Version 2, effective 2026-10-07

Privacy Policy

This policy explains what Breathing Room ("we", "us") stores about you, why, where it lives, who else handles it and what you can do about it. It applies to breathingroom.io and the Breathing Room Android app (the "Service"). Breathing Room is operated by BREATHINGROOM.IO LLC, 2 Dockery Drive, West Orange, NJ 07052, USA, reachable at support@breathingroom.io.

1. What we store

  • Account and profile: your email address, sign-in methods (a salted password hash if you set one, a Google account id if you connect one, passkey public keys, an encrypted two-factor secret and hashed recovery codes), your name, date of birth and phone number if you enter them, and your display preferences.
  • Therapy data: the files from your device's data card. We keep an encrypted copy of the uploaded files and everything parsed from them: sessions, respiratory events, per-night statistics, waveform signals, device settings and mask details.
  • Journal: the notes, ratings and tags you write.
  • Sleep-tracker data: if you connect a sleep tracker (currently Oura), the sleep stages it reports and an encrypted copy of the connection credentials.
  • Oximeter data: if you import a recording from a pulse oximeter, the blood-oxygen, pulse-rate and motion samples it contains and the device name.
  • AI conversations and analyses: the questions you ask, the answers you receive and the nightly summaries you request.
  • Consents: which version of the Terms and this policy you accepted, when, and the IP address and browser used.
  • Sign-in and security events: every sign-in attempt, security change and administrator action on your account, with time, IP address and browser, kept for 365 days.
  • Billing: whether you are on trial, subscribed, or complimentary, your Stripe customer id, and a mirror of your subscription status and the webhook events Stripe sends about it. We never see or store your card number.

2. Why, and on what basis

To provide the Service to you: showing your data, sending sign-in links and account emails, taking payment, keeping your account secure, and answering your questions. We do not sell your data, and we do not use it for advertising.

Where the law asks us to name a legal basis:

  • Therapy data, journal entries, sleep-tracker data and oximeter data are health data. We process them only with your explicit consent, which you give when you create an account and accept this policy. Uploading a data card, importing an oximeter recording, connecting a sleep tracker and asking the AI a question are each your choice. You can withdraw consent at any time by disconnecting the tracker, deleting an imported oximeter recording, no longer using the AI features, or deleting your account (section 6); withdrawing does not undo processing that already happened.
  • Everything else in section 1 is processed because it is needed to provide the Service you signed up for, because the law requires us to keep it (consent and billing records), or, for sign-in and security events, because we have a legitimate interest in keeping your account safe.

3. Where it lives and how it is protected

The Service runs on Cloudflare's network. Your records live in Cloudflare D1 and your files and waveforms in Cloudflare R2, both hosted in Cloudflare data centres in the United States. Uploaded files and waveform data are encrypted at rest with a key unique to your account, which is itself encrypted under a master key we can rotate. Connections to the Service are always over HTTPS.

The Service is operated from the United States and the processors in section 4 are also there. It is not offered to residents of the European Economic Area, the United Kingdom or Switzerland (see section 1 of the Terms of Service).

4. Who else handles your data

We use these processors, each only for the purpose stated:

  • Cloudflare, Inc. — hosting, storage and delivery of the Service.
  • Stripe, Inc. — payments and subscription management, as merchant of record through Stripe Link and Managed Payments. Stripe receives your email address and billing details and is an independent controller of the payment data it collects.
  • Resend, Inc. — sending the emails we send you (sign-in links, receipts of account changes, trial and deletion notices).
  • Anthropic, PBC — generating AI summaries and answers, when you use those features. We send a numeric digest of your nights, your journal ratings and tags, your question and the earlier turns of that conversation — never your uploaded files or your name. Anthropic's commercial terms prohibit it from training its models on what we send; it may keep a request for a limited time for abuse monitoring under those terms.
  • Cloudflare Workers AI — the fallback AI model when Anthropic is unavailable, under the same limits. Cloudflare does not train models on what we send either.
  • Oura Health Oy — only if you connect an Oura ring; we fetch your sleep data from Oura with your permission.
  • Google LLC — only if you sign in with Google; Google tells us your email address and its account id.

5. Cookies and storage in your browser

We use cookies and browser storage to run the Service and to see, in total, which links bring people to us: a sign-in cookie that keeps you signed in and a marker cookie that only records that you are signed in, short-lived cookies during Google sign-in, a referral cookie (`br_via`, kept for 90 days) when you arrive through a referral link so we can credit the person who referred you (that person sees how many people signed up and subscribed through their link, and their commission amounts with dates, but never your name or email address; if they have referred only a few people, they may be able to tell that you subscribed), a source cookie (`br_src`, kept for 90 days) when you arrive through one of our own tagged links so we can see which links bring people to us (if you then create an account, we note that link on it), and browser storage for your preferences, the current session, a marker that keeps your visit from being counted twice and a marker that keeps an attempt to upload an unsupported data card from being counted twice. We count visits to our public pages per link as a daily total that is not linked to you. For a visit without a tagged link we also count the name of the website that linked to us (such as `example.com`), never the full address. If you try to upload a data card from a machine we don't support yet, we count that attempt per manufacturer as a daily total that is not linked to you. There are no advertising or third-party analytics cookies.

6. How long we keep it

  • Your account and everything in it: until you delete the account, plus a 14-day grace period during which you can restore it. After that everything is permanently deleted, except the consent and security records below. Our database provider keeps point-in-time recovery copies for up to 30 days beyond that; we use them only to recover from a disaster affecting the whole Service, never to restore a deleted account.
  • Consent records: kept after deletion as evidence that you accepted the Terms, with the IP address and browser recorded at acceptance, identified only by an internal id.
  • Sign-in and security events, and billing webhook events: 365 days, then deleted.
  • An account that has never subscribed and has been unused for 60 days after its trial ended is deleted after a warning email and a further 30 days.
  • Stripe keeps its own records of payments as the law requires.

7. Your rights and how to use them

  • Access and portability: every account can download its account export (account.json: your profile, journal, settings, consents and generated text such as AI conversations) at any time from Settings → Data & devices; the night-level downloads (CSV, JSON and PDF of your nights, sessions and events) are part of Premium. Raw device files are not included (section 8).
  • Correction: edit your profile from Settings → Profile.
  • Deletion: delete your account from Settings → Account (see section 6).
  • Withdrawing consent: disconnect a sleep tracker or Google from Settings, delete an imported oximeter recording from the Dashboard, or stop using the AI features.
  • Depending on where you live you may also have the right to object to or restrict processing and to complain to a data-protection authority. For anything not covered by the in-app controls, email support@breathingroom.io; we answer within 30 days.
  • Consumer health data notice. If you live in Washington, Nevada or Connecticut, sections 1, 2, 4 and this section are our consumer health data privacy notice: the health data we collect, why, who we share it with, and how to withdraw consent or delete it. We collect health data only from you and, if you connect one, your sleep tracker. We do not sell it, we do not share it for advertising, and we do not use it to identify you across other sites. If you disagree with how we handle a request, you can appeal by replying to our answer; we will reply to the appeal within 30 days.

8. Your raw files

The files on your device's data card are yours. The copy we keep is used only to show you your data and is deleted with your account. We do not return raw files through the Service; keep your own card or backup.

9. Children

The Service is for people aged 18 or over. We do not knowingly hold data about anyone younger; if you believe we do, contact us and we will delete it.

10. Changes

We will ask you to accept a new version of this policy in the app when a change matters. The version number and effective date at the top tell you which version applies. Read the Terms of Service alongside this policy.

See also the Terms of Service. Back to sign in.