ShalloWeDive

The short version

Your dive log stays on your devices unless you act to send it somewhere. There are four ways anything leaves, and each is separate, each is named before it happens, and each can be stopped on its own:

1. Writing out what you said. When you speak about an outing, the words as heard can be sent — as text, never as a recording — through our server to the company whose model writes them out. Only after you allow it on a screen that names that company.
2. The cloud logbook. If you turn it on and sign in with Apple, everything the phone keeps is stored on our server so it is the same on every iPhone you sign in on. Off until you turn it on.
3. Improving the writing-out. What was heard, what came back written out and what you kept can be kept for 24 months to make writing out better — told or asked, as described below.
4. The app's own diagnostics. A record of how the app behaved, and wrist-motion recordings, under two switches of their own.

The watch talks to no server. Your name and your heart rate are never sent anywhere, and the app never reads where your phone is. The one place that leaves is the one a dive computer's file already carries — where it says you went in and out — stored with that imported record by the cloud logbook, if you turned it on. Nothing is sold, used for advertising, or given to anyone to train a model.

What stays on your devices, always

Unless you use the cloud logbook:

• Your dive logbook — every outing, dive, depth, duration and temperature the watch recorded.
• Your notes and outings' records — what you typed, and what you kept after speaking.
• Records you imported from another dive computer, and the files they came from.
• Your breath-hold tables and training sessions, settings, targets, alarms and disciplines.
• Your course sheets — a certification course's items, the results, attempts and pass dates you enter on them, and the names and numbers of instructors as you type them.

These live on your Apple Watch and iPhone. They leave a device when you export them through the iOS share sheet — then they go wherever you send them — or when you turn the cloud logbook on.

1. Writing out what you said

On iOS 26, an outing's page lets you speak about the day. Your iPhone turns the sound into text on the device; the recording is never kept and never sent.

To write that text out as a tidy record, the app sends it to our server, which passes it to a language model and returns the result. Before the first time, a screen names the company whose model will do the writing — currently Anthropic or OpenAI — says what is sent and what is not, and asks your permission. If the company changes, you are asked again before anything is sent to the new one. You can withdraw the permission in About → Writing out; dictation then keeps your words as heard, on the phone.

What is sent for each record:

• the words as heard, and up to twelve other readings the phone's recognizer offered;
• the phone's language;
• up to fifty site and buddy names already in your logbook, so a misheard name can be matched to one you wrote before.

What is never sent: the recording, anything your watch measured, your location, your name.

Who keeps what:

• Our server keeps none of the words unless you allow improvement (section 3). It keeps a line for each request — when, the outcome, the model, its size and cost, the language, the App Store country, the app's version — and none of what you said.
• The model's company receives the text from our server, not from your phone. Under its terms for this kind of use, it may keep requests for up to 30 days to detect abuse and does not use them to train its models.

The preview, and how it is counted

Writing out is offered as a preview of three records a day for a limited time. To count three a day per Apple account without an account of our own, every request carries the App Store's signed record that this copy of the app was bought, and a check from Apple's App Attest that it came from a genuine copy of the app. The server keeps a keyed hash of the App Store's purchase identifier — not your Apple ID, name or email — with the time zone your day is counted in, and the App Attest key's public half. These are kept while the service runs; they hold no words and nothing that names you.

2. The cloud logbook

The cloud logbook is off until you turn it on in About → Cloud logbook, and everything else in the app works the same without it.

Signing in. You sign in with Apple. The app asks Apple for neither your name nor your email; Apple gives our server an identifier that is stable for this app only. Our server also keeps Apple's sign-in token, encrypted, for one purpose: to tell Apple to end the sign-in when you delete your account.

What is stored. Everything the phone keeps: your dives with their measurements, your outings' own records and the words in them, records imported from other dive computers — including the entry and exit points their file carries, since 2.1.0 — your breath-hold tables, your training and in-water sessions, and your course sheets. Each is stored as you have it, so another iPhone signed in to the same account can hold the same, the map of where you went in included.

Where and how long. On a Supabase project operated by Andygile in Seoul, South Korea, kept until you delete it. Supabase is the hosting processor; it stores the data and does not use it. Your records are readable only through your own sign-in; a dive's measurements are used for nothing but returning them to you.

Taking it out and deleting it. In About → Cloud logbook you can:

• Export everything the server holds for you as one file.
• Turn it off, which stops syncing at once and offers to delete the server's copy.
• Delete your account, which erases everything the server holds for it at once, removes it from backups within 30 days, and ends the app's Sign in with Apple for that account.

None of these changes the logbook on your phone. A request made while offline waits, says it is waiting, and is confirmed only when the server has done it. You can also stop the app's use of Sign in with Apple in your iPhone's settings; the app then signs out and keeps your logbook.

3. Improving the writing-out

To make writing out better, the app can keep, for 24 months, what was heard, what came back written out, what you kept, and anything you typed into the remark box on the review — with the language, the app's version and the model. Only ShalloWeDive's maker reads it. Never kept for this: the recording, anything your watch measured, your location, your name.

This has its own switch in About → Writing out, apart from the permission to send the words; writing out works the same either way. Where it starts follows the same rule as diagnostics (below): on and told where the store the app came from allows telling, off and asked where a tap is required or the store cannot be read. In About → Writing out you can also delete everything kept for improvement, which the server confirms.

4. The app's own diagnostics

Two kinds of record, each with its own switch:

1. The app's own event log. A line-by-line record of what the app did — a dive started, a sync succeeded or failed, a screen redrew, an error was raised. It carries outcomes, counts, durations, sizes, language codes, device model identifiers and reasons. It carries no text you wrote or spoke, by design and by a rule the code is written against. Since 2.1.0 it also carries, for each entry the app wrote out, what you did with it — kept as offered, corrected (which fields, never what you wrote), left, a thumbs up or down — keyed to that writing-out, so the maker can tell which model earns its keep.
2. Wrist-motion recordings. The raw accelerometer and gyroscope samples from a dive session, used to measure how far you swam. A stream of numbers: no audio, no images, no location.

Why. The app's measurements were calibrated against a small number of sessions in one pool, on one watch, swum by one person, and are asked to work for everyone. These records are how that gets better.

Told or asked, and where the switches start

On first run, on the same screen that presents the terms and before anything can be sent, the app either tells you that both kinds of record are on or asks you to turn them on. It names what does not leave before it names what does, and says that a record leaves only over Wi-Fi while the device is charging.

Which you get depends on the store the app was offered to you from. Where that store is in the European Economic Area, the United Kingdom or Switzerland, the screen asks: both switches start off, and either turns on only by your tap. Everywhere else the screen tells: both are on from the first launch, and the screen names About → Diagnostics, where either can be turned off at any time. If the store cannot be read, the screen asks, with both off. The app reads the store once, to choose the screen, and keeps nothing of it but the position of each switch.

Nothing in the app is withheld, delayed or reduced if both switches are off.

If you were asked and never touched a switch, the app may ask at most twice more — after you have recorded an outing, and no sooner than thirty days after the last asking. A switch you moved to off is a decision: that kind is never asked about again.

Your answer is kept so that reinstalling the app does not put the question back: on this iPhone, where deleting the app does not erase it, and — if you are signed in to iCloud — in your iCloud account. What is kept is the answer and the date; nothing about your diving.

What happens to a diagnostic record

It is sent over Wi-Fi while charging and never otherwise, exactly as it was written, to a Supabase project operated by Andygile, and kept for 24 months. The one exception is your verdict on a written-out entry: a few counts and field names sent at the moment you decide, over any connection, because they must meet the record of that writing-out while it is fresh — the same switch covers it, and it carries no words. About → Diagnostics lists every record this installation sent; from there you can turn either switch off or ask for what already left to be deleted. You can also send one outing's records deliberately, from that outing, whatever the switches say.

What is never sent, by any of the four

• Your name or your email address. Where your phone is, at any precision: the app never reads it. The entry and exit points a dive computer's file carries go only to the cloud logbook you turned on, with that imported record (section 2).
• Your heart rate, and anything from Apple Health.
• Photographs, audio recordings or contacts.
• A dive's measurements to anyone but our own server, and only for the cloud logbook you turned on.

Apple Health

If you allow it, the app writes your dives to Apple Health as workouts and reads heart rate during a dive. That data stays in Health on your device, under Apple's controls, and is never part of anything above.

Children

The app is not directed at children and collects nothing knowingly from them.

Your rights

Where the law gives you rights over personal data — access, correction, deletion, objection, portability, and to complain to a supervisory authority — you can use them by writing to the address below. The fastest paths are in the app: the cloud logbook's export and account deletion, the improvement deletion in About → Writing out, and the diagnostics list.

If you are in the European Economic Area, the United Kingdom or Switzerland, the lawful basis for sending your words to be written out, for the cloud logbook, for improvement and for diagnostics is your consent — the permission, the sign-in or the switch — withdrawable at any time in the app.

Changes

If this statement changes in a way that affects what leaves your device, the app will say so before anything new is sent. A kind of record that has never been sent before is asked about on its own.

Contact

choi88andys@gmail.com

What earlier versions did

Versions up to and including 1.7.x sent nothing. There was no account, no server and no analytics of any kind; the only way anything left a device was the share sheet, used by the diver.

Nature of Service

ShalloWeDive ("Service") is a shallow water (under 6 meters) dive computer application exclusively for Apple Watch Ultra.

Not a Replacement for Professional Equipment

The Service provides reference information only and does not replace certified diving equipment. Users must always use the Service in conjunction with certified diving equipment and must not rely solely on information provided by the Service.

Assumption of Risk

Underwater activities are inherently dangerous. The developer shall not be liable for any injury, death, equipment damage, or other losses arising from or related to the use of the Service.

Data Accuracy

Data provided by the Service, including depth, water temperature, and heart rate, may vary depending on sensor accuracy and is not guaranteed to be absolutely precise.

Representations and Warranties

Your use of the Service is at your sole risk. The Service is provided on an "AS IS" and "AS AVAILABLE" basis. The Service is provided without warranties of any kind, whether express or implied, including, but not limited to, implied warranties of merchantability, fitness for a particular purpose, non-infringement, or course of performance. Andygile, its subsidiaries, affiliates, and its licensors do not warrant that a) the Service will function uninterrupted, secure or available at any particular time or location; b) any errors or defects will be corrected; c) the Service is free of viruses or other harmful components; or d) the results of using the Service will meet your requirements.

Limitation of Liability

In no event shall Andygile, nor its directors, employees, partners, agents, suppliers, or affiliates, be liable for any indirect, incidental, special, consequential or punitive damages, including without limitation, loss of profits, data, use, goodwill, or other intangible losses, resulting from (i) your access to or use of or inability to access or use the Service; (ii) any conduct or content of any third party on the Service; (iii) any content obtained from the Service; and (iv) unauthorized access, use or alteration of your transmissions or content, whether based on warranty, contract, tort (including negligence) or any other legal theory, whether or not we have been informed of the possibility of such damage.

Governing Law

Any claim relating to our Service shall be governed by the laws of the Republic of Korea without regard to its conflict of law provisions.

Terms and Conditions Updates

We may update Terms and Conditions from time to time. Thus, you are advised to review this page periodically for any changes. If there is a change in the Terms and Conditions, we will notify you 7 days in advance. If you have any objection to changing the Terms and Conditions, please contact andy@andygile.com within the period.