Privacy Policy

1. Overview

SnoozeSync LLC ("SnoozeSync," "we," "us," or "our") provides a cognitive behavioral therapy for insomnia (CBT-I) wellness application available through web browsers, the Apple App Store, and Google Play. This Privacy Policy describes how we collect, use, share, and protect your information when you use our app, our website at snoozesync.com, or our subscription services (collectively, the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Email address, password (stored as a one-way hash), and optional profile information you provide during onboarding.
• Sleep Diary Entries: Bedtime, wake time, sleep latency, number of awakenings, sleep quality ratings, and any notes you record.
• Sleep Severity Score (SSS) Responses: Your answers to the SnoozeSync proprietary 7-question sleep severity assessment.
• AI Coach Conversations: Messages you send to and receive from the AI Sleep Coach.
• Health and Wellness Information: Medications, sleep history, lifestyle factors, and goals you choose to share with the AI Coach or enter in your profile.
• Communications: Emails, support requests, and feedback you send to us.

2.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type, screen size, and unique device identifiers.
• Usage Data: Pages viewed, features used, time spent in the app, lessons completed, and engagement patterns.
• Log Data: IP address, access times, error reports, and crash logs (collected via Sentry — see Section 5).
• Cookies and Local Storage: We use browser cookies and the localStorage API to remember your login status, trial progress, preferences, and feature unlock state. See Data Storage for details.

2.3 Information from Third Parties

• Subscription and Purchase Data: Information from Apple, Google, or Stripe confirming a subscription purchase, payment status, renewal, or cancellation.
• Authentication Data: If you sign in via Apple ID, Google, or another identity provider, we receive your email address and a unique identifier from that provider.

3. How We Use Your Information

We use your information to:

• Provide the Service: Deliver CBT-I content, sleep diary functionality, AI coaching, sleep restriction calculations, and progress tracking.
• Personalize Your Experience: Generate personalized AI Coach responses, lesson recommendations, and Sleep Severity Score (SSS) interpretations based on your data.
• Process Subscriptions: Manage your subscription status, billing, renewals, and cancellations through Apple, Google, or Stripe.
• Communicate with You: Send transactional emails (receipts, password resets, subscription updates), respond to support requests, and — only with your consent — send product updates or educational content.
• Improve the Service: Analyze usage patterns to improve features, fix bugs, and develop new functionality. This analysis is conducted on aggregated, de-identified data wherever possible.
• Ensure Safety and Security: Detect and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
• Comply with Legal Obligations: Respond to lawful requests from public authorities, comply with applicable laws, and enforce our agreements.

We do not use your sleep diary entries, AI Coach conversations, or health information for advertising, marketing to third parties, or any purpose other than providing and improving the Service.

4. Third-Party AI Processing (Google Gemini)

4.1 What Data Is Sent to Google Gemini

• Messages you send to the AI Coach (including any health, lifestyle, or sleep-related content you choose to share)
• Your sleep diary entries, including the free-text notes you write. The AI Coach is sent your full diary history with each message so it can reference past nights; the AI insight/analysis feature is sent your recent entries (about the last two weeks).
• Your Sleep Severity Score (SSS) responses, when you request analysis
• System prompts and grounding documents (CBT-I educational content) we send alongside your request

4.2 What Data Is NOT Sent

• Your name, email address, or contact information
• Your password or any authentication credentials
• Your payment information
• Your IP address (Google may receive it as part of standard internet protocol, but we do not transmit it as part of the request payload)

4.3 How Google Uses This Data

According to Google's published policies for the Gemini API:

• Data submitted to the Gemini API is not used to train Google's AI models.
• Data is processed solely to generate the response you requested.
• Google's data handling is governed by the Google Privacy Policy and the Gemini API Additional Terms of Service.

4.4 Your Consent and Control

The first time you use the AI Coach or any AI-powered feature, you will see a consent dialog explaining what data is sent and to whom. You may decline. If you decline:

• The AI Coach will be disabled for your account.
• The rest of SnoozeSync (sleep diary, lessons, SSS, sleep restriction calculator, relaxation library) will continue to function normally.
• You can change this preference at any time in Settings.

5. Third-Party Services and Data Sharing

We share data with the following service providers, only as needed to operate the Service. We do not sell your data to anyone.

Each of these providers is contractually obligated to handle your data in accordance with applicable privacy laws and to use it only for the purposes described above. We do not authorize any of these providers to sell, rent, or use your data for their own marketing purposes.

5.1 Other Disclosures

We may also disclose your information:

• Legal Compliance: If required by law, subpoena, court order, or other legal process.
• Safety: If we believe disclosure is necessary to protect the rights, property, or safety of SnoozeSync, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the acquiring entity will be bound by this Privacy Policy or a substantially similar one.
• With Your Consent: Any other disclosure for which you provide explicit consent.

6. Payment Processing

SnoozeSync does not directly handle or store your full payment card details. Payment processing is handled by:

• Apple App Store for iOS subscriptions (Apple is the merchant of record)
• Google Play for Android subscriptions (Google is the merchant of record)
• Stripe for direct web subscriptions (SnoozeSync LLC is the merchant of record; Stripe processes payments on our behalf)

Each of these processors has its own privacy policy governing how they handle your payment data:

• Apple Privacy Policy
• Google Privacy Policy
• Stripe Privacy Policy

7. Data Storage and Retention

7.1 Where Data Is Stored

• On Your Device: Most personal sleep data — including sleep diary entries, profile information, trial progress, AI Coach conversation history (cached for 7 days), and feature preferences — is stored locally on your device using browser localStorage. Specific localStorage keys include snoozesync_logs, snoozesync_profile, snoozesync_onboarded, and trial-related state.
• On Our Servers and Service Providers' Servers: Account credentials, subscription status, support communications, and error logs are stored on servers operated by Netlify (United States), Stripe (United States), and Sentry (United States).
• Transient Processing: AI Coach messages are sent to Google's Gemini API for processing. We do not retain a server-side copy of these messages beyond the time needed to deliver the response to your device.

7.2 How Long We Retain Data

• Active Account Data: Retained for as long as your account is active.
• After Account Cancellation: Personal data is retained for 90 days after cancellation to handle billing disputes, support requests, and legal obligations, then deleted unless a longer retention period is required by law.
• Aggregate Analytics: De-identified aggregate data may be retained indefinitely for product improvement.
• Legal Holds: If we are required by law to retain certain information longer (e.g., for tax or regulatory reasons), we will do so only for the period required.

7.3 Local Data on Your Device

Data stored locally on your device persists until you clear your browser storage, uninstall the app, or use the Service's "Delete My Data" option in Settings.

8. Data Security

We implement reasonable technical and organizational measures designed to protect your information, including:

• HTTPS/TLS encryption for all data transmitted between your device and our servers
• Encryption at rest for data stored in our service providers' databases
• Hashed (one-way encrypted) password storage
• API key restrictions limiting access to authorized SnoozeSync services only
• Regular security reviews and dependency updates
• Access controls limiting employee and contractor access to personal data on a need-to-know basis

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security. If you suspect your account has been compromised, please contact us immediately at support@snoozesync.com.

9. Your Privacy Rights

Regardless of where you live, you have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to certain exceptions (e.g., legal retention requirements).
• Portability: Request a machine-readable copy of your data.
• Withdraw Consent: Where we rely on your consent, withdraw it at any time.
• Object to Processing: Object to our processing of your data for specific purposes.

To exercise any of these rights, email us at support@snoozesync.com with the subject line "Privacy Request." We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: What categories of personal information we collect, the sources, the purposes, and the third parties with whom we share it.
• Right to Delete: Request deletion of your personal information.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: Limit our use of certain categories of sensitive personal information.
• Right to Opt-Out of Sale or Sharing: SnoozeSync does not sell your personal information and does not share it for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise these rights, contact us at support@snoozesync.com.

11. European Privacy Rights (GDPR/UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / "right to be forgotten" (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to lodge a complaint with a supervisory authority

11.1 Legal Bases for Processing

We process your personal data on the following legal bases:

• Performance of a Contract (Article 6(1)(b)): To deliver the subscription Service you requested.
• Consent (Article 6(1)(a)): For optional features (e.g., AI Coach with Gemini processing) and marketing communications.
• Legitimate Interests (Article 6(1)(f)): For security, fraud prevention, and product improvement, balanced against your rights.
• Legal Obligation (Article 6(1)(c)): For tax, accounting, and regulatory compliance.

For data concerning health (sleep, wellness), we rely on your explicit consent under Article 9(2)(a) GDPR.

11.2 Data Controller

SnoozeSync LLC is the Data Controller of your personal information. Contact: support@snoozesync.com.

12. Children's Privacy

SnoozeSync is intended for adults age 18 and older. We do not knowingly collect personal information from individuals under 18. If you are under 18, please do not use the Service or provide any information to us.

If we become aware that we have collected personal information from a person under 18 without verified parental consent, we will delete that information promptly. If you are a parent or guardian and believe your child has provided us with information, contact us at support@snoozesync.com.

13. International Data Transfers

SnoozeSync is based in the United States, and our service providers (Apple, Google, Stripe, Netlify, Sentry) primarily operate from the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those of your country.

For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission, supplementary safeguards where required, and the recipient's compliance with applicable data protection frameworks.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last Updated" date at the top of this page
• For material changes, notify you by email or through a prominent notice in the Service before the changes take effect
• For changes that expand our use of your personal information beyond what was previously disclosed, obtain your consent where required by law

Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes.

15. Contact Us

For privacy questions, requests, or to exercise your rights under this Privacy Policy:

SnoozeSync™ is a trademark of SnoozeSync LLC, a Virginia limited liability company. SnoozeSync provides educational CBT-I content and is not a substitute for professional medical advice, diagnosis, or treatment.