Privacy Policy

To create an account we need either a mobile number, or an email address and a password, along with a username, a display name, and your date of birth. You can add a profile photo and a short bio. Your username, display name, photo, and bio make up your public profile.

If you use a password, it is handled by our authentication provider, Amazon Cognito. Wavely never sees it and never stores it in a form that can be read back.

Your email address is never shown on your profile or to other users. We use it to sign you in, to send the codes that confirm it and reset your password, and to contact you about your account and about changes to our policies. If you sign up with an email address, we email you a code to confirm it before your account is created.

We ask for your date of birth when you sign up, before your account is created, because Wavely is for people 13 and older, or 14 and older in Quebec. We use it only to apply age rules. It is never shown to anyone, never returned by any part of the app that shows profiles, and never used for anything else, including personalization.

If the date shows you are under 13, no account is created, and the app keeps a note on that device for 24 hours so it cannot simply be tried again with a different date. The note stays on the device and is never sent to us.

If you sign up or log in with a mobile number, we text it a one-time code. Entering the code proves the number is yours, and it is also how you sign in: an account created with a mobile number has no password. For now, codes can only be sent to numbers in the United States and Canada.

• What we text. Only the codes you ask for, to sign up, to log in, or to confirm your number. We never send marketing or promotional texts.
• How often. One message each time you ask for a code. Message and data rates may apply.
• Stopping texts. Reply STOP to any message to stop receiving texts from us, or HELP for help. While texts are stopped, you cannot sign in with a code; reply START to receive them again.
• Who sees your number. Your mobile number is never shown on your profile or to other users. People who already have it in their contacts can find your account, unless you turn that off, as described in Finding people from your contacts.

Finding people you know from your phone’s contacts is optional, and you can skip it. The app explains what it will do before your phone asks for permission, and where your phone lets you share only some contacts, only those are used.

• What we read. Only the phone numbers and email addresses in your contacts, not names, photos, notes, or anything else.
• What we do with them. The app puts them in a standard format on your phone and sends them to our servers, which compare them with Wavely accounts and send back the people who matched. Anything that matches nobody is discarded straight away. We do not keep your address book, we do not contact anyone in it, and we do not use it for anything else.
• Who can be found. A number matches the account that signs in with it. An email address matches only once its owner has confirmed it, so nobody can pose as someone else by signing up with their address. Anyone can turn off being found by their number, their email address, or both.
• Limits. Each account can look people up only a limited number of times a day, so an address book cannot be used to work out who uses Wavely.

If you sign up or sign in with Google or Sign in with Apple, that provider tells us your email address, whether it is verified, a unique identifier for your account with them, and your name if you let it share your name. If you choose Apple’s option to hide your email address, we receive a private relay address instead. If the provider does not share a name, your display name starts as the part of your email address before the @ until you change it, and like any display name it is public.

We store the content you create, so that Wavely can show it to the people you choose:

• Posts, with their text, title, photos and videos, the topics you chose, and the rating scale and rating you attached.
• Ratings you give to community rated posts, comments and replies, likes, reposts and quote repost commentary, and pinned comments.
• Saves, which are only ever visible to you.
• Folders, their names and descriptions, the posts in them, and who added each post to a collaborative folder.
• Who you follow, follow requests, and the followers you approve or remove.
• Communities you create, join, or are invited to, and your role in them, when communities are available.
• The interests you choose during sign-up or later, and the posts you mark Interested or Not interested.
• Reports you make, and the reasons you give.

Photos and videos are checked and re-encoded on our servers before anyone sees them, so they play reliably on every device.

Adding a location to a post is optional. If you add one, you choose a city or a region, and that is all we save: the place’s name and the point that marks it on the map, which is the same for everyone who picks it. Your own position is never saved with a post.

To suggest places near you, the app can use your device’s location, if you have allowed it. Your phone rounds it to a 0.1° grid, about 11 km, before sending it, and our servers use it only to find nearby places. On the Map, posts are shown as counts of areas when you zoom out, and an area with fewer than three posts is not shown at all, so a sparse area does not point to somebody’s neighbourhood.

Wavely does not track your location in the background, and does not use your location for anything other than the posts you choose to attach it to. When you browse the Map, the app sends the area on your screen to our servers to find posts there; that area is used to answer the request, not recorded as where you are.

When you search for a place to rate, and only if you have already allowed Wavely to use your location, the app sends our servers the area you are in, rounded to the same 0.1° grid, about 11 km, so nearby places come first. The app never asks for your location to do this. The area is used only to answer that search, and is not added to your account or your history.

When direct messages are available, we store the conversations you take part in, the messages and the Wavely content shared in them, who is in each conversation, and what you have read, so the app can show your conversations across your devices.

• A conversation is readable only by the people in it. Nobody at Wavely browses conversations.
• Messages are encrypted while they travel and while they are stored, but they are not end to end encrypted. That means Wavely could technically read them. We have chosen this deliberately for now, because it lets us review a message that someone reports as abusive.
• If you report a message, our moderators see that message and the least surrounding context needed to judge it, and nothing else in the conversation.
• Message content never appears in our logs or in notifications. A notification says who messaged you, never what they said.
• Messages are kept until they are deleted under these policies, as described in How long we keep information.

If you email us or fill in a form, we keep what you send and our reply, so we can help you and keep a record of what we did.

To decide what to show you, we record how you interact with posts: which posts were shown to you and where, which you opened and for roughly how long, and when you like, save, repost, share, comment on, report, or mark a post Interested or Not interested. We also record when you open a profile, follow or unfollow someone, and refresh a feed.

We call these signals. They are never shown to anyone, never visible in any count or total, and are deleted after 90 days. From them we keep a running summary of the topics and authors you engage with, which fades over time if it is not reinforced and is limited to your top 100 topics.

We keep your searches in two different ways, for two different purposes:

• Recent searches are shown back to you so you can repeat them. We keep your 20 most recent, and you can clear them at any time.
• Search activity, meaning what you searched for, what results you saw, and which you opened, helps recommend things related to what you were looking for. It is never shown to anyone and is deleted after 30 days. Clearing your recent searches does not delete this sooner; deleting your account does.

A single search counts for little, and its influence fades if you do not act on it again, so one search does not reshape your feed.

We keep a history of what you view on Wavely: the posts and profiles you open, the communities you open once communities are available, which posts you were shown, and roughly how long you spent on them. We use it to rank your feeds, to avoid showing you the same posts again, and to recommend things you are likely to enjoy.

Your viewing history is never shown to anyone else. What you opened, and for how long, is kept with your other signals for 90 days, and which posts you were shown is kept for 60 days. Deleting your account deletes it.

When your device talks to our servers, we receive technical information such as your IP address, the type of device and operating system, the app version, language settings, and the time of each request. We use it to deliver the Services, keep them secure, prevent abuse such as spam and repeated sign-in attempts, and diagnose problems. If you have allowed your device to share crash data with app developers, Apple or Google may send us a report describing a crash.

When notifications are available and you turn on push notifications, we store the token your device’s notification service gives us, so we can deliver them. Turning notifications off in your settings stops them.

The website stores your light or dark mode choice in your browser, and the waitlist page keeps your progress in the browser tab until you close it. The website sets no cookies. The app stores sign-in tokens on your device so you stay signed in, and keeps a few preferences there. The Cookie Policy lists each one, and explains how we honor the Global Privacy Control signal. Wavely does not track you across other companies’ websites or apps, and uses no advertising or analytics tools that do, so it works the same whether or not your browser sends a Do Not Track signal.

Wavely has two feeds, and they work differently on purpose:

• The Following Feed is not personalized. It shows original posts from the accounts you follow, newest first, and nothing else.
• The Home Feed and Explore are ranked for you. The main things that decide what you see are how recent a post is, your relationship with its author, how people have engaged with it, how well it matches topics you have chosen or engaged with, its ratings, and what you have been searching for. Posts you have already seen too often, or too many posts on one subject or from one person, are held back, and new posts and new authors get a chance to be seen.

You can shape the ranking directly. Marking a post Not interested hides that post from you for good and tells the ranking you want less like it. It does not hide the author or the topic. Your negative feedback is only ever about your own feed: it never affects what anyone else sees, and nobody else can see it.

These providers process information on our behalf, only for the purposes we set, and under contracts that require them to protect it. Where a provider also uses information for its own purposes, the table says so. There are two exceptions. OpenFreeMap is a free public map service we have no contract with, and it handles your IP address under its own terms. Our team’s inbox is a Gmail account, so Google handles the email you send us under its own terms, not a contract with us.

When you choose what a post is rating, Wavely looks it up in public catalogs: Wikidata for films, anime, and manga, TVmaze for TV shows, Open Library for books, IGDB for games, and MusicBrainz for music. Places come from Foursquare’s open places data, a copy of which we keep, so looking up a place never leaves Wavely.

• What a catalog receives. Our servers send it the words you type, and nothing about you: not your account, your IP address, or your location.
• Artwork. Cover art and images from TVmaze, Open Library, IGDB, and MusicBrainz’s Cover Art Archive are shown straight from their servers. Your device asks them for each image, so, as with any image on the web, they receive your IP address and which image it was.

We may preserve or disclose information if we believe in good faith that it is reasonably necessary to comply with a law, regulation, or valid legal process; to protect someone from death or serious physical harm; to prevent fraud or abuse of Wavely; or to protect the rights, property, or safety of Wavely, our users, or the public. We report child sexual exploitation to the National Center for Missing & Exploited Children as US law requires.

How we handle requests from law enforcement is set out in the Law Enforcement Guidelines, and we will report on them in the Transparency Center.

If Wavely is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of it. This policy will continue to apply to it, and we will tell you before it becomes subject to a different policy.

We share information when you direct us to, for example when you share a post outside Wavely.

Our hosting provider receives the technical information every website receives, such as your IP address, browser type, and the pages requested, and uses it to serve the site and keep it secure. We do not use analytics or advertising tools, and we set no cookies.

• The map on the home page. The home page shows a map of example places, drawn with imagery from OpenFreeMap. When you scroll near it, your browser loads the map from OpenFreeMap’s servers, so OpenFreeMap receives your IP address and which map areas are loaded. The map does not ask for or use your location.
• Your light or dark mode choice. If you choose one, the site remembers it in your browser.
• If someone mentions you. If content on Wavely includes you without your permission, such as your photo or private information, you can report it even without an account. See Reporting and Appeals.

Wavely will launch in the United States and Canada, and the waitlist is only for people there. You must be 13 or older to join, or 14 or older in Quebec. The waitlist does not ask your age.

When you open the waitlist page, it asks our servers whether your connection comes from the United States or Canada, which our hosting provider works out from your IP address. If it comes from elsewhere, the page tells you that Wavely is launching in the US and Canada first instead of asking for your email address, and our servers do not send a code to anyone connecting from there. The page also tells you that this was decided automatically, and how to ask a person to review it. We do not store the country.

If you have already joined, you cannot get a new code while you are outside the United States and Canada. The unsubscribe links in our emails, and requests to privacy@usewavely.com, work from anywhere.

To join, you give us your email address and we email you a six-digit code. Typing the code proves the inbox is yours and claims the username you chose, which is then held for you until Wavely opens.

• Your email address, as you typed it, so we can send waitlist emails to it. To recognize the same inbox, we also keep it in a standard form: for providers that ignore capitals and tags, such as Gmail, we lowercase it and remove any tag, and for Gmail its dots, so one inbox cannot hold two names.
• The username you claim, when you claimed it, and when you changed it. You hold one name at a time. A name you change away from is held for 14 days, during which only you can take it back, and you can change your name at most three times in any 14 days. These limits stop names being passed from one person to another.
• A record of your consent. Before you ask for a code, the page tells you how we will email you. When you go ahead, we record the version of the wording you saw, the time, your IP address, and your browser’s user agent. It is kept with your claim as proof of your agreement.
• Your email settings, and the state of your code: when it was sent, when it expires, and how many guesses were made. Codes are worked out when they are needed and never stored.
• Counts that limit abuse. We count requests by IP address, and code emails by inbox and by email domain, so the waitlist cannot be used to flood an inbox or claim names in bulk. Inboxes and domains are counted under a keyed hash, not their address.
• The bot check. Cloudflare Turnstile checks that a person, not a bot, is using the form. The page loads it once that check finds your connection comes from the United States or Canada, or after a few seconds if the check is slow or fails, and not at all if the check has already found it comes from elsewhere. Cloudflare receives your IP address, your browser’s user agent, and technical signals about your browser and connection. It uses them for that check on our behalf, and also, under its own privacy practices, to improve its bot detection. We do not send Cloudflare your email address or username.

The waitlist page also keeps your progress in the browser tab, so a reload picks up where you left off. Nothing is kept once you close the tab. The Cookie Policy lists what it keeps.

We use this information only to hold your username, to send you the emails below, and to keep the waitlist free of abuse. When Wavely opens and you sign up with the same email address, the app fills in the name you claimed.

Your claimed username is not shown to anyone before launch. Checking whether a name is available gives the same answer for every name that is taken, reserved, or held, so it reveals nothing about who holds what. Our team can see claimed usernames, so it can remove names that break our rules. If we remove your name, we email you to say why, unless you stopped all waitlist email. You can claim a different one, leave, or appeal within 90 days by emailing appeals@usewavely.com. Only a few people can see the email address behind a name.

Waitlist emails are sent through Amazon SES. We send:

• The code you asked for, which expires after 10 minutes.
• A receipt when you claim or change a username.
• Notices about your name: your invitation when Wavely opens to you, a reminder before an unused name is released, and a note if a name is released or removed.
• Notice of significant changes to our terms or this policy.

Every email except the code has an unsubscribe link, which works for 90 days, with two choices. Stop launch updates keeps your name and the emails about it. Stop all waitlist email stops everything except the codes you ask for and notice of significant changes to our terms or policies. Unsubscribing never releases your name.

If an email to you cannot be delivered because the address does not exist, or is marked as spam, Amazon SES adds the address to a list of addresses we do not send to. Any bounce also sends our team an alert that contains the address, never a code. Alerts are deleted after 90 days. That list is kept even if you leave the waitlist, so we never email an address that refused our mail; ask privacy@usewavely.com to remove you from it.

Each period is enforced by our code when it ends; the record itself is then deleted automatically, usually within a few days. The exception is the alerts to our team, which we delete by hand each month once 90 days have passed.

A claimed name is released 30 days after your invitation to Wavely, after a reminder, or at the latest 12 months after Wavely opens in your country. If you stopped all waitlist email, the 30 days start when Wavely opens to everyone. Releasing a name deletes your email address and claim with it.

You can leave on the waitlist page after confirming it is you with a code, which works from the United States and Canada, or from anywhere by asking privacy@usewavely.com. Leaving deletes your email address and claim at once, and your name is held for 14 days before anyone else can claim it. Copies in our backups are gone within 7 days. If an email to you ever could not be delivered because the address does not exist, or was marked as spam, the address stays on our do-not-send list, as described in Waitlist emails.

You can also ask privacy@usewavely.com for a copy of what the waitlist holds about you, or to correct it.