HYDRATE_PRIVACY

Effective 5 November 2026 · Version 1.0 · Applies to the Hydrate app for Android (package com.openwater.sync)

1. Who is responsible

Hydrate is developed and published by Glen Muthoka Mutinda, an individual developer based in the United Kingdom (“the developer”, “we”, “us”). For the limited personal data that the developer itself receives, such as correspondence you send us, the developer is the controller within the meaning of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Most data used by Hydrate never leaves your device and is never accessible to the developer. You remain in control of that data at all times. Third-party services you choose to connect, such as Health Connect, Samsung Health and Google Maps, process data under their own privacy policies.

Contact: [email protected]

2. Data Hydrate processes

Hydrate does not collect your name, email address, contacts, photos, advertising identifier or browsing activity, and it contains no advertising or analytics software development kits.

3. Purposes and legal bases

Hydrate uses the data above solely to provide the features you request: recording your water intake, calculating and displaying your daily goal and statistics, sending the reminders you configure, synchronising with your smart bottle and helping you locate it.

Data concerning health is a special category of personal data. To the extent that data protection law applies to processing carried out within the app, it relies on:

• Your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR / UK GDPR) for health data and location data. You give this consent through the Android, Health Connect and Samsung Health permission screens and by entering profile details, and you may withdraw it at any time without affecting the lawfulness of earlier processing.
• Performance of the service you request (Article 6(1)(b)) for non-health data needed to operate the app, such as preferences and bottle pairing details.
• Legitimate interests (Article 6(1)(f)) in responding to messages you send us.

Data obtained through Health Connect is used only to provide Hydrate’s hydration features. It is not used for advertising, is not sold, and is not transferred to any third party. Hydrate’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

4. Health Connect and Samsung Health

If you grant permission, Hydrate writes your drink entries to Health Connect and/or Samsung Health and reads hydration totals from them so that your daily progress is consistent across apps. It may also read height, weight, steps and energy expenditure to personalise your recommended daily goal. With your permission, Hydrate can read hydration data in the background so that bottle synchronisation keeps your total accurate while the app is closed.

Records written to Health Connect or Samsung Health remain in those services after you stop using Hydrate. You can review and delete them in those apps. Samsung Health may back up your data to Samsung’s servers if you have enabled that option in Samsung Health; see Samsung’s privacy notice.

5. Smart bottles and Bluetooth

Hydrate communicates with compatible smart bottles directly over Bluetooth Low Energy. Data exchanged with the bottle stays between the bottle and your phone. On Android 11 and earlier, the operating system requires location permission to scan for Bluetooth devices; Hydrate does not use that permission to determine your location during scanning.

Hydrate is an independent app. It is not affiliated with, endorsed by or sponsored by the manufacturer of any bottle it supports. Product names are used only to identify compatible devices.

6. Location and Google Maps

Find My Bottle is optional. If you allow location access, Hydrate records your phone’s location at the moment it connects to your bottle, using Google Play services, so that it can show where the bottle was last seen. Only the most recent location is kept, and it is stored on your device.

When you open the Find My Bottle map, the map is provided by the Google Maps SDK. To display the map, Google receives your device’s IP address, technical information about your device and the map area being displayed. Google processes this information as an independent controller under the Google Privacy Policy. Choosing “Open in Google Maps” passes the bottle’s last known coordinates to the Google Maps app or website.

Hydrate does not request background location access, and all other features work without location permission.

7. Recipients and international transfers

The developer does not receive, sell, rent or share your app data. Data is disclosed only to services that you choose to use:

• Health Connect (Google, on-device) and Samsung Health (Samsung Electronics), when you grant permission;
• Google, through the Google Maps SDK and Google Play services location, when you use Find My Bottle;
• Google, through Android Backup, if you have enabled device backup (see section 8).

Google and Samsung may process data outside the European Economic Area and the United Kingdom, including in the United States. Such transfers are made by those providers under their own safeguards, such as the EU–US Data Privacy Framework, its UK extension and Standard Contractual Clauses.

8. Storage and retention

Data stored by Hydrate remains on your device until you delete it. You can remove all of it at any time by choosing Settings › Apps › Hydrate › Storage › Clear storage or by uninstalling the app. The last known bottle location is overwritten each time your bottle connects.

If Android Backup is enabled on your device, Android may include Hydrate’s data in your device backup stored in your Google account. Google encrypts these backups, and you can manage or delete them in your Google account settings.

If you email us, we keep the correspondence for as long as needed to deal with your request and in any event no longer than 24 months, unless a longer period is required by law.

9. Security

Hydrate stores data in the app’s private storage, which Android isolates from other apps. Data in transit to Google services is encrypted. Because the app does not transmit your log to the developer, there is no central database that could be breached. You can further protect your data by using a screen lock and keeping your device updated.

10. Your rights

Under the GDPR and UK GDPR you have the right to:

• access the personal data held about you and receive a copy of it;
• have inaccurate data rectified;
• have your data erased;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time; and
• lodge a complaint with a supervisory authority.

Because your app data is held on your own device, you can exercise most of these rights directly: you can view and edit your log and profile in the app, export or delete records through Health Connect or Samsung Health, revoke permissions in Android settings, and erase everything by clearing the app’s storage. Instructions are available on the Your data page. For any request concerning data the developer holds, such as correspondence, contact [email protected]. We will respond within one month.

11. Children

Hydrate is not directed at children under 16. We do not knowingly process personal data of children. Daily intake recommendations in the app are designed for adults; children should follow the advice of a parent, guardian or healthcare professional.

12. Donations

Hydrate is free. If you choose to make a voluntary donation, the payment is handled entirely by the external payment provider you use, which processes your payment details under its own privacy policy. The developer receives only the information the provider makes available, such as your name or display name, the amount and any message you include, and uses it solely to record and acknowledge the donation and to meet legal record-keeping obligations. Donating does not change how the app handles your data.

13. Automated decision-making

Hydrate calculates a recommended daily goal from the profile and activity data you provide. This calculation is a suggestion that you can change at any time; it does not produce legal or similarly significant effects, and no automated decision-making within the meaning of Article 22 GDPR takes place.

14. Changes to this policy

We may update this policy to reflect changes to the app or to the law. The effective date at the top shows when it was last revised. If a change materially affects how your data is handled, we will inform you within the app before the change takes effect.

15. Contact and complaints

For questions about this policy or your data, contact [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority. In the United Kingdom this is the Information Commissioner’s Office. In the European Union you may contact the authority in the Member State where you live or work, or where an alleged infringement occurred; a list is published by the European Data Protection Board.