Privacy Policy

1. What information do we collect?

Personal information you disclose to us

If you email us, we process the email address and message you choose to send so that we can respond. SleepTight does not provide account registration, login, social sign-in, or an in-app email field.

Application data

The current app processes sleep-time windows that you confirm, including their start and end times, time zone, source and a session identifier. They represent user-confirmed time records, not measurements of sleep stages or medical information. The current app does not record audio or request microphone permission. Optional self-rating data is accepted by the service API but is not sent by the current iOS app. We use the submitted records to provide synchronization and related features that you request.

If a future feature requests access to a device capability, the app will explain that request and you can manage the permission in your device settings. This version does not use notifications.

Information automatically collected

When the app synchronizes a confirmed record, the service receives an installation credential and the record fields described above, along with limited request metadata such as platform and environment. Our application access logs use static route names and allowlisted operational fields; they are designed not to record IP addresses, authentication credentials, request bodies, raw URLs, or installation and record identifiers. Hosting or network providers may process connection data, such as an IP address, to deliver and protect the service under their own systems.

The app uses Sentry for crash diagnostics. Reports may contain crash stacks, exception reasons, and app, device, operating-system, and SDK information; they may be stored on your device before upload. We do not intentionally attach synchronized records or other user content to crash reports. Product usage analytics are currently disabled. These public information pages do not use analytics scripts, advertising trackers, or cookies; hosting or network infrastructure may separately process connection data.

2. How do we process your information?

We process information to provide, improve, and administer our Services, communicate with you, maintain security and prevent abuse, and comply with law. Depending on how you interact with the Services, we may use information to:

• Deliver the features and services you request.
• Respond to inquiries, provide support, and resolve technical issues.
• Evaluate and improve reliability, functionality, and your experience.
• Protect the Services and enforce our terms.
• Fulfill legal obligations and respond to lawful requests.

We process information for other purposes only where we have an applicable legal basis, including your consent where required.

3. What legal bases do we rely on?

We process personal information only when we believe it is necessary and we have a valid legal reason under applicable law. These reasons may include your consent, providing requested services and fulfilling contractual obligations, our legitimate interests in operating and securing the Services where those interests do not override your rights, and compliance with legal obligations.

Where processing is based on consent, you may withdraw it by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal. If you are in Canada, we may rely on express or implied consent where permitted by law, and may process information without consent in limited circumstances authorized by applicable law, such as lawful investigations or court orders.

4. When and with whom do we share information?

We may share information with service providers that assist us with hosting, infrastructure, application functionality, diagnostics, and customer support, to the extent needed for those services. Sentry provides crash diagnostics; see Sentry’s Privacy Policy. If an AI summary feature is made available and you give the required consent, the service may send the limited summary inputs described in the app and API notice to the configured model provider; the current iOS build does not expose that feature. We will update this notice if the providers or data flows materially change.

We may disclose information to comply with law or legal process, protect rights and safety, investigate abuse, or in connection with a merger, financing, acquisition, or transfer of business assets. We do not sell personal information or share it for cross-context behavioral advertising.

Information may be processed in countries other than your country of residence. Where applicable law requires safeguards for international transfers, we apply the required safeguards.

5. How long do we keep your information?

Confirmed records are stored on your device and, if synced, on our server until you delete them or we no longer need them to provide the Service. The current service does not apply a fixed automatic expiry period to active installation or record data. When you delete a record, it is removed from the app immediately and the server deletion is sent when the app reconnects. The server retains a limited deletion marker to prevent an old queued upload from restoring that record. Installation credentials and security records may remain while needed to operate the installation and protect the Service. Sentry and infrastructure providers apply their own retention schedules; we do not state a fixed provider retention period here.

Removing the application may remove local data but does not itself delete information already held by the Services. Contact us if you need help with a privacy request about synced data.

6. How do we keep your information safe?

We implement reasonable technical and organizational measures designed to protect personal information. However, no electronic transmission or storage technology can be guaranteed to be completely secure. Please use the Services within a secure environment and protect access to your device.

7. Do we collect information from minors?

We do not knowingly collect or solicit personal information from, or market to, children under 18 or the equivalent age specified by applicable law. If we learn that information has been collected without appropriate authorization, we will take reasonable measures to delete it. Please contact us if you believe a child has provided information to us.

8. What are your privacy rights?

Depending on where you live, you may have rights to request access and a copy of your information, correction, deletion, restriction, portability, or objection to processing. You may withdraw consent where processing relies on it and may lodge a complaint with your local data protection authority. We consider and act on requests in accordance with applicable law.

SleepTight has no login account, but synchronization uses an anonymous installation credential to authorize access to records for that installation only. To locate information associated with your installation, we may need reasonable additional information to verify and fulfill a request. Please do not send passwords, payment information, or authentication tokens by email.

9. Controls for Do-Not-Track features

Some browsers and operating systems offer Do-Not-Track signals. We do not currently respond to these signals. These public pages do not perform advertising tracking. Where applicable law requires us to honor a recognized privacy preference signal, we will do so.

10. Do United States residents have specific privacy rights?

Depending on your state and applicable law, you may have rights to know the categories and specific pieces of information we process, obtain a copy, correct inaccuracies, request deletion, withdraw consent, limit certain uses of sensitive information, or appeal a request decision. We do not discriminate against you for exercising these rights.

The categories we may process include an installation identifier and authentication credential, contact details you provide when emailing support, technical and diagnostic information, and user-confirmed time-window records. Sources, purposes, recipients, and retention practices are described above. We do not sell personal information or share it for targeted advertising.

You or an authorized agent can contact us to make a request. We may verify your identity and an agent’s authority before fulfilling it, and may decline or limit requests where permitted by law. If you wish to appeal a decision, reply to our response with your appeal.

11. Do we make updates to this notice?

We may update this notice from time to time. The revised date at the top indicates the latest version. Where changes are material, we will provide notice as required by applicable law. We encourage you to review this notice periodically.

12. How can you contact us?

If you have questions or comments about this notice, contact NEXALIFY LIMITED at [email protected].

13. How can you review, update, or delete your data?

The current app lets you delete individual records. That deletion is queued for the server if your device is offline and completes after the app reconnects. The app does not currently provide a self-service export or full account-data dashboard. You may also contact [email protected] to request access, correction, or deletion under applicable law. Please identify SleepTight and describe your request; because there is no login account, we may need reasonable information to verify which installation’s information you are authorized to access. Do not email your installation token or other authentication secrets.