Privacy Policy

1.Who we are and what this policy covers

NuNest is a sleep-wellness service; this policy explains how we handle your information when you use it.

NuNest ("we", "us", "our") provides the NuNest mobile app and our website (together, the "Service"). This policy describes the personal information we collect through the Service, how we use and share it, and the rights you have over it.

This policy does not cover third-party services you connect to NuNest - such as Google, Apple, or the health platforms described in this policy. Those services have their own privacy policies, and we encourage you to read them.

If you have questions, you can reach us at [TODO support mail].

[TODO: legal entity name and registered address]

2.Information we collect

We collect only what we need to prepare your night: your account details, your sleep profile, the health data you choose to connect, and basic technical information.

a. Account information

When you create an account, we store your email address, display name, and the identifier provided by your sign-in provider (Google or Apple). If you sign in with an email address and a password, we collect and store that password as part of your account credentials.

b. Your sleep profile and routines

The answers you give during onboarding - your sleep goals, unwinding habits, and target bedtime and wake-up times - as well as the routines NuNest prepares for you, the soundscapes and stories assigned to your nights, and your playback progress.

c. Health data you choose to connect

If you explicitly connect Apple Health or Health Connect, NuNest can read your sleep data to prepare a better night based on your routine. This connection is entirely optional:

• NuNest only reads the categories of information you approve, and only sleep-related data.
• You can disconnect at any time from the app's Settings or your device's privacy settings, and reading stops immediately.

d. Information collected automatically

When you use the Service, our servers keep basic technical information - device type, operating system, app version, IP address, and timestamps - in request logs used for security and abuse prevention. These logs are kept only for a limited period. If you enable notifications, we also store a push notification token so your device can receive the bedtime reminders you asked for.

e. Support communications

If you contact us for support, we keep the messages you send us - and nothing more than what you choose to include - so we can help you.

3.What we don't collect

Some things never touch our servers - and we think you should know exactly what.

• No bedroom audio. NuNest plays soundscapes and stories; it never records audio. Your microphone is not used to capture sound while you sleep. [TODO: REWRITE IF THIS CHANGES]
• No sensor-based sleep tracking. NuNest does not use your device's motion sensors to measure sleep. Sleep insights come only from the health platforms you explicitly connect.
• No advertising identifiers. The app contains no advertising SDKs and does not collect advertising IDs or track you across other apps and websites.
• No precise location. We don't use GPS.
• No data selling. We never sell personal information. Not to anyone, for any purpose.

4.How we use your information

We use your information to prepare your night, run your account, and keep the Service safe.

• To create, secure, and sign you into your account.
• To prepare and improve your nightly routines, soundscapes, and stories.
• To read the sleep data you have approved, so your night adapts to your routine.
• To deliver the notifications and bedtime reminders you request.
• To respond when you contact us for support.
• To keep the Service safe, prevent abuse, and diagnose technical problems.
• To comply with our legal obligations.
• To produce aggregated, anonymous statistics that can no longer be tied to you. We do not use your health or sleep data for advertising, and we do not build profiles about you for third parties.

5.Legal bases for processing

Where the law requires a legal basis, here is ours.

• Consent. Connecting Apple Health or Health Connect, and receiving optional communications - both rest on your consent, which you can withdraw at any time without affecting the rest of the Service.
• Performance of a contract. Creating and managing your account, providing your personalized sleep routines, and delivering the features and services you request.
• Legitimate interests. Keeping the Service secure and reliable, preventing abuse, and improving the Service - always balanced against your privacy interests.
• Legal obligations. Responding to valid legal requests and meeting other obligations the law imposes on us.

6.How we share information

We share as little as possible, and only in the circumstances below.

• Sign-in providers. When you authenticate with Google or Apple, that provider is involved in the sign-in process and its own terms apply.
• Health platforms. Sleep data you approve flows only between you, NuNest, and the platform you connected - Apple Health or Health Connect - and is shared securely.
• Service providers. We rely on a small number of providers to run the Service (for example, hosting). They process information only on our instructions, are contractually bound to keep it confidential, and may not use it for their own purposes.
• Legal requirements. We may disclose information if required by law or valid legal process, and we will notify you when legally allowed.
• Business transfers. If NuNest is ever part of a merger or acquisition, your information may transfer with it - with notice to you before any material change in how it is used. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7.Third-party services we use

A short list, on purpose.

• Sign in with Apple / Google Sign-In. Receives your authentication request; provides us your account identifier. Their privacy policies apply.
• Apple Health / Health Connect. Optional, read-only sources of sleep data you approve.
• Cloud hosting providers. We use trusted third-party infrastructure providers to securely host our Service and store account information, user profiles, and other data necessary to operate NuNest.
• PostHog. We use PostHog to understand how people interact with NuNest, monitor app performance, and identify issues so we can improve the experience. This may include usage events, device information, app version, and technical diagnostics. We do not intentionally send health data, passwords, or the content of private communications to PostHog. No ad networks. No data brokers. No social media SDKs. If we ever add a third-party service that processes your personal information, we will update this section.

8.Cookies and similar technologies

The website currently sets no analytics or advertising cookies. If we add cookies or similar technologies later, we will update this policy and, where the law requires it, ask for your consent first. In the app, we use only standard operating-system features (such as push notification tokens) needed to deliver the reminders you request.

9.Data security

Protecting your information is important to us.

We implement reasonable technical and organizational measures designed to protect your personal information against unauthorized access, disclosure, alteration, or loss. These measures include secure communications, access controls, and practices intended to maintain the confidentiality and integrity of your information.

While we take appropriate steps to safeguard your data, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a security incident involving your personal information, we will take appropriate action and notify affected users and relevant authorities where required by applicable law.

If you believe your account has been compromised, please contact us at [TODO: insert support mail].

10.Data retention

We keep your information while your account is active - and not forever after.

We keep your account, profile, and routine data for as long as your account exists, so you can access your nights. When you delete your account, your profile, routines, and preferences are deleted from our servers. Request logs are kept only for a short, fixed period for security purposes. [TODO: exact retention periods] Aggregated, anonymous statistics may be retained indefinitely - they can no longer be linked to you.

11.Where your data lives

We use cloud infrastructure providers to host and operate NuNest. Your personal information may be stored or processed in countries other than your country of residence, including the United States. Where required by applicable law, we implement appropriate safeguards to protect personal information transferred internationally.

12.Your privacy rights

Wherever you live, you can access, export, correct, or delete your information.

a. For everyone

• Access and portability. Request a copy of the data associated with your account, in a portable format.
• Correction. Update your profile and preferences in the app at any time, or ask us to fix inaccurate data.
• Deletion. Delete your account - and with it, your personal data from our servers.
• Health data control. Revoke NuNest's access to Apple Health or Health Connect at any time; reading stops immediately.
• No discrimination. You will not be treated differently for exercising these rights. To make a request, email [TODO: insert support email] or use the options in the app. We may need to verify your identity, and we aim to respond promptly and without charge, unless a request is excessive or repetitive.

b. If you are in the EEA or the UK

You have additional rights under the GDPR and the UK equivalent: to object to or restrict certain processing, to withdraw consent at any time, and to lodge a complaint with your local data protection authority. Where processing rests on legitimate interests, you may object on grounds relating to your particular situation.

c. If you are in the United States

Several US state laws - including the California Consumer Privacy Act as amended by the CPRA - give residents rights to know, access, correct, and delete personal information, and to opt out of its "sale" or "sharing." We do not sell or share personal information as those terms are defined, so there is nothing to opt out of. Sleep data connected from health platforms is treated as sensitive personal information and is used only to provide the Service. We will not discriminate against you for exercising any right. [TODO: state-by-state supplemental notices if counsel requires them]

13.Children's privacy

NuNest is not intended for anyone under 13.

The Service is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at [TODO: insert support email] and we will delete it.

14.Changes to this policy

If this policy changes materially, you will hear it from us - in the app.

We may update this policy as NuNest evolves: new features, changes in our practices, or new laws. Material changes will be announced in the app (or by email where the law requires it), and the effective date at the top of this policy will always reflect the current version.

15.Contact us

Questions or requests? [TODO: insert support email] is the fastest way to reach us.

For anything security-related, email us directly and we will prioritize it. [TODO: legal entity name, registered address, and (if required) EU/UK representative]