Commawise Privacy Policy
Last updated: 2026-11-02
Your recording is deleted as soon as it is transcribed. We keep your transcripts, readings and account so you can see progress, and you can delete any of them. OpenAI transcribes and writes the advice; PostHog handles analytics.
1. What never happens
- We never store your recording or write it to a log. We keep only the text.
- OpenAI does not train on what we send through its API. Analytics and ad platforms never receive your words, advice or email.
- Your readings come from our own code and the word times, not from an AI guess. We sell no data.
- We use no website session replay or screen recording.
- Website click capture masks text, attributes and link queries.
2. Information we handle
2.1 Your account
Your first use creates an account without an email, so your work is kept. When you save it with an emailed code, Apple or Google, that sign-in joins the same account. We use your email, account creation date and sign-in sessions to sign you in and connect your saved work and subscription. We do this to perform our contract with you. Cloudflare stores them in the United States and sends sign-in codes. Each session also records the IP address and browser it started from. We keep the account until you delete it. Codes expire after 10 minutes, and a session ends 60 days after your last visit. We count requests by IP address and email to prevent sign-in abuse and delete the counters within a day. You can sign out or delete your account.
2.2 Server events
When you pay, renew, get a refund or cancel, our server reports the plan, amount, currency or months paid to PostHog. We do this under our legitimate interest in checking sales and refunds. These events use the random analytics identifier from checkout, never your email or account. PostHog keeps delivered events under its terms. We keep no separate copy. You can request deletion of sent records.
2.3 Recordings, transcripts and readings
Your browser records only after you press record. If the upload fails, the recording waits in the open page until it uploads or you close the page. We send the audio to OpenAI's transcription service and get back the text with a time for each word. We then discard the audio. Under OpenAI's current API data terms, it keeps no copy of transcription audio.
Our code computes pace, filler words and pauses from the word times. OpenAI then reads the transcript, the question and these readings. It judges whether "like" and "so" were fillers and writes one piece of advice. OpenAI keeps that request up to 30 days for abuse monitoring and does not train on it.
For each practice we keep the question, transcript, word times, readings, advice, date and any retry link. We use them to show your history and progress under our contract. Cloudflare stores them in the United States. They stay until you delete the practice or the account. A deleted practice still counts its day in your streak. If you report a wrong reading, we keep the kind of mistake and its position, not your words.
2.4 Free practice limits
One free practice is open per device and IP address each day. To enforce this, we keep a hashed device identifier and a hashed IP address for 2 days, under our legitimate interest in preventing abuse. If you don't save an account, we delete it and its practices once 30 days pass with no visit and no practice.
2.5 Apple and Google sign-in
You can save with Apple or Google instead of an emailed code. That provider sends us your account identifier and email; Apple can give a private relay address. We keep these with your account at Cloudflare until you delete it. The provider learns that you signed in to Commawise and handles that under its own terms.
2.6 Subscription and email
Stripe runs checkout, and Link, LLC is the merchant of record. They receive your email and payment details; we never see card numbers. We keep the customer and subscription identifiers, plan, status, renewal date, card brand and last four digits, and the first payment's date and amount. We use them to unlock practice and to handle cancellation and refunds under our contract. Checkout also carries your first-visit campaign source and a random analytics identifier from your browser. Our copy stays until you delete the account. Stripe and Link keep their records under their terms.
Cloudflare sends sign-in codes, a reminder before a yearly renewal and a cancellation confirmation. Subscribers also get a daily practice reminder at 6 pm in their time zone, so we store that zone. It skips days you already practised and pauses after 3 unanswered emails. Turn it off in Account or with the link in any reminder.
2.7 Website analytics
We collect visits, clicks, visit duration, public page addresses and queries, referrers, campaigns, browser and device details, errors and performance. Optional survey answers you type carry a random browser identifier. We rely on our legitimate interest in comparing visit sources and fixing broken or slow pages. PostHog receives this data, retains IP addresses and derives approximate country, region and city.
PostHog keeps analytics under its terms. We keep no separate copy. Cookies and browser storage remember identifiers until you clear site data. We exclude API, sign-in, practice-detail and unsubscribe pages. Practice events carry ranges and yes-or-no values, never your words, advice or exact counts. Cloudflare API logs last up to 7 days. You can request deletion of analytics records. Clearing local data leaves sent records intact. Please omit personal and contact details from surveys.
2.8 Advertising attribution
We collect Google, Microsoft, Meta or TikTok click identifiers on ad landings, based on our legitimate interest in measuring campaigns. Our conversion relay stores them and your browser type for up to 90 days. We can report ad-attributed purchases and browser type to the originating ad platform. Your browser keeps identifiers and a reference for the session. You can request deletion of sent records. PostHog retains public URLs containing these identifiers under its terms.
2.9 Meta pixel
Our public pages load the Meta pixel to measure our ads, based on our legitimate interest. Meta receives page views and one key action with the page address, browser details and IP address, never a purchase, email or name. The pixel sets the _fbp browser ID cookie and, after a Meta ad click, the _fbc click ID cookie. Meta uses this data under its privacy policy. To opt out, block these cookies in your browser or change your Meta ad preferences.
2.10 Support email
We use your email and message to answer requests, under our legitimate interest. We keep them for 12 months after the thread closes.
3. Providers and locations
We use these providers:
- OpenAI — transcription of the recording and the written advice; receives audio, transcript, question and readings, no email (US).
- Stripe and Link — checkout through Stripe Managed Payments with Link, LLC as merchant of record; tax, receipts and refunds (US).
- PostHog — site analytics and payment events (US).
- Cloudflare — hosting, the account and practice database, request logs and all our email (US).
- Apple — optional sign-in with an Apple Account (US).
- Google — optional sign-in with a Google account (US).
EU and UK data reaches the United States under each provider's transfer safeguards.
4. Your rights
Where data-protection law applies, including the EU and UK, you can ask to see, correct, delete, restrict or export your data. You can object to our use of it. You can complain to your local supervisory authority.
Email hello@commawise.com to exercise these rights. We answer within 1 month. Write from your account email. You can also download your practices as JSON in Account or delete your account.
5. Children
Commawise is for people 13 and older and is not directed at children. Under 18, a parent or guardian must agree to a purchase. Contact us about a child's account and we delete it.
6. Changes
We update this page and email account holders before a change affects our use of data.
7. Contact
Email hello@commawise.com or write to WaveApp LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.