Wildwater is an indoor-rowing adventure from Metatheory Inc. This policy explains how we handle information in the Wildwater app, on playwildwater.com and when you contact us. Contact support@metatheory.gg about privacy or your data.
The short version
You can row as a guest. Workout history is saved on your phone. Account-enabled versions offer optional cloud backup after you sign in. Product-learning analytics is a separate, optional choice. In onboarding, the “Share app analytics” checkbox starts checked for a new installation; a previous refusal is retained. You can uncheck it before signing in or continuing as a guest. Collection begins only after that action with it checked, or after enabling sharing in Settings. Displaying the checkbox does not start collection. We do not send your heart-rate readings, age or exercise-effort ratings to product analytics. We do not sell personal information or use it for targeted advertising.
Wildwater is currently a private beta. Features can differ by version. Current testing builds have accounts enabled and purchases disabled. The account sections below apply when you use an account-enabled version. The website does not install advertising or analytics trackers and has no sign-up form. Requesting beta access opens your email app; nothing is submitted until you send the email.
Information on your device
The app stores workout history, interrupted-workout checkpoints, journey progress and settings. Records can include dates, workout type, duration, completion status, aggregate heart-rate measurements and measurement coverage when a monitor is used, and optional perceived effort.
Your optional age, estimated or custom maximum heart rate, training goal, monitor configuration and device permissions are used locally to prepare workouts and display guidance. Age is not a date of birth. Versions supporting training-profile backup include your saved age, training goal and maximum-heart-rate setting in signed-in cloud preferences and account exports. Monitor configuration and device permissions remain local. None of these profile or monitor settings are sent to product analytics. Live heart-rate samples are used during exercise. Versions with workout graphs also save a bounded, sampled heart-rate timeline on your device, including gaps where readings are unavailable. Versions supporting graph backup send this bounded timeline with its workout to your account backup and include it in account exports. Earlier backups may contain only the summary until the original recording device uploads its graph using a supported version. Graph samples are not sent to product analytics. Wildwater does not upload a continuous heart-rate stream to its account service.
Guest history stays on that device unless you export/share it or explicitly add it to a signed-in account. Deleting the app or losing the device can lose local data that has not been backed up or exported.
Accounts and optional cloud backup
When accounts are enabled and you choose Apple or Google sign-in, we receive the provider identity needed to identify your Wildwater account, which can include a name, email address, email-verification status and provider account identifier. We do not receive your Apple or Google password. We process authentication proofs and maintain account/session records. The phone stores its session using the platform's protected credential storage; Apple authorization grants needed for revocation are retained encrypted on the server.
Signed-in backup sends workout summaries and portable preferences to our Cloudflare-hosted account service. Summaries may include aggregate heart rate, time with valid measurements, time in the workout target and optional perceived effort. Portable preferences include workout selection, preview, sound and subtitle choices, plus saved age, training goal and maximum-heart-rate settings in versions supporting training-profile backup. Cloud restoration uses these records to recover history and journey progression. Account failures do not make a local workout a confirmed backup: check the backup status in Settings.
Optional Apple Health and Health Connect export
In versions supporting automatic health saving, connecting Apple Health on a supported iPhone or iPad, or Health Connect on a supported Android 14 or later device, allows newly finished rowing workouts to save automatically after they are saved in Wildwater. This also applies to previously granted workout-write access unless you turn automatic saving off in Health settings. You can turn automatic saving off without removing local workout history, and manually save eligible older workouts. Earlier versions require a separate export action for each workout. Health access is optional; Wildwater does not request permission to read or import other apps' health records. On Apple devices, it may look up records it previously exported to associate heart-rate readings with the correct workout and retry safely.
The export contains indoor-rowing workout type, precise start and end times, active duration and pause periods. With separate heart-rate write permission, supported versions also export real heart-rate readings received from a connected Bluetooth monitor during the workout. If heart-rate permission is not granted, workout saving can still work without those readings. It does not contain estimated calories, distance or a geographic route. Preview demos and simulated workouts are excluded. Older or restored workouts without trustworthy local timing information cannot be exported. Stable identifiers support safe retries without creating additional copies.
Export goes to the health store on your device, subject to that platform's permissions and your platform sync settings. Health export data and individual permission grants are not sent to product analytics. If app analytics is enabled, a coarse connected/not-connected outcome for the onboarding Health step may be sent. Precise export timing and timestamped Bluetooth readings for Health are kept with local workout history and may be included when you explicitly export your local files; they are not part of Wildwater cloud backup. Local export status and pending work support retries when saving fails. You can revoke permission in your device's Health settings. An exported health workout is a separate copy: deleting Wildwater history, deleting your Wildwater account, or uninstalling Wildwater does not remove it. Delete the copy in Apple Health or Health Connect when you want it removed.
Optional product learning
If you sign in or continue as a guest with Share app analytics checked, or enable sharing in Settings → Product learning & data, release-mobile versions can send PostHog events about app opens, onboarding progress, selected screens and workouts, workout starts, pauses, completion or early endings, saves, coarse sign-in/backup/monitor-connection results, and the optional ratings “How did it feel?” and “How did time pass?”. These help us understand setup problems, enjoyment and repeat exercise. Events before your choice are not retrospectively collected. Demo and simulated usage are labeled separately from real workouts. Development builds are excluded.
Events use a random identifier for this installation, session/flow/workout/event identifiers, timestamps, app/build versions and limited app/workout context. A pseudonymous PostHog person profile connects usage before and after sign-in on this installation. We do not attach your name, email, Wildwater account ID, age, BPM, target-zone measurements, perceived effort, sensor name/address or free-form health notes. We do not use session replay, screen recordings or automatic screen tracking. Different installations have different analytics IDs; we do not join them using your account. The analytics choice is installation-wide and is not restored from cloud backup.
PostHog's US service processes these events. IP storage is disabled in our project and requests disable geolocation enrichment; network providers necessarily receive connection information while delivering requests. Unsent events are bounded to 200 events/256 KiB and are removed after seven days when the app next processes its queue. Sending pauses during workouts and other protected operations.
You can turn participation off at any time. This stops future sending and clears the unsent queue; it does not erase events already received by PostHog. Re-enabling creates a new analytics ID. Automatic expiry of already-received raw analytics events is not currently enforced. To request access or deletion, copy the data ID from Product learning & data and contact support. We may need to verify control of the relevant app/profile. Account deletion does not automatically locate or remove these separate remote analytics records; request their deletion separately, preferably before deleting the account or installation and its data ID. Account deletion also stops local collection and clears its unsent queue.
Website, support and service operation
Our hosting and infrastructure providers process network information such as IP address, request time, browser/user-agent information and requested resource to deliver and protect the service. Account operations also use session and rate-limit metadata to prevent abuse and troubleshoot failures. Wildwater does not intentionally log authentication credentials, request bodies or workout payloads in application logs.
If you email us, we receive your email address and anything you choose to include, such as a beta request, device details or a support description. Please do not send passwords, sign-in tokens or unnecessary health information. We use correspondence to respond, manage beta access and resolve your request; an enquiry is not consent to unrelated marketing.
Why we use information and who processes it
We use information to provide workouts and requested backup, authenticate accounts, restore records, prevent abuse, answer support requests and, with your optional participation, improve the experience. Where data-protection law requires a legal basis, these purposes rely on providing the service you request, consent for optional product analytics, our legitimate interests in reliable and secure operations, or legal obligations as applicable. You can withdraw analytics consent without affecting guest exercise.
We use Cloudflare for account hosting/storage and infrastructure, Apple and Google for the sign-in methods you choose and app distribution, PostHog for opted-in product learning, and email providers for correspondence. These providers may process information outside your country, including in the United States, under their applicable service arrangements and legal safeguards. We may disclose information when legally required, to protect rights or service security, or as part of a business transfer subject to applicable privacy protections. We do not sell workout or identity data to advertisers.
Purchases are disabled in the current beta, and the RevenueCat integration is not initialized. If we enable paid features, we will update the relevant disclosures before collection begins. Your workout data is not sent to a consumer AI coach or generative-AI provider by this app.
Retention, exports and deletion
Local workouts remain until you remove the relevant data or app. Signed-out account files are kept separately on that phone so sign-out does not silently discard pending workouts. Cloud workouts have no automatic expiry and remain until account deletion. Operational records and correspondence are retained for service, security, support and applicable legal needs; we do not promise a fixed deletion interval for every provider log or backup.
In account-enabled versions, open Settings & Backup → Delete account. Confirm the request and verify with a linked sign-in method. Successful deletion removes the account, its cloud workout/preferences records and the account-owned files on the requesting device, including unsynced workouts. Apple authorization is revoked before server deletion completes. If the operation fails or connectivity is lost, the app shows an incomplete state and allows retry; it must not be treated as confirmed deletion. New guest workouts stay separate. Exported copies, files you shared elsewhere and copies on other offline devices are not remotely erased by this action.
The server keeps a hashed deletion receipt for retry confirmation for up to 30 days of use; expired receipt rows are pruned on later successful deletion requests, so physical retention can be longer. Provider backup/recovery copies may persist under their retention processes. Copies retained for a legal obligation remain restricted to that purpose.
You can prepare a device-only export in Settings, and signed-in versions also offer a cloud-inclusive workout export. These are workout exports, not complete exports of support correspondence or remote product analytics. Contact support for other data requests or if you cannot use the in-app deletion flow. We may verify ownership before disclosing or deleting information. Deleting an account or app does not cancel any subscription you separately hold through a store.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete or receive a copy of personal information, restrict or object to processing, withdraw consent, or complain to your local data-protection authority. Contact support@metatheory.gg to exercise applicable rights or raise a concern. We will assess and respond under the law that applies to your request. We do not treat a privacy request as a reason to discriminate against you.
Age requirements, security and policy changes
Wildwater is intended for people aged 13 or older. If you are under the age of majority where you live, you must have permission from a parent or legal guardian to use Wildwater. We do not knowingly collect personal information from children under 13; contact us if you believe a child supplied information so we can investigate and remove it where required.
We use measures including encrypted transport, protected mobile credential storage and access controls. No service or device can be guaranteed completely secure. We will update this page when practices change and provide additional notice or obtain consent when required. The date above identifies the current version.