Privacy Policy

Havelaar US, LLC ("we," "us," or "our") operates the WaveDyno website at wavedyno.com and the WaveDyno application at app.wavedyno.com (together, the "Service"). We are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner.

1. Information We Collect

We collect the following information when you use the Service:

• Account information. When you sign up, we collect your email address and, if provided, your name, through our authentication provider.
• Project and simulation data. The engine configurations, projects, simulation runs, and results you create are stored so the Service can function.
• Public share pages. Sharing is off unless you turn it on. You can create a public link for a completed run. When you do, we make a copy of selected results for that page:
  • the title and caption you write;
  • the simulated power and torque curves, peak power and torque, and the power band;
  • a short engine summary: displacement, bore and stroke, intake type, and the setup template if you used one;
  • the sweep range and step, the quality preset, the simulation date and the software version.
  Power is shown in the unit you choose (hp or kW). Before the link exists, you see a preview of exactly what will be published. The page never shows your email address, your account name, your project name, your run notes, your pipe dimensions, your port timings, your full engine configuration or your run history. The title starts out as your run's name. If you keep that name, it's public.
• Usage analytics. We collect information about how the Service is used, such as pages viewed, features used, and general device and browser information. This includes the address of each page viewed. Some links we post, such as wavedyno.com/yt and wavedyno.com/fb, which we use in our own comments on YouTube and Facebook, lead to our homepage with a campaign tag added to its address (for example, utm_source=youtube), so we can count visits from them. The tag identifies the link, not you. Our server also counts the requests for these two addresses. For each one, it sends our product analytics provider, PostHog, a record that contains which of the two addresses was requested, the date, and what made the request: a person, a link-preview service, and which one, or another automated program. For a person's visit, the record also contains the domain of the site or app they came from (for example, youtube.com), if their browser passed it on. The record doesn't contain the visitor's IP address or browser details, and nothing is read from or stored on the visitor's device. Our server sends it, not the visitor's browser, so the visitor's IP address doesn't reach PostHog with it.
• Correspondence. If you email us, we keep the message and your contact details so we can reply.
• Builder notification request. If you ask us to tell you when Builder opens, we collect your email address. Our pricing page sends it to Loops, our email provider, and asks Loops to add it to the Builder notification list. If Loops already holds a contact for you, it uses that contact. Submitting the form does not override an unsubscribe or a withdrawal through Loops' Preference Center.

2. How We Use Your Information

We use the information we collect to:

• Operate the Service: authenticate you, store your projects, run your simulations, and enforce usage limits.
• Publish the share pages you create, and take them down when you revoke them.
• Respond to your inquiries and provide support.
• Understand how the Service is used so we can improve it.
• Improve and calibrate our simulation models, using simulation inputs and results in aggregated or de-identified form.
• Notify you about important changes to the Service or your account.
• If we send you WaveDyno news or marketing emails, we use your contact details for those messages.
• Send one Builder announcement to subscribed addresses on the Builder notification list, if Builder opens by 31 October 2027. We don't send it to the whole account list or add you to other mailing lists. You can withdraw at any time through our contact form, and we'll remove your request within 10 business days and before we send. The email itself has an unsubscribe link.

We do not sell, rent, or trade your personal information to any outside parties.

3. Public Share Pages

Who can see a share page. Anyone who has the link. We don't list share pages anywhere: not on our site, and not in any sitemap. Every share page also asks search engines not to include it, so a search engine that finds the link somewhere (on a public forum, for example) and honours that request won't list it. The page shows only what the preview showed you when you created or last edited the link.

Revoking a link. You can revoke a share link at any time from the share dialog. Revoking deletes the page's content and images from our systems, and the link stops working on wavedyno.com within about a minute. A revoked link is never reused, and sharing the same run again gives it a new link. Deleting a run or a project revokes every link that includes it.

What we keep after you revoke a link. Revoking doesn't delete the link's record entirely. We keep a small record of each former link. It doesn't contain the page's title, caption, results or images. It keeps:

• a scrambled (hashed) form of the link, so that the address is never used again;
• the page's referral code (a short code in the page's link to the app, which gives no access to the page) and the number of sign-ups counted for it;
• the reason the link was revoked, and when it was created and revoked;
• which account the link belonged to.

Revoking a link doesn't remove its association with your account. That association is removed only when you delete your account (see Data Retention).

What we can't recall. Once a link has been shared, other people and services can make copies we don't control. Revoking doesn't remove:

• link previews already posted on Facebook, WhatsApp, forums or other sites, including copies of the preview image that some forums store themselves;
• the preview image in browsers and other caches, which may keep it for up to a day;
• anything a visitor saved, screenshotted or copied.

The preview image shows the dyno curve, the peak power and the title.

What you write is public. The title and caption appear on the page as you wrote them. If a caption mentions a pipe length or a customer, that's public too.

The link to the app. Each share page links to the WaveDyno app, and that link carries the page's referral code. When the app is opened from that link, it takes the code out of the address before our product analytics starts; if it can't, our product analytics stays off for that visit. The app keeps the code in the browser's storage, and our server sends our product analytics provider, PostHog, a record that the app was opened from a share page, with the referral code and the date. If a new WaveDyno account is created in that browser within 30 days, we add one to that page's sign-up count, and our server sends PostHog a record with the referral code and the date. These records contain nothing about the browser or the account, and we don't store which share page an account came from, in our systems or in PostHog. Sign-ups by our own staff and test accounts aren't counted. The app deletes the stored code once it has successfully loaded a signed-in WaveDyno account in that browser, which happens straight away if someone is already signed in, or the first time the app is opened after the 30 days. If loading the account fails, the app keeps the code for its next try; if neither happens, the code stays in the browser until its stored data for the app is cleared. Cloudflare, our hosting provider, also serves the app, so like any web host it sees the address the app was opened with, code included. Share pages themselves load no analytics or advertising scripts.

Links created and active. When you create a share link, our server sends PostHog a record with its referral code, the date, and whether it shows one run or a comparison. Once a week it also sends the number of links that are active, created and revoked. These records never include your account. Records about links made by our own staff and test accounts are marked as such, so we can leave them out of our numbers.

Our host sees share addresses. Share pages are served by Cloudflare, our hosting provider (see Third-Party Services). Like any web host, Cloudflare necessarily sees the address of each page requested, including share links. Its dashboard statistics may list those addresses to our administrators, and Cloudflare keeps them for its own retention period. If a share page fails to load, some browsers also send Cloudflare an error report that includes the share address that was requested. We don't log share addresses ourselves, and we don't send them to our analytics provider or to any other third party. When a visitor clicks a link on a share page, their browser is told not to pass the share address on.

What we count on share pages. Our server counts the requests for each share page. For each one, it sends our product analytics provider, PostHog, a record that contains the page's referral code, the date, and what made the request: a person, a link-preview service (the services that fetch a page to show its preview when a link is posted, such as Facebook, WhatsApp, Discord, Slack, Telegram or iMessage), and which one, or another automated program. For a person's visit, the record also contains the domain of the site or app they came from (for example, facebook.com), if their browser passed it on. The record doesn't contain the visitor's IP address, browser details or the share address, and nothing is read from or stored on the visitor's device. Our server sends it, not the visitor's browser, so PostHog doesn't receive the visitor's IP address either. The records sent to PostHog contain no account identifier. In our own database, each referral code stays linked to the account that created the share, including after the link is revoked, until that account is deleted; after that, nothing connects the counts to you.

4. Third-Party Services

To operate the Service, we rely on a small set of trusted third-party processors:

• Clerk for authentication and account management.
• Convex for our application database and backend.
• Amazon Web Services for running simulations.
• Cloudflare for hosting and content delivery, including public share pages.
• PostHog for product analytics.
• Tally for our contact form, including the "Report this page" link on share pages.
• Loops for our email contact list. When you sign up, Clerk shares your email address, your name if provided, and your Clerk user ID with Loops. Our pricing page also sends your email address to Loops when you submit a Builder notification request. We use Loops for that list and the one announcement described above.

Each of these providers processes data on our behalf under their own security and privacy commitments.

5. Cookies

The application uses cookies and similar browser storage that are necessary for signing in and keeping your session active, and analytics identifiers that help us understand product usage. If you open the app from a share page, it also keeps that page's referral code in browser storage, to count a sign-up for that page within 30 days; Section 3 says when the app deletes it. The marketing website at wavedyno.com does not use advertising cookies. Public share pages set no cookies and load no analytics or advertising scripts. The counting of share-page requests described in Section 3 happens on our server and stores nothing on the visitor's device. Apart from Cloudflare, which serves them and may receive the error reports described in Section 3, they load nothing from other companies.

6. Data Security

We implement industry-standard security measures to maintain the safety of your personal information. However, please be aware that no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your account information and project data for as long as your account is active. Detailed simulation artifacts may be cleaned up after a retention period. That doesn't affect share pages, which keep their own copy of the results.

If you delete your account, all your active share links are revoked and their content and images are deleted. The records of former links described in Section 3, including links you revoked earlier, are kept without anything that connects them to you. We delete the rest of your personal information within a reasonable period, except where retention is required by law.

Messages you send us through our contact form, including reports made with the "Report this page" link, are reviewed monthly and deleted when they are older than 90 days. If you ask us to delete a message sooner, we will.

Builder notification requests. We keep your request until we've sent the Builder announcement, and remove it from the list within 30 days after sending. If Builder hasn't opened by 31 October 2027, we won't send the announcement, we stop taking requests, and we remove every request from the list by 30 November 2027. If you withdraw through our contact form, we remove your request within 10 business days and before we send. For subscribed contacts created only for this request, we also delete the contact. Other contacts, including contacts linked to a WaveDyno account, remain in Loops. They may keep a record of the announcement and of leaving the Builder list. If you unsubscribe from WaveDyno marketing emails, we retain your email address marked as unsubscribed to prevent further marketing emails. This does not stop transactional or legally required emails. Copies in Loops' backups are removed when those backups expire.

8. Your Rights

You have the right to request access to the personal data we hold about you, and to ask that your personal data be corrected, updated, or deleted. If you would like to exercise this right, please contact us. You can revoke any share link yourself at any time, without contacting us.

9. Changes to This Policy

We may update this Privacy Policy from time to time as we launch new features or change our data practices. We will notify you of any changes by posting the new Privacy Policy on this page and updating the date above.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us.

Company: Havelaar US, LLC