Legal
SleepMethod Privacy Policy
Effective date: 21 August 2026
Last updated: 21 August 2026
SleepMethod is designed to help adults build sleep-supporting habits without unnecessary tracking. This Privacy Policy explains what personal information we use, why we use it and the choices available to you.
1. Who we are
SleepMethod is operated by [CONFIRM: full legal name and legal form], located at [CONFIRM: business or correspondence address], [CONFIRM: Chamber of Commerce registration number, if applicable].
The operator is the controller responsible for personal data processed through SleepMethod unless this Policy identifies another organization as independently responsible.
For privacy requests, contact us at support@sleepmethod.app.
Data-protection contact: [CONFIRM: contact or state that no data protection officer has been appointed].
2. Scope
This Policy covers:
- the SleepMethod iOS and Android applications;
- SleepMethod.app;
- beta, preview and testing versions;
- support and privacy communications; and
- related SleepMethod features and services that link to this Policy.
It does not govern third-party services that apply their own privacy policies, such as Apple App Store and Google Play.
3. Information we collect
Account and contact information
We collect [CONFIRM: exact account fields] when you create or manage an account. This information is provided directly by you. [CONFIRM: which fields are required and which are optional].
Onboarding answers
We collect [CONFIRM: exact onboarding questions and answer categories] to create your initial pattern reveal and starting plan. You provide these answers directly. [CONFIRM: whether onboarding is required to use the core Service].
Sleep-related preferences and behavioral observations
Information may include preferred sleep and wake times, Wake Anchor settings, perceived bedtime alertness, nap-related patterns and other sleep-supporting preferences. [CONFIRM: exact fields collected].
This information is not automatically health data in every context. Some answers or combinations may nevertheless reveal or relate to your physical or mental health. We therefore handle them with additional care. [CONFIRM: Article 9 assessment and condition where data concerning health is processed].
Habits, routines, check-ins and progress
We process [CONFIRM: exact habit, completion, routine, check-in, progress, streak and reflection fields] when you use these features. Information may be provided by you or generated through your interaction with the Service. [CONFIRM: which processing is required and which features are optional].
Personalization information
SleepMethod may derive qualitative statuses, a current focus and recommended plan from your answers and activity. These are generated by the Service and remain wellness estimates, not physiological measurements or medical conclusions.
Device and technical information
We process [CONFIRM: IP address, device model, operating system, app version, language, identifiers, timestamps and other technical fields] to deliver, secure and troubleshoot the Service. This information is generated when your device communicates with our systems or providers.
Diagnostics and crash information
If diagnostics are enabled, we process [CONFIRM: crash logs, performance data and associated identifiers]. [CONFIRM: whether diagnostics are required, optional or subject to consent].
Notifications
If you enable notifications, we process [CONFIRM: push token, reminder settings, notification interaction and delivery information]. Notification permission is optional and can be withdrawn through your device settings.
Subscription and transaction information
If paid subscriptions are introduced, Apple, Google or [CONFIRM: subscription provider] may provide us with transaction identifiers, product, entitlement, renewal and purchase-status information. We do not receive payment-card details when they are processed entirely by the app store. [CONFIRM: exact transaction data received].
Support communications
We process the information you include when contacting support, along with [CONFIRM: support metadata and attachments collected]. Providing unnecessary medical details is discouraged.
Website information
The website processes ordinary server-request information such as [CONFIRM: exact server logs]. It also uses [CONFIRM: cookies, local storage, analytics, embedded services and third-party fonts].
Optional connected-health information
Apple Health and Google Health Connect are not represented as active launch features. If an optional integration is introduced, we will update this Policy before accessing connected-health information and request the relevant platform permission.
We do not collect precise location, contacts, microphone recordings, photos, camera data, motion data or Bluetooth data unless explicitly disclosed here and requested through a device permission. Current status: [CONFIRM: permissions used].
4. How we use information
We use personal information only for defined purposes:
- to create and maintain an account;
- to provide the requested Service and save settings;
- to generate an initial pattern reveal and personal starting plan;
- to adapt qualitative recommendations from answers and check-ins;
- to save habits, routines, progress and reflections;
- to provide Wind Down routines, breathing, meditation and audio;
- to send reminders you request;
- to authenticate users and protect accounts;
- to investigate crashes, security incidents and technical problems;
- to respond to support and privacy requests;
- to manage purchases and subscription entitlements;
- to improve usability and reliability using [CONFIRM: analytics design and data]; and
- to comply with legal obligations and establish or defend legal claims.
We do not use sleep-related information for targeted advertising. We do not sell personal information or provide it to data brokers. [CONFIRM: this is technically and contractually true for every SDK and provider].
5. Legal bases
| Purpose | Data involved | GDPR legal basis | Explanation |
|---|---|---|---|
| Provide accounts and requested features | Account data, settings, plan, habits and routines | Contract, Article 6(1)(b) | Needed to provide features the user requests. |
| Onboarding and ordinary personalization | Answers and derived qualitative outputs | Contract, or consent where required | Contract may cover ordinary requested personalization. [CONFIRM: Article 9 assessment]. |
| Process data concerning health, if applicable | Sleep-related answers or connected-health data that qualify under Article 9 | [CONFIRM: likely explicit consent under Articles 6(1)(a) and 9(2)(a), or another valid condition] | Special-category processing requires both an Article 6 basis and an Article 9 exception. |
| Save habits, check-ins and progress | Behavioral events and reflections | Contract | Used to provide requested tracking and adaptation. |
| Send optional reminders | Push token, schedule and preferences | Consent, Article 6(1)(a), where required | Permission is optional and withdrawable. |
| Essential security and fraud prevention | Account, device, network and security logs | Legitimate interests, Article 6(1)(f) | Protects users and the Service, subject to a balancing test. |
| Optional analytics | Technical and usage events | Consent, Article 6(1)(a), where ePrivacy consent is required | Non-essential analytics should not load before valid consent. |
| Necessary diagnostics | Crash and performance information | [CONFIRM: contract or legitimate interests, and whether consent is required] | Depends on configuration, identifiers and necessity. |
| Support | Contact details and communications | Contract or legitimate interests | Used to answer requests and resolve problems. |
| Purchases and entitlements | Transaction and subscription status | Contract and legal obligation | Used to provide paid access and maintain required records. |
| Legal compliance and claims | Relevant account, transaction, consent and security records | Legal obligation, Article 6(1)(c), or legitimate interests, Article 6(1)(f) | Limited to applicable requirements and defensible claims. |
| Marketing communications | Email address and consent record | Consent, Article 6(1)(a), unless a narrow legal exception applies | Users can unsubscribe at any time. |
Where we rely on legitimate interests, you may request information about the balancing assessment and may object as explained in Section 13.
6. Personalization and automated processing
SleepMethod may automatically compare onboarding answers, habits and check-ins with predefined logic to select qualitative statuses, focus areas or recommendations. [CONFIRM: actual logic and whether any AI determines personal recommendations].
These outputs are estimates for general wellness guidance. They do not make legal decisions, determine access to essential services or otherwise produce legal or similarly significant effects. [CONFIRM: this remains true].
You can change [CONFIRM: editable inputs] and contact us if an output appears inaccurate or unsuitable. [CONFIRM: whether manual review is available].
7. AI-assisted content
Some meditation scripts, spoken voices, soundscapes or other audio may be created, narrated or produced with assistance from artificial intelligence.
AI-assisted prerecorded content is general wellness content. It is not a live interaction with a human instructor, therapist or healthcare professional.
AI providers: [CONFIRM: provider names and roles]. Personal information sent to those providers: [CONFIRM: none, or exact data and purpose]. Provider retention and model-training use: [CONFIRM: settings and contractual terms]. Human review before publication: [CONFIRM: process].
If generic audio is created without user information, that creation is not itself processing of a user’s personal data. We will not submit personal sleep answers to an AI service unless that processing is separately disclosed, legally assessed and supported by an appropriate lawful basis.
8. When information is shared
We share information only as needed for the purposes described here:
| Recipient | Purpose and role |
|---|---|
| [CONFIRM: hosting and database providers] | Host the Service and store information, normally as processors. |
| [CONFIRM: authentication provider] | Authenticate accounts, normally as a processor or independent controller depending on the service. |
| [CONFIRM: analytics provider] | Measure approved usage events, role to be confirmed. |
| [CONFIRM: crash-reporting provider] | Diagnose technical failures, normally as a processor. |
| Apple, Google and [CONFIRM: notification provider] | Deliver notifications and operate device platforms, often under their own terms. |
| [CONFIRM: email and support providers] | Deliver communications and manage support, normally as processors. |
| [CONFIRM: audio hosting or CDN] | Deliver audio and related files, normally as a processor. |
| [CONFIRM: AI providers] | Create content or perform another confirmed service, role depends on processing terms. |
| Apple App Store, Google Play and [CONFIRM: subscription provider] | Process purchases and manage entitlements. Apple and Google generally act under their own legal responsibilities for store transactions. |
| Professional advisers | Provide legal, security, accounting or insurance assistance under confidentiality duties. |
| Authorities | Receive information where disclosure is legally required or necessary to protect legal rights. |
| Business-transfer parties | Evaluate or complete a merger, acquisition, financing, restructuring or sale, subject to safeguards and notice where required. |
SleepMethod does not sell personal information or share it with data brokers or for targeted advertising. [CONFIRM: all SDK and vendor practices are consistent with this statement].
9. International transfers
Information is processed in [CONFIRM: countries for production, support, analytics, audio, AI and backups].
Where personal data is transferred outside the European Economic Area, we use [CONFIRM: applicable adequacy decisions, Standard Contractual Clauses or other Article 46 safeguards] and supplementary safeguards where required.
You may contact support@sleepmethod.app to request more information about relevant transfer safeguards.
10. Data retention
| Category | Retention |
|---|---|
| Active account and profile | [CONFIRM: period and criteria] |
| Deleted account | [CONFIRM: operational deletion timeline and lawful exceptions] |
| Onboarding and personalization | [CONFIRM: period] |
| Habits, routines, check-ins and progress | [CONFIRM: period] |
| Analytics events | [CONFIRM: period] |
| Crash and diagnostic logs | [CONFIRM: period] |
| Support requests | [CONFIRM: period] |
| Subscription and transaction records | [CONFIRM: period based on legal and accounting duties] |
| Backups | [CONFIRM: backup cycle and deletion timeline] |
| Security logs | [CONFIRM: period] |
| Consent and withdrawal records | [CONFIRM: period needed to demonstrate compliance] |
When setting these periods, we consider the purpose, sensitivity, user expectations, security needs and applicable legal obligations. Information is deleted or irreversibly anonymized when the relevant period ends, unless a narrow legal exception applies.
11. Security
We use reasonable technical and organizational measures designed to protect personal information. Implemented safeguards are [CONFIRM: encryption in transit, encryption at rest, authentication controls, least-privilege access, provider review, monitoring, backups and incident response].
No service can guarantee absolute security. Please use a unique password and contact us if you suspect unauthorized account access.
12. Your choices and controls
Depending on available features, you can:
- change [CONFIRM: profile fields and plan inputs];
- change device permissions through iOS or Android settings;
- disable notifications through device settings and [CONFIRM: in-app settings];
- disconnect a future Apple Health or Health Connect integration;
- withdraw optional consent without affecting earlier lawful processing;
- unsubscribe from marketing using the link in each message;
- request access, correction, export or deletion at support@sleepmethod.app; and
- delete your account through [CONFIRM: exact in-app route] or [CONFIRM: website deletion URL].
Deleting an account does not automatically cancel an Apple App Store or Google Play subscription. Store subscriptions must be cancelled through the relevant store account.
13. Your privacy rights
Subject to legal conditions and exceptions, the GDPR gives you the right to:
- access personal data we hold about you;
- correct inaccurate or incomplete data;
- request deletion;
- restrict certain processing;
- object to processing based on legitimate interests or direct marketing;
- receive certain data in a portable format;
- withdraw consent at any time; and
- complain to a supervisory authority.
Requests can be sent to support@sleepmethod.app. We may request only the information reasonably necessary to verify identity. We generally respond within one month, subject to the extensions allowed by law.
In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens. Information is available at https://autoriteitpersoonsgegevens.nl.
14. Children
SleepMethod is intended for adults aged 18 and older. [CONFIRM: age-screening or verification approach].
If we learn that we processed information from someone under 18 contrary to this restriction, we will investigate and delete it where appropriate. A parent, guardian or affected person may contact support@sleepmethod.app.
15. Cookies and similar technologies
Website
SleepMethod.app uses [CONFIRM: essential cookies, local storage, analytics, embedded services, tracking pixels and third-party fonts]. Essential technology supports requested functions and security. Non-essential analytics or marketing technology will be used only after legally required consent.
Cookie controls: [CONFIRM: consent banner and preference mechanism, or verified cookieless configuration].
Mobile app
The app may use secure device storage and ordinary network communications to save settings, authenticate accounts and provide requested features. [CONFIRM: SDK storage and tracking identifiers].
SleepMethod does not use advertising trackers. [CONFIRM: true for all builds and SDKs].
16. Health-platform integrations
Apple Health and Google Health Connect are future, optional features and are not described as active at launch. SleepMethod will not access connected-health information unless you activate an integration and grant the requested platform permissions.
Before launch of an integration, this Policy must identify:
- the exact data types read and written;
- the purpose of each permission;
- whether information is stored outside the health platform;
- retention and deletion rules;
- how access can be revoked; and
- applicable Apple and Google restrictions.
Connected-health information will not be used for advertising or sold to data brokers.
17. Business changes and legal disclosures
If SleepMethod is involved in a merger, acquisition, financing, restructuring or sale, relevant information may be disclosed under confidentiality and data-minimization safeguards. Users will receive notice where required, and the receiving party must respect applicable privacy rights.
We may disclose information where required by law, a binding legal process or a competent authority, or where necessary to establish, exercise or defend legal claims.
18. Changes to this Policy
We may update this Policy when the Service, law or our data practices change. Material changes will be communicated through the app, website, email or another appropriate channel before they take effect where required.
Continued use does not replace consent where a change legally requires new consent.
19. Contact
Controller: [CONFIRM: full legal name and legal form]
Brand: SleepMethod
Address: [CONFIRM: business or correspondence address]
Privacy email: support@sleepmethod.app
Data-protection contact: [CONFIRM: contact or not appointed]
You may also contact the Autoriteit Persoonsgegevens through https://autoriteitpersoonsgegevens.nl.