Privacy Policy

1. Controller

The controller responsible for data processing through the DreamSleep app is:

Mental Mobile Coach GmbH
Gutenbergstraße 10
55257 Budenheim
Deutschland
Email: info@dreamsleep-app.com

2. Overview

DreamSleep is a sleep improvement app that provides personalized sleep coaching, evidence-based practices, and educational content. This policy explains what personal data we collect, why we collect it, how we process it, and what rights you have under the General Data Protection Regulation (GDPR).

Because DreamSleep is a sleep-coaching app, some of the data you share with it (such as sleep patterns and information you provide about your sleep problems) can constitute health-related data within the meaning of Art. 4(15) and Art. 9 GDPR. We process such data only on the basis of your explicit consent, which you give when creating your account and can withdraw at any time (see Sections 3.2, 3.3, and 6).

3. Data we collect

3.1 Account data

When you create an account, we collect:

• Email address – for authentication and account recovery
• First name – for personalized coaching
• Age and sex (Geschlecht) – for sleep-relevant personalization
• Timezone – for accurate scheduling of practices and notifications

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)) – necessary to provide the service.

3.2 Sleep and health-related data

During your use of the app, we collect:

• Sleep habits – bedtime, wake time, sleep quality self-assessment
• Chronotype assessment results – to determine your optimal sleep schedule
• Sleep protocol data – daily sleep logs, protocol progress, and weekly comparisons
• Personal information (optional) – any additional context you choose to share for coaching
• Coaching notes – short summaries and notes the AI Sleep Coach derives from your conversations (for example about your habits, goals, and practices you have tried) so that coaching stays consistent over time. These notes are stored in your profile, are not shown in the app, and are included in your data copy (Section 6).
• Program report – at the end of the 8-week program, a summary of how your sleep diary developed (for example sleep quality, time to fall asleep, night-time awakenings) together with a personal sleep plan. It is stored in your profile, shown in the app and included in your data copy.

Legal basis: Your explicit consent (GDPR Art. 9(2)(a) in conjunction with Art. 6(1)(a)), given when you create your account. This data can constitute health-related data. You can withdraw your consent at any time (see Section 6); without it, the core coaching service cannot be provided.

3.3 Chat data

Conversations with the AI Sleep Coach are stored to provide continuity and context-aware coaching. Messages are processed by Google Cloud Functions and, to generate responses, transmitted to Anthropic in the USA (see Section 4). Before suggesting certain practices (for example bedtime restriction), the coach may ask you for safety reasons about relevant medical conditions or medication; any such information you choose to share is processed like all other chat messages. From your conversations the coach also creates a rolling summary and coaching notes (see Section 3.2), which are stored to keep coaching consistent.

Legal basis: Your explicit consent (GDPR Art. 9(2)(a) in conjunction with Art. 6(1)(a)), given when you create your account, since chat messages may contain health-related information.

3.4 Practice and progress data

We store information about practices you accept, complete, or decline, including task history, streaks, and knowledge module completion status.

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)).

3.5 Device and technical data

• Push notification tokens (FCM) – to deliver notifications you have opted into
• App version and build number – for compatibility checks
• Device model and operating system – collected automatically by Firebase

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) – ensuring app stability and compatibility.

3.6 Usage analytics (only with your consent)

We use Firebase Analytics (provided by Google) to understand how users interact with the app — but only if you actively enable it. Analytics is switched off by default and is activated only when you opt in during onboarding or in the app settings. If enabled, we collect:

• Screen views and navigation patterns
• Session duration and frequency
• Feature usage (e.g., which screens are visited, chat session starts)
• App instance ID (a pseudonymous device identifier)

Analytics events are associated with a pseudonymous app instance ID; we do not link them to your user account. Analytics data is used solely for product improvement. It is not used for advertising or sold to third parties.

You can withdraw your consent at any time in the app under Settings > Legal Documents > Usage Analytics. Collection stops immediately; the lawfulness of processing before the withdrawal remains unaffected.

Legal basis: Your consent (GDPR Art. 6(1)(a); Section 25(1) TDDDG for storing/reading identifiers on your device).

3.7 Purchase and subscription data

If you purchase the 8-week coaching program or a subscription through the Apple App Store or Google Play, we process your purchase and subscription status, the product identifier, the purchase date and access period, and a store transaction identifier via our subscription management provider RevenueCat (see Section 4). If you redeem a promotional code, we additionally record the code you used as an attribute of that purchase so that we can account for the discount and remunerate the partner who distributed the code; partners only receive redemption counts per code, never your name, email address or other account data. Payment details (e.g., credit card numbers) are processed exclusively by Apple or Google; we never receive them. When you delete your account, we also delete your customer record at RevenueCat; your purchase history remains with Apple or Google and can be restored in the app after a new registration with the same store account.

Records of promotional-code redemptions (code, product, transaction identifier, date) are accounting records and are retained for the statutory retention period (currently eight years, § 147 (3) AO as amended in 2025). When you delete your account, the link to your user ID is removed from these records.

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)) – managing your access and entitlements; legal obligation (GDPR Art. 6(1)(c)) for retaining accounting records.

3.8 Waitlist (website)

If you join the launch waitlist on our website, we store your email address, your language, the time of signup and confirmation, and the version of the consent text you agreed to. We use this data solely to send you a confirmation email (double opt-in) and to notify you when DreamSleep launches.

Legal basis: Consent (GDPR Art. 6(1)(a)). You can withdraw it at any time by sending us an informal email — we will then delete your address.

3.9 Reporting of chat replies

You can report an individual reply of the AI Sleep Coach in the app (long-press the reply, then "Report reply"). If you do, we store the reported reply, the reason you selected and your optional comment together with your user ID, app version and platform for up to 12 months. We use this to review the reply, improve the coach and meet the content requirements of the app stores. Reports are not shared with third parties. When you delete your account, the link to your user ID is removed from your reports; the reported reply, reason and comment remain for the review period of up to 12 months. Please do not enter data about other people in the comment.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) in safe and correct coaching content; insofar as the reported reply contains health-related data, your explicit consent (GDPR Art. 9(2)(a)) already given for the AI Sleep Coach (Section 3.3).

4. Data processors

We use the following third-party services to operate DreamSleep:

Google processes data under the Google Cloud Data Processing Addendum (Art. 28 GDPR). Data is stored in the EU region (europe-west3, Frankfurt) with no third-country transfer for core services.

Anthropic processes data as a processor under a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. Data transfers to Anthropic are covered by EU Standard Contractual Clauses (Art. 46 GDPR). Data sent to Anthropic is limited to what is necessary to generate your coaching response and is not used to train Anthropic's models.

RevenueCat processes data as a processor under a Data Processing Agreement pursuant to Art. 28 GDPR. Data transfers to RevenueCat are covered by EU Standard Contractual Clauses (Art. 46 GDPR).

5. Data retention

• Active accounts: Data is retained as long as your account exists.
• Deleted accounts: Your app content (profile, sleep logs, chat history, practice data) is deleted immediately upon account deletion; copies may remain in our backups for up to 7 days before they are overwritten. Upon deletion, your account record is immediately reduced to your user ID, your email address and your consent and acceptance record (which version and language of our legal documents you accepted and when, and your explicit consent to the processing of health data with its date). This reduced record is retained until the end of the third calendar year after deletion so that we can demonstrate your consent and defend legal claims (Art. 7(1), Art. 6(1)(f) and Art. 17(3)(e) GDPR; limitation period under Section 195 BGB), and is then automatically and permanently deleted.
• Analytics data: If you enabled analytics, event data is retained by Firebase for up to 14 months.
• Waitlist: Deleted after the launch notification has been sent, or immediately upon withdrawal of consent. Unconfirmed signups are deleted no later than at launch.
• In-app feedback: In-app feedback and ratings are stored anonymously, without any link to your account, are therefore not affected by account deletion, and are deleted after 2 years at the latest.
• Inactive accounts: We delete accounts that are no longer used so that your data is not stored longer than necessary. An account in which nothing was ever purchased is deleted 12 months after it was last used; an account in which a program or subscription was purchased is deleted 24 months after it was last used, provided that no subscription or program is active any more. Before deleting we notify you twice by email to the address of your account (90 days and 30 days before the deletion date); any sign-in to the App within that time keeps the account. The deletion then follows the same rules as a deletion by you (immediate deletion of your app content, reduced record as described above).

6. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15) – request a copy of your data
• Right to rectification (Art. 16) – correct inaccurate data (available in-app via Profile settings; the email address of your account can be changed on request via support@dreamsleep-app.com)
• Right to erasure (Art. 17) – delete your account and all data (instructions here)
• Right to data portability (Art. 20) – request your data in a machine-readable format
• Right to restrict processing (Art. 18) – request limitation of processing
• Right to object (Art. 21) – object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)) – you may withdraw any consent at any time with effect for the future: analytics consent via the toggle in Settings, and your consent to the processing of sleep and health-related data by contacting us or deleting your account. Note that without the latter consent, the coaching service cannot be provided. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, contact us at info@dreamsleep-app.com. We will respond without undue delay, at the latest within one month.

7. Data security

We implement the following measures to protect your data:

• All data is transmitted over encrypted connections (TLS/HTTPS)
• Firebase Authentication secures access to your account
• Firebase App Check with Play Integrity protects against unauthorized API access
• Firestore security rules restrict data access to the authenticated owner
• Cloud Functions run in isolated, secure environments

8. Children's privacy

DreamSleep is not intended for children under 16 years of age. We do not knowingly collect data from children. If you believe a child has provided personal data, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. When we make significant changes (major version update), you will be asked to review and agree to the updated policy within the app. Minor updates will be reflected in the version number.

10. Right to lodge a complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

11. Contact

For all data protection inquiries:

Mental Mobile Coach GmbH
Gutenbergstraße 10
55257 Budenheim
Deutschland
Email: info@dreamsleep-app.com