The short version
- You can use BreathWave without creating an account.
- Guest progress and preferences stay on your device unless you later choose to import eligible guest history into an account.
- An account lets you synchronize practice history, course progress, favorites, mood check-ins, and comments.
- We do not sell personal data, show advertising, or use third-party advertising or analytics SDKs.
- Your own music remains on your device and is not uploaded to BreathWave.
Who this policy covers
This Privacy Policy describes how BreathWave (the “app,” “service,” “we,” or “us”) handles information when you use the BreathWave Android app, website, account services, and support. BreathWave is a general-wellness service for adults aged 18 and over.
Privacy questions can be sent to support@breathwave.space.
Information we handle
Account and authentication
If you create an account, we collect your email address, optional display name, a securely hashed password, email-verification status, and security records needed to keep you signed in. We store one-way digests rather than readable refresh, verification, or password-reset tokens.
Practice and course activity
For signed-in users, we store practice identifiers and versions, start and end times, duration, completion status, saved practices, course progress, and lesson completion. This provides history, progress, and cross-device synchronization.
Mood check-ins and comments
If you choose to add them, we store a mood rating from 1 to 5 and free-text comments linked to the relevant practice. These entries may contain sensitive information depending on what you write. They are private account content, are not used for advertising, and are not included in introduction statistics.
Optional introduction statistics
If you explicitly opt in, we receive your selected goal, breathing experience, and preferred session length. We do not send your name, email, account ID, free text, or an exact response time with these answers. A random receipt held by your device is stored only as a one-way hash so you can update or withdraw the response.
Technical and security information
Our systems process limited network and request information, including an IP address, to deliver the service, apply rate limits, prevent abuse, and investigate failures. Rate-limit identifiers are hashed and expire. We may keep minimal security events, such as a password change or account deletion event and its time.
Support communications
If you contact support, we receive the address and contents you send so we can answer and resolve your request.
Information that stays on your device
Guest history, mood check-ins, comments, favorites, course state, theme, voice, reminder, haptic, soundscape, and other device preferences are stored locally. A music file you select is opened from your device; BreathWave does not upload the file or listen through your microphone. Locally generated or saved soundscapes also remain on your device.
Android backup and device-transfer rules exclude BreathWave’s local app data. You can remove local data from Profile, or through Android’s app-storage settings. Uninstalling the app normally removes its local app data.
How we use information
- Provide accounts, authentication, email confirmation, and password recovery.
- Deliver the practice catalogue and synchronize the account features you request.
- Show your history, progress, saved content, mood check-ins, and comments.
- Produce anonymous totals from introduction answers only when you opt in.
- Protect the service, enforce rate limits, diagnose problems, and prevent misuse.
- Reply to support and privacy requests and comply with applicable law.
Where applicable, we process data to provide the service you request, based on your consent for optional introduction statistics, and for legitimate security and service-integrity purposes. You may withdraw optional introduction sharing without losing access to the app.
When information is disclosed
We do not sell or rent personal data. We do not share it with advertisers or data brokers. We use service providers only as needed to operate BreathWave:
- OVHcloud provides server, network, database-hosting infrastructure, encrypted backup infrastructure, and Zimbra email delivery for account and support messages.
- Google Play distributes the Android app and independently handles information associated with your Play account under Google’s own privacy terms.
We may disclose information if required by valid law, to protect users or the service, or as part of a business transfer with appropriate notice and safeguards. Service providers may process data only for their contracted operational purpose.
Where information is processed
The primary BreathWave application server is hosted in Canada. Email and supporting infrastructure may be processed in other locations where our providers operate. When required, we use appropriate contractual or legal safeguards for international transfers.
Security
Data sent between the app and BreathWave uses HTTPS encryption. Passwords are stored as modern password hashes, access tokens are short-lived, refresh credentials are stored as one-way digests on the server, and Android credentials are encrypted using Android Keystore. Access is restricted, the database is not exposed directly to the public internet, and database backups are encrypted. No system can guarantee absolute security, so please avoid placing unnecessary medical or highly sensitive details in a free-text comment.
Retention and deletion
- Guest data: stays on the device until you delete local data or uninstall the app. If you explicitly import guest history after signing in, the imported copy follows the account rules below.
- Account data: remains while your account is active. Deleting your account removes the account, profile, authentication credentials, synchronized sessions, course progress, favorites, mood ratings, and comments from the active service.
- Security credentials: access tokens expire within about 10 minutes; sign-in sessions last no more than 30 days. Expired verification, reset, and session records are removed through automated cleanup.
- Introduction answers: remain without an account link until you withdraw sharing in the app or until they are no longer needed for the stated statistical purpose.
- Security events: a minimal event type and timestamp may remain after account deletion, without a continuing link to the deleted account, for security and accountability.
- Backups: encrypted backups may temporarily contain data deleted from the active service. Backups are isolated, used only for disaster recovery rather than ordinary operation, and deleted on the backup-retention cycle.
Your choices and rights
You can use the app as a guest, choose whether to create an account, leave mood and comment fields empty, and decline optional introduction statistics. In About & privacy, you can withdraw introduction sharing and delete local data. Signed-in users can update their display name, sign out, change their password, and permanently delete their account from Profile.
Depending on where you live, you may also have rights to access, correct, delete, restrict, or receive a copy of personal information, or object to certain processing. Contact support@breathwave.space. We may need to verify that the request belongs to you. You may also use this address to request account deletion if you cannot access the app.
Children
BreathWave is intended only for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can investigate and delete it.
Changes to this policy
We may update this policy as BreathWave changes or legal requirements evolve. We will update the date above and provide additional notice in the app when a change materially affects how personal information is handled.
Contact
BreathWave privacy support
support@breathwave.space
https://breathwave.space/