Privacy policy
Your data should stay yours.
This policy explains how WickedLabs (“we,” “us,” or “our”) handles information when you use a product that links to this policy.
1. Scope
This policy applies to HRV Tracker for iPhone and Apple Watch, SpacePad, Cookie Stuffing Alert, this legal website, and any later WickedLabs product that links directly to this policy (together, the “Services”). A product-specific notice presented in a Service may provide additional information and controls. It controls if it conflicts with this general policy.
This policy does not govern websites, platforms, or services operated by others, even when a Service opens or links to them.
2. Information we handle
Depending on the Service and the feature you choose, information may be processed on your device, sent directly to a third party you request, or received by us when you contact us.
| Category | Examples | Where it is handled |
|---|---|---|
| Device-local content and settings | Wellness check-ins, recent Space links, alert settings, and extension findings | On your device |
| Feature inputs and observations | Authorized Apple Health data, readiness calculations, page request metadata, cookie-change signals, and selected URLs | Primarily on your device; limited Apple and third-party processing is described below |
| Purchase status | Available products and verified subscription entitlement status | Processed through Apple StoreKit and reflected in the app |
| Communications | Your email address and information you send in a support or privacy request | Received by us and our communications provider |
| Basic website/network data | IP address, request time, browser type, and security signals | May be processed by our hosting and security provider |
We do not intentionally collect passwords, full payment-card information, private messages, the contents of forms you type into websites, or a centralized history of the pages you visit through the current Services.
3. Product-specific details
HRV Tracker for iPhone and Apple Watch
With your permission, HRV Tracker reads selected Apple Health data: heart-rate variability (SDNN), resting heart rate, heart rate, sleep analysis, and mindful sessions. It uses available data to calculate personal baselines, trends, daily summaries, and readiness or recovery estimates. It can receive new HRV samples through HealthKit background delivery and display local notifications based on your alert settings.
Health and readiness analysis occurs on your Apple devices. The current app does not upload HealthKit data or derived readiness results to a WickedLabs server. The iPhone and paired Apple Watch may exchange recent HRV readings, readiness state, score, and timing information through Apple’s WatchConnectivity framework so that both devices can show current information.
Wellness check-ins—including energy, mood, perceived stress, sleep quality, soreness, optional notes, time, and the HRV value available when you log the check-in—are stored in the app’s local preferences on your device. Alert preferences and limited alert history are also stored locally. You can remove this local data by deleting the app; Apple Health data remains controlled through Apple Health settings.
Purchases and subscription entitlement checks are processed by Apple through StoreKit. We receive only the entitlement status made available to the app and do not receive your full payment-card details. Apple’s handling of HealthKit, App Store, and purchase information is governed by Apple’s Privacy Policy. HRV Tracker does not use HealthKit data for advertising, sell it, or disclose it to data brokers.
HRV Tracker provides general wellness estimates, not medical care, diagnosis, or treatment. Health measurements and estimates may be incomplete or inaccurate.
SpacePad
SpacePad stores up to eight recently opened public X Space links and their open times on your device. You can clear them in the app. When you open X Home, an X Space, or X login, the page is provided by X Corp. in a browser controlled by the operating system. SpacePad cannot read your X credentials, X cookies, or activity inside that browser view. Information you give X is governed by X’s privacy policy.
Cookie Stuffing Alert
Cookie Stuffing Alert has one purpose: to detect and alert you in real time when a web page shows indicators of unauthorized affiliate-cookie placement or loads hidden tracking pixels or zero-size iframes.
Chrome Web Store Limited Use disclosure. The extension uses access to browsing activity, page request metadata, cookie-change signals, and page structure only as necessary to provide and improve this user-facing detection and alerting purpose. Our use of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
To perform detection, the extension may inspect the current page URL and hostname; script, image, iframe, and network-request attributes; affiliate-related redirect or query parameters; cookie names, domains, expiration, and creation or modification signals; and whether an element is hidden or has zero-size dimensions. This processing is designed to occur locally in your browser.
The extension does not use this access to build an advertising profile, personalize ads, determine creditworthiness, sell browsing activity, or monitor activity for an unrelated purpose. It does not intentionally inspect form entries, passwords, private messages, or general page text. Findings and preferences remain in browser storage unless you deliberately export or share them. The current extension does not send browsing history or findings to a WickedLabs server.
“Unauthorized” is a risk classification based on technical indicators. The extension usually cannot know private commercial agreements or consent arrangements, so alerts may be incomplete or incorrect.
This legal website
This is a static website. We do not place analytics or advertising cookies through it. If hosted on Cloudflare Pages, Cloudflare may process ordinary request and security information to deliver and protect the site under Cloudflare’s privacy policy.
4. How we use information
We use information only to provide the feature you request; store your local preferences and content; maintain security, prevent abuse, and troubleshoot; respond to support, legal, or privacy requests; comply with law; and improve reliability without repurposing browsing activity for advertising or unrelated profiling.
Where applicable law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in providing and securing the Services, compliance with legal obligations, or consent where we specifically request it. You may withdraw consent at any time, without affecting earlier processing.
6. Retention and deletion
Device-local data remains until you delete it using the Service’s controls, clear the relevant app or browser storage, remove the extension, or uninstall the app. We do not keep a server copy of device-local data unless you choose to send it to us.
We retain communications only as long as reasonably necessary to respond, keep business and security records, and meet legal obligations. Hosting providers may retain short-lived security and access records under their own retention schedules.
7. Your choices and privacy rights
You can decline optional permissions, stop a scan, clear local history or reports, remove the extension, or uninstall an app. Some features will not work without the permission they require. Browser and operating-system controls may let you limit site access or grant the extension access only when selected.
Depending on where you live, you may have rights to know or access personal information, correct it, delete it, obtain a portable copy, restrict or object to processing, withdraw consent, appeal a decision, or opt out of sale, sharing, or targeted advertising. We do not currently sell or share personal information for targeted advertising. You will not receive discriminatory treatment for exercising a privacy right.
Send a request to support@wickedapi.com. Describe the Service and request. We may need to verify your request. Because most Service data stays only on your device, we often cannot access, identify, or delete it for you. You may also complain to your local data-protection authority.
8. Security
We use reasonable administrative and technical safeguards appropriate to the information we handle. No device, browser, transmission, or storage system can be guaranteed completely secure. Keep your device and browser updated, review requested permissions, and avoid sending sensitive information in support messages.
9. Children
The Services are general-audience tools and are not directed to children under 13, or the higher minimum age required in a user’s location. We do not knowingly collect personal information from children. Contact us if you believe a child provided personal information to us.
10. International use
Our providers may process limited network or communications data in countries other than yours. Where required, we use legally recognized transfer mechanisms and safeguards. Device-local data remains under the control of your device unless you choose to transmit it.
11. Changes to this policy
We may update this policy when a Service, law, or provider changes. We will post the revised policy here, change the effective date, and provide additional notice when required. Material changes apply prospectively unless law permits otherwise.
12. Contact
WickedLabs
Privacy and legal inquiries: support@wickedapi.com