Last updated: October 7, 2026
Hydration records, goals, scenes, and studio settings stay on this device. Optional Google sign-in provides an identifier, name, email, and avatar; optional Apple sign-in provides an identifier and, when available, a verified email. Google and Apple app accounts are independent and are never merged by email. Our own server stores the account, session, membership snapshot, and encrypted Apple token needed to revoke authorization. Hydration records are not uploaded.
Google or Apple authenticates the app account. Google Play or App Store processes subscriptions; RevenueCat loads products, purchases, restores, and subscription status. Our Cloudflare Worker and D1 verify membership. Water Box does not store complete payment card details. There are no ads, browsing or click analytics, or crash-reporting services. RevenueCat processes transaction and subscription statistics for subscription services.
Hydration records stay on this device and are removed when app data is erased or the app is uninstalled. Signing out, uninstalling, or deleting an account does not cancel subscriptions. Manage subscriptions in the store. When Apple account services are enabled, Account & membership offers Delete account, which removes the server account and revokes Apple authorization; failed deletion can be retried. Google account deletion uses the configured public deletion channel. Pending deletion requests retain the information needed to finish deletion. Completed requests keep non-readable verification records for retry confirmation; these have a 30-day retention window and are cleaned up during subsequent service requests. Account deletion does not erase transaction records that the store or RevenueCat retains for required purposes.
Water Box is a hydration logging and visualization tool. It does not provide medical diagnosis, treatment, or personalized medical advice. Consult a qualified professional for advice based on your circumstances.
Our Cloudflare backend processes the request IP address and app account identifier as rate-limit keys to prevent abuse. These keys and counters are processed across requests; the 60-second rate window is not a guaranteed deletion deadline. We do not use IP addresses to infer location or for advertising. Cloudflare and RevenueCat also process network and service metadata needed to provide and secure their services under their own policies.