PRIVACY NOTICE / PRIVACY-V1 / EFFECTIVE 04 OCTOBER 2026
A clear boundary for your data.
This notice describes the current Wave Body website preview and the planned boundaries for the Early Access community. It is written for visitors in Canada and the United States and is a baseline for review, not a representation that the future mobile app is legally approved or fully launched.
Wave Body is a founder-led fitness and wellness product project developed by Roman Chupryna. WaveWork Unity is the planned operating name for a future business; it is not represented here as a registered corporation. Before paid enrollment or health-data collection, this notice, the app privacy documentation and the operator's legal details must be reviewed and updated.
1. Operator, legal and physical contact details
The project is currently developed and operated by Roman Chupryna as an individual founder. WaveWork Unity is a planned operating name, not a registered corporation, and no registration number, registered office or physical business address is represented by this preview. The public privacy contact is wave@wavebody.app; do not treat that email as proof of incorporation or as an emergency channel.
If a live service or applicable law requires a legal entity name, business or registered-office address, local representative, tax details or additional postal contact, those details will be published before that service opens. We will not invent or imply those details while the project remains pre-registration.
2. What the current website handles
The public site is a static product preview. Its current source is configured to fail closed when the verification API is unavailable; the Early Access form must not claim that an email was sent unless a live service confirms it.
- Appearance preference: the system light/dark preference is read locally. An explicit theme choice may be stored in browser local storage under
wavebody-theme. - Early Access email: if the verification service is enabled, the form may send the submitted email and consent state to the Wave Body backend so it can create a pending membership and send a one-time verification link.
- Community session: after verification, a short-lived access token may be stored locally so a member can return without verifying on every page load. It can be removed by clearing this site's local data.
- Community content: verified members may later submit comments or suggestions. They must not submit health information, medical details, passwords, payment data or another person's personal information.
- Technical requests: a hosted page can expose ordinary request data such as IP address, browser, device and approximate time to the hosting provider's logs.
The current preview does not ask for or accept health records, biometric data, progress photos, precise location, payment details, Apple Health data, Health Connect data or wearable data. It does not use advertising pixels, analytics trackers, third-party fonts or cross-site behavioral advertising.
3. Why information may be used
- to display and secure the website and prevent abuse;
- to send an Early Access verification message when the service is live;
- to provide verified community access and moderate public discussions;
- to send product updates or research invitations only when a separate optional marketing choice is provided and selected;
- to maintain consent, verification, deletion and support records;
- to meet legal, security and dispute-resolution obligations.
Depending on the person's location and the activity, processing may rely on a requested service, consent, a legitimate security or administration interest, or a legal obligation. A person may withdraw optional marketing consent without losing access to necessary service messages, subject to the law and the state of the service.
4. Email, consent and marketing
Verification and account/community messages are service messages needed to complete the requested Early Access flow. Product updates are intended to be optional, separately described and unsubscribeable. Canada and the United States have different rules for commercial electronic messages; the live implementation must record the message type, consent choice, timestamp, notice version and withdrawal state. The current preview does not start a subscription or paid relationship.
Do not use the public contact email to send health or other sensitive information. Email is not an appropriate channel for urgent medical or safety matters.
5. Health, AI and young people
The marketing site uses synthetic examples only. It is not a health-data intake form and does not make medical decisions. The future app will need a separate privacy notice, permission flows, retention rules and explicit health/AI-data consent before collecting that information.
The intended product audience is 14+. People under 14 are not eligible for the planned product. For ages 14–17, the future app and any health/AI-data processing will use a purpose-specific parent-declaration flow plus separate youth assent, mandatory Terms and Privacy acceptance, explicit health/AI-data consent and verified email. Email verification is not parental permission. The current preview form does not perform that age, parent-declaration or youth-assent workflow and is not a substitute for it.
6. Retention and deletion
The current static preview does not create a member record when its API is disconnected. If the verification service is enabled, a verification token is intended to be single-use and expire after 24 hours; a verified community session is intended to expire after 30 days. Email, consent, verification and community records will be retained only for the Early Access purpose, safety/security, moderation, dispute handling and legal obligations, with a documented schedule before production enrollment.
You may request access, correction or deletion by emailing wave@wavebody.app. We may need to verify the request and may retain a minimal suppression or audit record where required to prevent abuse or comply with law.
7. Service providers and international processing
The site is hosted using AWS services. If the verification/community backend is activated, infrastructure, email delivery and security vendors may process information on the operator's behalf under appropriate contractual and access controls. Providers may process data in Canada, the United States or another country where they operate. The operator will publish material provider or transfer changes before they are used for a new purpose.
No health information is sent to an AI provider from this website. The future app will need a separate provider list, transfer explanation and user permission boundary before any such processing.
8. Security and incidents
We use data minimization, verification tokens rather than plaintext tokens, access controls and reasonable technical and organizational safeguards appropriate to the preview. No website or transmission is guaranteed to be completely secure. If a breach creates a legal notification obligation, affected people and regulators will be notified as required by the applicable law.
9. Your choices and complaints
Subject to applicable law, you may ask what personal information is held about you, request correction or deletion, withdraw optional marketing consent, request a copy, or ask how a decision was made. We will not retaliate for a privacy request. If we cannot resolve a concern, you may contact the privacy regulator that applies to your location, including the Alberta Office of the Information and Privacy Commissioner or the Office of the Privacy Commissioner of Canada. U.S. state rights may also apply when the future service meets a state's scope thresholds.
10. Cookies, links and changes
This preview uses local storage rather than advertising cookies. Browser settings, security tools and third-party links can have their own policies. We may update this notice when the product, hosting, law or data flow changes. The effective date at the top will change with a material revision; important changes will be surfaced before a new purpose or collection begins.
Public reference sources
This page is not legal advice. The baseline was prepared for review against public guidance, including Alberta privacy legislation, PIPEDA guidance, Canada's anti-spam rules, U.S. CAN-SPAM guidance, COPPA guidance and California privacy guidance. A qualified privacy lawyer must confirm which laws apply to the production service.