap. 18, Sector 1, București, Romania, registered with the Romanian Trade Register under CUI RO46322985. This Privacy Policy describes how we collect, use, store, share, and protect your personal information, including biometric and health-related data, when you use the Wane mobile application and website.

By using Wane, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

Data Controller

The data controller for personal data processed through the Wane application and website is:

TUNE SCORE S.R.L.
Strada Apicultorilor 56, Ap. 18, Sector 1
București, Romania
CUI: RO46322985
Contact: [email protected]

1. Information We Collect

We collect the following categories of information:

1.1 Account Information

• Email address, display name, and profile photo (optional).
• Authentication credentials (hashed password) or Apple ID identifier (if using Apple Sign In).
• Account creation date and timezone.

1.2 Biometric and Health Data

Updated October 24, 2026 for Wane 3.0

Apple Health (read-only). With your permission, Wane 3.0 on iPhone reads sleep (including sleep stages and in-bed time), heart rate variability, resting heart rate, active and basal energy, and step count from Apple Health. Wane never writes to Apple Health. The battery is worked out on your iPhone from this data. If you have a Wane account, we also store daily summaries of these values on our servers (for example, last night's total sleep and that day's resting heart rate), so your history and outlook survive a new phone. Without an account, nothing from Apple Health leaves your phone.

Whoop and Oura Ring (optional). If you connect Whoop or Oura with your account, our server receives your sleep, heart rate variability, resting heart rate, recovery or readiness, strain and activity values from that service through its official API, and stores the access tokens needed to keep syncing. You can disconnect either source at any time.

Depending on your app version and the sources you connect, the health data we may hold includes:

• Heart rate variability (HRV / RMSSD), resting heart rate, and heart rate ranges.
• Sleep metrics: total duration, sleep stages (REM, deep, light, awake), sleep efficiency, and respiratory rate during sleep.
• Recovery and strain scores (from compatible devices such as Whoop).
• Readiness and activity scores (from compatible devices such as Oura Ring).
• Blood oxygen saturation (SpO2) and skin temperature.
• Activity data: step count, distance, flights climbed, calories, and VO2 max.
• Body composition: weight, body fat percentage, lean body mass.
• Mindfulness session duration.

1.3 Energy Check-ins and Actions

Updated October 24, 2026 for Wane 3.0

Wane learns from what you tell it. Two kinds of record are kept on your iPhone, and also on our servers if you have an account:

• Energy check-ins ("taps"): each time you tap how you feel (full, OK, low or empty) from a widget, the app, Control Center, the Action button or Siri, we record the level, the exact time, the charge the battery showed at that moment, where the tap came from, and a random identifier for the tap.
• Actions you mark as done: when you press "I did it" on a suggested action (for example, a ten-minute walk outside), we record which action, the time, and the charge at that moment. Wane compares these with your next check-in to learn which actions help you.

1.4 Calendar (Wane Premium, optional)

Updated October 24, 2026 for Wane 3.0

If you subscribe to Wane Premium and allow calendar access, Wane reads your calendar events on your iPhone to lay your energy curve over your day. Event titles, times, attendees and all other event details never leave your device. The only calendar-derived information ever sent to our server is a single meeting-load level for the day — low, normal or high — sent with the request for your personal "why" sentence (Section 4). It is used to write that sentence and is not saved in our database. You can turn calendar access off at any time in iOS Settings.

1.5 Interaction and Response Data (Wane Check)

Updated October 24, 2026 for Wane 3.0

With your consent, we collect data from Wane Check, a set of five short interactive tasks (25–90 seconds each, rotating) that you can choose to play in the app. Wane Check requires an account. Each run generates:

• Raw trial data: every individual response you make during a run and its timing, stored as JSON so that runs can be re-scored if we improve our scoring algorithm.
• Derived measures: median response time, response variability, missed and premature responses, error counts, and a score for the run.
• Context: the date, a coarse time-of-day bucket (morning, midday, or evening), and a device key (platform, device model, OS major version and, in Wane 3.0, the screen refresh rate) used only to compare a run against other runs on the same device, since touchscreen responsiveness varies by hardware. The device key is not a device identifier for advertising and is not used for tracking.

1.6 Device and Technical Information

Updated October 24, 2026 for Wane 3.0

• Device platform (iOS or Android) and operating system version.
• Push notification tokens: in Wane 3.0, the Apple Push Notification service (APNs) device token for your iPhone, with the app's bundle identifier and whether it is a production or test build; in earlier versions, an Expo push token. Tokens are used only to deliver Wane's own notifications and are deleted with your account.
• The low-battery notification in Wane 3.0 is scheduled on your iPhone itself; it involves no push token and no server.
• App version and session timing.

1.7 Usage Data

• Feature interactions and navigation patterns within the app.
• Subscription status and purchase history (managed by RevenueCat and the respective app store).

1.8 Information You Provide Voluntarily

• Support requests, feedback, and communications sent to us.
• Notification preferences and display settings.

2. Legal Basis for Processing

We process your personal data on the following legal bases, as applicable under the EU General Data Protection Regulation (GDPR) and similar laws:

• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): Health and physiological data are "special category data" under GDPR. We process this data solely on the basis of your explicit consent, which you provide when connecting a wearable device or health platform in the app. You may withdraw consent at any time by disconnecting the data source or deleting your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Explicit consent (Art. 6(1)(a) GDPR): Wane Check is optional. We process the interaction data generated when you play a run, including raw trial data, on the basis of your consent, given each time you choose to start a run. You may withdraw consent at any time by not playing further runs or by deleting your account. The derived measures and score computed from this data are also processed as necessary to provide you with the Service you signed up for (performance of a contract, Art. 6(1)(b)).
• Performance of a contract (Art. 6(1)(b)): We process account information and subscription data as necessary to provide you with the Service under our Terms of Service.
• Legitimate interest (Art. 6(1)(f)): We process technical and usage data (device platform, session timing, error logs) for service security, fraud prevention, and infrastructure performance only. Legitimate interest is not used as a basis for processing health or physiological data.
• Legal obligation (Art. 6(1)(c)): We may process data when required to comply with applicable law, regulation, or legal process.

3. How We Use Your Data

Updated October 24, 2026 for Wane 3.0

• Your battery (Wane 3.0): Your iPhone works out how much energy you have left today from your sleep, the time of day, your usual hours, your check-ins, and — if you allow them — heart rate variability, activity and (Premium) your calendar. This calculation runs on the device. Your check-ins teach it your day.
• Actions: Suggested actions are picked on the device by simple rules. For Premium subscribers, the actions you mark as done are compared with your next check-in to rank actions by what helped you.
• Restore and history: With an account, your daily health summaries, check-ins, actions and Wane Check runs are stored so they can be restored on a new phone.
• Daily score and outlook: On our server, we analyze your daily health summaries using statistical methods to compute a daily score that caps how full your battery can start the day, and (Premium) the outlook for the next 14 days. The score is a wellness indicator derived from heart rate variability, sleep quality, resting heart rate, recovery balance, and — when you choose to play a run — your Wane Check interaction and response measures.
• AI-written "why" (Premium): For Premium subscribers, a short summary of your recent numbers is sent to our AI processor (Anthropic's Claude) to write one sentence a day explaining your battery. No name, email, account or device identifiers are sent. See Section 4 for exactly what is included.
• Alerts and notifications: We use your data to send the notifications you have switched on (Section 15), such as a morning note that your day is ready and a warning when your outlook drops.
• Service operation: To authenticate your account, process subscriptions, sync wearable data, and deliver core app functionality.
• Service improvement: Aggregated, de-identified data that cannot reasonably be linked back to you may be used to improve our algorithms and the overall Service.
• No employer or third-party individual access: We do not share individual-level health data with employers, insurers, or any third party. If we introduce organizational or team features in the future, only aggregated, de-identified dashboards will be available to organizations, and only with explicit opt-in from each individual user. No individual-level data will ever be accessible to an employer or team administrator without the user's express consent.
• Communications: To send you service-related messages (account verification, security alerts, subscription updates) and, with your consent, wellness-related notifications.

4. AI-Powered Features

Updated October 24, 2026 for Wane 3.0

Wane Premium includes one AI-written sentence a day explaining your battery (the "why"). It is written by Anthropic's Claude (currently the Claude Haiku model), which acts as our processor for this feature. When it is written, our server sends Anthropic a text prompt containing only:

• Recent daily values: your latest daily score, its risk level and trend, its four component levels, how many days of data it is based on; your latest day's heart rate variability, resting heart rate, sleep hours and sleep efficiency, and recovery or strain when a wearable provides them; your latest sleep compared with your 30-day average; and your daily scores for the last 7 days, with their dates.
• Today's check-ins: the level of each check-in you made today (full, OK, low or empty) with its local hour, rounded to the hour.
• Meeting load: if you use the calendar, the single level for the day — low, normal or high. Nothing else from your calendar is sent: no event titles, times, attendees or locations.
• We do not send your name, email address, account ID, device identifiers, Wane Check results, or the exact time of any check-in.
• We use Anthropic under a Zero Data Retention eligible API configuration. Under this configuration, prompt and response data are not stored or used to train AI models, subject to limited exceptions required by law or for abuse prevention as described in Anthropic's usage policy.
• The sentence is cached on our servers for the day and associated with your account for delivery; a new check-in can produce a new sentence, with a small daily limit.
• AI insights are informational only and may contain inaccuracies. They do not constitute medical advice. See our Terms of Service for the full AI disclaimer.

5. Cookies and Tracking Technologies

Our mobile application does not use cookies. Our website (getwane.app) uses the following:

• Essential cookies: Necessary for website functionality (e.g., page routing). These cannot be disabled.
• Analytics: We do not currently use third-party analytics or advertising trackers on our website. If we add analytics in the future, we will update this section and obtain consent where required.

We do not use advertising cookies, cross-site trackers, pixel tags, or web beacons. We do not participate in advertising networks. Because we do not engage in cross-site tracking or behavioral advertising, Do Not Track (DNT) and Global Privacy Control (GPC) signals have no material effect on our processing. If we introduce any form of tracking in the future, we will respect GPC signals as required by applicable law and update this section accordingly.

6. Data Sharing and Third-Party Providers

We do not sell, rent, or trade your personal data or health data to any third party.

We share data only with the following categories of service providers, each bound by data processing agreements:

Updated October 24, 2026 for Wane 3.0

Whoop and Oura are sources you choose to connect: we receive data from them (Section 1.2) and do not send them your Wane data.

We may also disclose data if required by law, subpoena, court order, or government request, or if necessary to protect our rights, safety, or property.

7. International Data Transfers

Wane's servers and infrastructure are located in the United States. If you access the Service from outside the United States (including from the European Economic Area, United Kingdom, or Switzerland), your personal data will be transferred to and processed in the United States.

We ensure appropriate safeguards for international transfers through:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• Data processing agreements with all service providers.
• Encryption of data in transit (TLS 1.3) and at rest.

By using the Service, you acknowledge and consent to the transfer and processing of your data in the United States, subject to the protections described in this policy.

8. Data Storage and Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: Data transmitted between your device and our servers is encrypted using industry-standard transport layer security (TLS).
• Encryption at rest: Our database provider (Supabase) encrypts stored data at rest using industry-standard encryption.
• Authentication security: Passwords are hashed using a one-way hashing algorithm. Authentication tokens are stored on your device using platform-provided secure storage (Keychain on iOS, Keystore on Android).
• Access controls: Server access is restricted to authenticated, authorized personnel only.
• Token expiry: Access tokens are short-lived; refresh tokens have a limited lifetime. Specific durations may change as we improve our security posture.

No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Data Retention

Updated October 24, 2026 for Wane 3.0

• Active accounts: We retain your personal and biometric data, energy check-ins, actions you marked as done, and Wane Check interaction data (including raw trial data) for as long as your account remains active.
• On your iPhone: Your battery, check-ins and what Wane has learned are stored in the app's private storage on your device. Deleting the app removes them from the device.
• Account deletion: When you delete your account (in the app: You → Delete account), all personal data, biometric records, energy check-ins, action records, push tokens, Wane Check session data (including raw trial data), burnout scores, alerts, AI insights, and uploaded images are deleted from our active production systems promptly. Residual copies in automated backups are purged on a rolling schedule (typically within 30 days). Certain records may be retained where required by law (e.g., transaction records for tax or legal compliance).
• Disconnected data sources: When you disconnect a wearable, we stop collecting new data from that source. Previously synced data remains until you delete your account.
• Aggregated data: De-identified, aggregated data that cannot be linked back to you may be retained indefinitely for research and service improvement.
• Legal obligations: We may retain certain data as required by applicable law (e.g., transaction records for tax purposes).

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (available directly in the app).
• Portability: Request your data in a structured, machine-readable format. In Wane 3.0 you can also export it yourself: You → Export my data. (Updated October 24, 2026.)
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for biometric data or Wane Check interaction data processing at any time by disconnecting data sources, no longer playing Wane Check runs, or deleting your account.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or sooner as required by applicable law). We may verify your identity before fulfilling requests.

If you believe your request was improperly denied, you have the right to appeal by contacting us at the same address. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

11. Information for EEA, UK, and Swiss Residents

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional provisions apply under the General Data Protection Regulation (GDPR) and UK GDPR:

Data Controller: TUNE SCORE S.R.L. is the data controller responsible for your personal data. Contact: [email protected]. Full controller details are listed in the "Data Controller" section above.

Legal Basis: See Section 2 above for our legal bases for processing.

Your GDPR Rights: In addition to the rights listed in Section 10, you have the right to:

• Lodge a complaint with your local supervisory authority (e.g., ANSPDCP in Romania, ICO in the UK, CNIL in France, BfDI in Germany).
• Object to automated decision-making. Wane's burnout score is generated through automated processing of biometric data. You may request human review of any automated decision that significantly affects you.
• Request restriction of processing while we verify the accuracy of your data or assess an objection.

International Transfers: Your data is transferred to the United States. We rely on Standard Contractual Clauses (SCCs) and encryption as safeguards. See Section 7.

Retention: See Section 9. We retain data only as long as necessary for the purposes described in this policy.

12. Information for California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights. This section supplements the rest of our Privacy Policy.

Categories of Personal Information Collected (past 12 months):

• Identifiers: Email address, display name, Apple ID identifier, device tokens.
• Biometric information: Heart rate variability, resting heart rate, sleep metrics, respiratory rate, blood oxygen, body temperature, and related physiological data.
• Health information: Sleep patterns, recovery scores, activity data, burnout risk assessments, energy check-ins and actions marked as done. (Updated October 24, 2026.)
• Internet/electronic activity: App usage data, feature interactions, session timing.
• Commercial information: Subscription status and purchase records (managed by Apple/Google).
• Inferences: Burnout risk scores and wellness trend assessments derived from biometric data.

We do not:

• Sell your personal information (as defined under CCPA).
• Share your personal information for cross-context behavioral advertising.
• Use or disclose sensitive personal information for purposes other than providing the Service.
• Sell or share the personal information of users under 16 years of age.

Your California Rights:

• Right to Know: Request details about the categories and specific pieces of personal information we collect, use, and disclose.
• Right to Delete: Request deletion of your personal information (available directly in the app via account deletion).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your data, so this right is automatically satisfied.
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (biometric/health data) only to provide the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising these rights.

To submit a request, email [email protected] with the subject line "California Privacy Request." We will verify your identity and respond within 45 days.

13. Information for Other US State Residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Oregon, Texas, Montana, and other states with comprehensive privacy laws may have additional rights, including:

• Right to access, correct, and delete personal data.
• Right to opt out of targeted advertising (we do not engage in targeted advertising).
• Right to opt out of the sale of personal data (we do not sell personal data).
• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
• Right to appeal our decision regarding a privacy request.

To exercise your rights, contact [email protected].

Washington Residents (My Health My Data Act): Wane collects "consumer health data" as defined under the Washington My Health My Data Act, including physiological metrics such as heart rate, sleep data, and activity data. We collect this data solely to provide the wellness monitoring service described in this policy. We do not sell consumer health data. We do not share consumer health data except with the service providers listed in Section 6, and only as necessary to operate the Service. You may withdraw consent and request deletion of your health data at any time by deleting your account or contacting [email protected].

Note on Illinois BIPA: Wane does not collect "biometric identifiers" as defined under the Illinois Biometric Information Privacy Act (BIPA). We do not collect fingerprints, retina or iris scans, voiceprints, or face geometry. The physiological metrics we collect (heart rate, HRV, sleep data) are not biometric identifiers under BIPA.

14. Children's Privacy

Wane is not intended for users under 16 years of age (or under 13 in jurisdictions where 13 is the applicable minimum). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] and we will promptly delete it.

15. Electronic Communications

By creating an account, you consent to receive electronic communications from us, including:

• Service messages: Account verification, security alerts, subscription confirmations, and important service updates. These are necessary for providing the Service and cannot be opted out of while your account is active.
• Push notifications: In Wane 3.0: a morning note that your day is ready, a low-battery alert scheduled on your iPhone, and a warning when your outlook drops. Earlier versions send similar battery alerts and Wane Check reminders. You can switch each one on or off in the app (You → Notifications), or turn them all off in your device settings. (Updated October 24, 2026.)

We do not send marketing emails or promotional push notifications. All communications are directly related to the Service and your wellness data.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you through the app (via in-app notification or alert).
• For material changes to how we process biometric or health data, we will request renewed consent where required by law.

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy, except where renewed consent is required.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

• Privacy inquiries: [email protected]
• General support: [email protected]
• Company general contact: [email protected]

Legal entity: TUNE SCORE S.R.L., Strada Apicultorilor 56, Ap. 18, Sector 1, București, Romania, CUI RO46322985.

For GDPR-related inquiries, you may also contact your local data protection authority. A list of EEA supervisory authorities is available at edpb.europa.eu.