WonderWatch Privacy Policy

Last updated: 7 October 2026

This policy applies to the independent WonderWatch Apple Watch app. It is separate from the Wonderwake iPhone app and website privacy policy. WonderWatch is operated by WonderWake Limited, Hong Kong.

The short version

• Your heart-rate and movement readings stay on your Watch. We do not send these readings or inferred sleep or wake signals to PostHog or our servers.
• No account, advertising identifier, advertising tracking, or session replay is used.
• Usage sharing is optional and off by default. Your alarm works the same way with it off.
• If you enable usage sharing, a small set of app actions and technical failure categories goes to PostHog. Your chosen alarm time is excluded.

Local alarms and health access

WonderWatch saves your alarm deadline, selected time, timing mode, wake style, and alarm state locally. The app and its complication share this information through a dedicated App Group on the Watch. It is not shared with the Wonderwake iPhone app. The usage-sharing preference is also saved locally.

Smart Timing requests permission to read heart rate from Apple Health and access wrist movement. These inputs are processed on the Watch to look for a wake opportunity. WonderWatch does not write to Apple Health, upload your health or movement readings, or create a cloud sleep record. You can decline or revoke these permissions. Without usable readings, Smart Timing uses your selected time while its native alarm session remains running.

Local diagnostic messages describe alarm transitions and failures without including health readings, alarm times, or analytics identifiers. Apple manages system diagnostics and Apple Health separately under your device settings.

Optional usage sharing

You can enable Share app usage in WonderWatch Settings > Help & Privacy. We use these records to understand which controls and modes people use and investigate alarm failures, not to infer health or confirm that someone woke up.

The permitted events are:

• Opening the app.
• Successfully scheduling or cancelling an alarm.
• Starting an alarm alert, stopping it, or explicitly snoozing it.
• A fixed technical failure category, such as scheduling failure or session expiry. Raw error text is not sent.

These events may include your selected Exact or Smart timing mode, Gentle, Slow, or Direct wake style, whether the action concerns a snooze, whether Stop came from the app or Apple's alert, event timestamps, and app, library, and operating-system versions.

PostHog assigns a random identifier to the Watch app installation so successive actions can be understood together. This is pseudonymous, not fully anonymous. It is not your Apple Account, an advertising identifier, or an identifier reused from the Wonderwake iPhone app. We do not send your name, email, chosen alarm time, heart rate, movement, health-derived conclusions, precise location, screen recordings, or free-form content.

Only explicitly selected events are permitted. Automatic screen and lifecycle capture, automatic error capture, and session replay are disabled. Analytics are best-effort and may arrive late or not at all when the Watch is offline, suspended, or interrupted.

Service provider and transfers

PostHog processes optional usage records in our separate US-hosted WonderWatch project. See the PostHog Privacy Policy. Internet requests necessarily expose a network IP address to the receiving service. Our project is configured not to retain IP addresses in analytics events, and event-based geographic enrichment is disabled.

We use service providers to process information for our product analytics, not to sell personal data, build advertising profiles, or track you across other companies' apps. Processing outside your country may involve different data-protection laws. Applicable contractual and legal safeguards govern these transfers.

Your choices and retention

You can turn usage sharing off at any time in Help & Privacy. This stops new usage events and clears unsent analytics events on the Watch. It cannot recall events already sent or a request already in transit. Actions before you opted in are not uploaded later.

Local alarm settings remain on the Watch until changed or the app is removed. We keep optional usage records only as long as reasonably needed for the product-improvement and diagnostic purposes described here, subject to applicable legal obligations. Turning sharing off does not itself delete records already received by PostHog.

Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing and to withdraw consent. Because no account is required, we may need additional information to locate pseudonymous records. Contact us for privacy questions or requests. You may also complain to your local data-protection authority.

Children, security, and changes

We do not knowingly collect personal information from children in circumstances that require parental consent without that consent. Contact us if you believe such information has been shared.

Optional analytics requests use encrypted HTTPS. No security measure can guarantee absolute protection. We may update this policy when the app or our data practices change and will update the date above.

Contact