Data Protection Policy

1. Controller

The controller responsible for data processing through the DreamSleep app is:

DreamSleep
Email: dream_sleep_coach@web.de

2. Overview

DreamSleep is a sleep improvement app that provides personalized sleep coaching, evidence-based practices, and educational content. This policy explains what personal data we collect, why we collect it, how we process it, and what rights you have under the General Data Protection Regulation (GDPR).

3. Data we collect

3.1 Account data

When you create an account, we collect:

• Email address – for authentication and account recovery
• First name – for personalized coaching
• Age and sex (Geschlecht) – for sleep-relevant personalization
• Timezone – for accurate scheduling of practices and notifications

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)) – necessary to provide the service.

3.2 Sleep and health-related data

During your use of the app, we collect:

• Sleep habits – bedtime, wake time, sleep quality self-assessment
• Chronotype assessment results – to determine your optimal sleep schedule
• Sleep protocol data – daily sleep logs, protocol progress, and weekly comparisons
• Personal information (optional) – any additional context you choose to share for coaching

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)) – core functionality of the app.

3.3 Chat data

Conversations with the AI Sleep Coach are stored to provide continuity and context-aware coaching. Messages are processed by Google Cloud Functions using a large language model.

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)).

3.4 Practice and progress data

We store information about practices you accept, complete, or decline, including task history, streaks, and knowledge module completion status.

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)).

3.5 Device and technical data

• Push notification tokens (FCM) – to deliver notifications you have opted into
• App version and build number – for compatibility checks
• Device model and operating system – collected automatically by Firebase

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) – ensuring app stability and compatibility.

3.6 Usage analytics

We use Firebase Analytics (provided by Google) to understand how users interact with the app. This includes:

• Screen views and navigation patterns
• Session duration and frequency
• Feature usage (e.g., which screens are visited, chat session starts)
• App instance ID (a pseudonymous device identifier)

Analytics data is aggregated and used solely for product improvement. It is not used for advertising or sold to third parties.

You can opt out of analytics at any time in the app under Settings > Legal Documents > Usage Analytics.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) – improving the app based on usage patterns.

4. Data processors

We use the following third-party services to operate DreamSleep:

Google processes data under the Google Cloud Data Processing Addendum (Art. 28 GDPR). Data is stored in the EU region (europe-west3, Frankfurt) with no third-country transfer for core services.

Anthropic processes data as a sub-processor under a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. Data transfers to Anthropic are covered by EU Standard Contractual Clauses (Art. 46 GDPR). Data sent to Anthropic is limited to what is necessary to generate your coaching response and is not used to train Anthropic's models.

5. Data retention

• Active accounts: Data is retained as long as your account exists.
• Deleted accounts: All personal data is permanently deleted upon account deletion. A minimal metadata record (user ID and deletion timestamp) is retained for up to 90 days to ensure cleanup across all systems.
• Analytics data: Aggregated analytics data is retained by Firebase for up to 14 months. This data cannot be attributed to individual users.

6. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15) – request a copy of your data
• Right to rectification (Art. 16) – correct inaccurate data (available in-app via Profile settings)
• Right to erasure (Art. 17) – delete your account and all data (instructions here)
• Right to data portability (Art. 20) – request your data in a machine-readable format
• Right to restrict processing (Art. 18) – request limitation of processing
• Right to object (Art. 21) – object to processing based on legitimate interest, including analytics (opt out in Settings)
• Right to withdraw consent (Art. 7(3)) – where processing is based on consent (e.g., push notifications), you may withdraw at any time

To exercise any of these rights, contact us at dream_sleep_coach@web.de. We will respond within 30 days.

7. Data security

We implement the following measures to protect your data:

• All data is transmitted over encrypted connections (TLS/HTTPS)
• Firebase Authentication secures access to your account
• Firebase App Check with Play Integrity protects against unauthorized API access
• Firestore security rules restrict data access to the authenticated owner
• Cloud Functions run in isolated, secure environments

8. Children's privacy

DreamSleep is not intended for children under 16 years of age. We do not knowingly collect data from children. If you believe a child has provided personal data, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. When we make significant changes (major version update), you will be asked to review and agree to the updated policy within the app. Minor updates will be reflected in the version number.

10. Right to lodge a complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

11. Contact

For all data protection inquiries:

DreamSleep
Email: dream_sleep_coach@web.de