Privacy Policy

Last updated November 10, 2026

kuwakuwa studio ("we") takes care with the personal information of everyone who uses kuwakuwa ("the Service"). This policy explains what we collect, why we collect it, how long we keep it, and what rights you have.

1. Information we collect

We collect only what the Service needs to work.

Account information (required)

  • The unique identifier, email address, and name provided by Sign in with Apple
  • Your nickname

Profile information (optional)

  • Date of birth — used to determine whether you are under 14 and to tailor training advice to your age group
  • Gender and swimming level (recreational or competitive)
  • Profile photo — a picture you upload is used as your avatar. If you do not upload one, an illustrated avatar assigned automatically to your account is used instead, and nothing in the service is restricted without a photo. Uploaded photos are stored with Amazon Web Services (Seoul region) and are shown where other members can see them, such as party member lists and the public feed. You can return to the default avatar at any time, and the photo is deleted immediately when you do

Health and activity records

  • Swimming workouts read from the Apple Health app (HealthKit) — distance, duration, per-lap records, stroke type, stroke count, average heart rate, and heart-rate zones
  • Training programs, session notes, and meet results you enter yourself

Service usage information

  • Subscription status and history
  • Party membership, challenge participation, and posts and replies you write in the feed and in parties
  • Photos you add to posts and parties — stored with Amazon Web Services (Seoul region) and automatically checked with Amazon Rekognition on upload to filter inappropriate images
  • Training programs you publish and your download history
  • Likes, saves, and shares you leave on posts — used only to rank the feed, never for advertising or tracking
  • Device tokens used to deliver push notifications
  • App usage statistics — anonymous events recorded when the app launches, when you open a tab, when a swim workout is imported, and when you save a program, together with app version, device model, and OS version. These are aggregated in a form that cannot identify you and are never used for advertising or tracking

Location (optional)

  • If you allow location access in the pool finder, the coordinates of your current location are sent to our server to show nearby pools. We do not store them as service data, but they may remain in server access logs together with your IP address

Support inquiries (in-app 1:1 inbox)

  • The inquiry category, what you wrote, and the replies exchanged
  • Images you attach to an inquiry — up to 3 per message
  • Diagnostic information — app version and build number, device model, OS version, and the language the app is displayed in. Sent automatically with your inquiry so we can reproduce the problem, and visible only to administrators

Users under 14

  • A guardian email address and a record of their consent

Website inquiries (partnerships, etc.)

  • The name/affiliation, email address, and message entered in the inquiry form — used only to receive and reply to the inquiry

We do not collect information for advertising or user tracking. The Service contains no advertising and does not use the Advertising Identifier (IDFA).

2. Health data — what stays on your device and what leaves it

Swimming records read from the Apple Health app (distance, duration, per-lap records, stroke type, stroke count, average heart rate, and heart-rate zones) are stored both on your device and on our servers. The server copy is a backup that restores your records on a new device or after reinstalling the app, and it lets the people you allow see your session records.

Raw heart-rate samples measured every few seconds are never sent to our servers. We keep only the summary shown on the session record screen.

Who else can see your session records and diary follows the visibility you choose (Everyone, Mutual followers only, or Private). Users you have blocked can never see them.

When you delete a record in the app, its measurements are deleted from our servers too; only the record identifier and date are kept so the same workout is not imported again. If many records are deleted within a short time, we keep them for 30 days in case of a mistake or a sync error, and you can restore them from the app settings during that time.

The one exception is the Weekly AI Report. When you request one, a summary of your last seven days of training (distance, duration, pace, stroke type, and heart rate) is sent through our server to the AI provider named in Section 3. This transmission happens only after you have explicitly agreed to it, and nothing is sent if you do not request a report.

Training programs you create are published to the catalog, where other members can view and save them, with your nickname shown as the author. Programs created by the AI report are also published to the catalog when they are issued, with kuwakuwa.ai shown as the author so that the person who requested the report is not revealed. Only the program title and training structure are published; swimming records and heart rate are not included.

Health and fitness data is never used for advertising, marketing, or data mining, and is never sold.

3. Sharing with third parties and international transfers

We do not share your personal information with third parties except as described below.

Anthropic, PBC (United States) — AI training analysis

  • Data transferred: a summary of your last seven days of training (distance, duration, pace, stroke type, heart rate) together with the context needed for coaching advice, such as age group and swimming level
  • Purpose: to analyse your week and generate a training program for the following week
  • Destination, timing, and method: the United States, transmitted over the network at the moment you request a report
  • Retention: for as long as needed to produce the response. Transferred records are not used to train AI models
  • We do not transmit directly identifying information such as your name, email address, or date of birth
  • You may decline this transfer. If you decline, every part of the Service remains available except the report feature

We may also disclose information where a competent authority requires it through a lawful process.

4. Service providers

We rely on the following providers to operate the Service.

Providers and their roles

  • Amazon Web Services — server hosting, data storage, and automated image checks (Seoul region)
  • Apple Inc. — sign-in, payment processing, and push notification delivery
  • Resend — transactional email (guardian consent requests, report notices, website inquiry receipts and replies)
  • Vercel Inc. — hosting for this website and processing of the website inquiry form
  • TelemetryDeck (Germany) — aggregation of anonymous app usage statistics. User identifiers are hashed on the device before they are sent; no name, email address, or health record is transmitted

5. How we use your information

  • To identify you, sign you in, and manage your account
  • To store, display, and analyse your swimming records
  • To generate AI training analysis and program recommendations, where you have agreed to it
  • To provide community features such as parties, challenges, and shared training programs
  • To process subscriptions and confirm entitlement
  • To send notices and notifications needed to operate the Service
  • To handle reports of inappropriate content and keep the Service safe
  • To verify guardian consent for users under 14

6. How long we keep your information

We keep your personal information for as long as your account exists, and delete it without undue delay when you delete your account.

Content created together with other people — replies and comments on other posts, and published training programs — is not deleted but is anonymised, so that other members do not lose lists and conversations they were part of. Anonymised content is no longer linked to any individual.

Where the law requires us to retain certain records for a set period, we keep them for that period and then delete them.

Support inquiries and dispute records are kept for three years after you delete your account, as required by law, in a form with identifying information removed, and are deleted afterwards. Images attached to an inquiry are deleted as soon as you delete your account.

Swimming records stored on our servers are destroyed immediately when you delete your account. Records held after a bulk deletion have their measurements deleted after 30 days.

Your profile photo is deleted the moment you return to the default avatar or replace it with another picture, and also as soon as you delete your account. We keep no separate copy and there is no grace period.

7. Deletion

Personal information that has passed its retention period or is no longer needed is deleted without undue delay. Electronic files are erased in a way that cannot be recovered.

8. Your rights

You may access, correct, delete, or restrict the processing of your personal information at any time.

What you can do in the app

  • View and edit your profile — Profile screen
  • Delete your account — Profile › Delete Account. Your personal information is deleted as described in Section 6
  • Stop AI transmission — nothing is transmitted unless you request a report
  • Revoke health data access — iOS Settings › Privacy & Security › Health
  • Turn off push notifications — iOS Settings › Notifications

For any other request, contact us using the details in Section 11 and we will respond within the period required by applicable law. Where the user is under 14, their guardian may exercise these rights on their behalf.

9. Children

We obtain guardian consent before processing the personal information of users under 14. During sign-up we check the date of birth; if the user is under 14 we ask for a guardian email address, send a consent request to that address, and only allow the Service to be used once consent is confirmed.

A guardian may at any time request access to, correction of, or deletion of their child’s information, or withdraw consent.

10. Security

  • Encryption in transit — all communication between the app and our servers uses HTTPS
  • Least privilege — access to systems handling personal information is limited to designated staff
  • Regular backups — server data is backed up on a regular schedule
  • Health data minimisation — only the summary needed for the session record screen is stored on our servers; raw heart-rate samples are never sent

11. Contact

  • Business name: kuwakuwa studio
  • Representative and privacy officer: Kwanghoon Park
  • Business registration number: 896-08-03160
  • Address: Kyungdong Wintz Tower, 59 Yangun-ro, Haeundae-gu, Busan, Republic of Korea
  • Email: studio.kuwakuwa@gmail.com

12. Changes to this policy

If we change this policy we will announce the change in the Service or on this page at least seven days before it takes effect. Changes that materially affect your rights will be announced at least 30 days in advance, and we will ask for your consent again where required.