Legal
Privacy policy
Last updated: August 2, 2026 (draft)
Data controller
[Pending: legal name, tax ID, address, and contact details of the controller. To be completed before processing the first real user's health data.]
What data we process and why
Account data (name, email, encrypted password): to create and maintain your account. Therapy data you log yourself (usage hours, AHI, leaks, notes, tags): to show you your own history and, with your additional explicit consent, for pattern analysis over your own data. We do not use your therapy data to train models or share it with third parties for commercial purposes.
Legal basis and specific consent for health data (GDPR Art. 9)
Therapy data is health data (special category, GDPR Art. 9). It is processed only with your explicit consent, requested separately from account sign-up — it is not implied by accepting these terms. You can withdraw that consent at any time from your profile, which stops processing of new data (it does not retroactively delete data unless you explicitly request it, see below).
Where your data is hosted
On Supabase servers, Frankfurt region (European Union). Encryption in transit is standard (TLS); therapy data fields (usage, AHI, leaks, notes, tags) are additionally encrypted at the column level in the database, so that direct database access does not reveal those values in plain text.
Who we share data with
With our infrastructure providers (hosting, database) strictly as data processors, never as a transfer to third parties for their own purposes. If at any point we use a language model (AI) to analyze your history, it only receives aggregated, anonymized series — never your name, email, or any direct identifier.
Your rights
Access, rectification, portability, objection, and restriction of processing, exercisable from your profile or by writing to [pending: privacy contact email]. The right to erasure is executed as a real, irreversible deletion, not a simple flag — when you request it, your therapy data stops existing in our database.
Retention
For as long as you keep your account active. If you delete it, your therapy data is deleted for real (not soft-deleted) following the process described above.
Cookies and analytics
We do not use third-party analytics on the private pages of the app (journal, patterns, consumables, assistant). [Pending: confirm and detail any technical or analytics cookies used on public pages before publishing this document as final.]