Version 6, effective 2026-10-31

Privacy Policy

This policy explains what Breathing Room ("we", "us") stores about you, why, where it lives, who else handles it and what you can do about it. It applies to breathingroom.io and the Breathing Room Android app (the "Service"). Breathing Room is operated by BREATHINGROOM.IO LLC, 2 Dockery Drive, West Orange, NJ 07052, USA, reachable at support@breathingroom.io.

1. What we store

  • Account and profile: your email address, sign-in methods (a salted password hash if you set one, a Google account id if you connect one, passkey public keys, an encrypted two-factor secret and hashed recovery codes), your name, date of birth and phone number if you enter them, and your display preferences.
  • Therapy data: the files from your device's data card. We keep an encrypted copy of the uploaded files and everything parsed from them: sessions, respiratory events, per-night statistics, waveform signals, device settings and mask details. If you choose to send us a copy of a data card we cannot read yet (section 8), we keep that copy too.
  • Journal: the notes, ratings and tags you write.
  • Sleep-tracker data: if you connect a sleep tracker (currently Oura), the sleep stages it reports and an encrypted copy of the connection credentials.
  • Oximeter data: if you import a recording from a pulse oximeter, the blood-oxygen, pulse-rate and motion samples it contains and the device name.
  • AI conversations and analyses: the questions you ask, the answers you receive and the nightly summaries you request.
  • Consents: which version of the Terms and this policy you accepted, when, and the IP address and browser used.
  • Sign-in, security and upload events: every sign-in attempt, security change, administrator action and data upload (CPAP card, oximeter or sleep-stage file) on your account, with time, IP address, browser and the kind of device the browser implies, kept for 365 days.
  • Billing: whether you are on trial, subscribed, or complimentary, your Stripe customer id, and a mirror of your subscription status and the webhook events Stripe sends about it. We never see or store your card number.
  • AI assistants you connect — what they request from your data, sent at your request.

2. Why, and on what basis

To provide the Service to you: showing your data, sending sign-in links and account emails, taking payment, keeping your account secure, and answering your questions. We do not sell your data, and we do not use it for advertising.

Where the law asks us to name a legal basis:

  • Therapy data, journal entries, sleep-tracker data and oximeter data are health data. We process them only with your explicit consent, which you give when you create an account and accept this policy. Uploading a data card, importing an oximeter recording, connecting a sleep tracker, connecting an AI assistant and asking the AI a question are each your choice. You can withdraw consent at any time by disconnecting the tracker, deleting an imported oximeter recording, disconnecting the assistant, no longer using the AI features, or deleting your account (section 6); withdrawing does not undo processing that already happened.
  • A data card you donate (section 8) is processed with the explicit consent you give when you press the button that sends it. You can withdraw that consent by removing the copy in Settings → Data & devices; withdrawing does not undo work already done with it.
  • Everything else in section 1 is processed because it is needed to provide the Service you signed up for, because the law requires us to keep it (consent and billing records), or, for sign-in and security events, because we have a legitimate interest in keeping your account safe, and, for upload events, in seeing how the Service is used.

3. Where it lives and how it is protected

The Service runs on Cloudflare's network. Your records live in Cloudflare D1 and your files and waveforms in Cloudflare R2, both hosted in Cloudflare data centres in the United States. Uploaded files and waveform data are encrypted at rest with a key unique to your account, which is itself encrypted under a master key we can rotate. Connections to the Service are always over HTTPS. A donated card copy (section 8) lives in the same storage, encrypted at rest by Cloudflare but not under your account's key, because our developers must be able to read it.

To keep the Service running we keep technical logs in Cloudflare for seven days: for each request, the web address requested (including any identifiers it carries), the response status and timing, and the connection details Cloudflare records (such as your IP address, the approximate location derived from it and your browser type); and the messages our software writes while handling requests and processing your uploads, with e-mail addresses and identifiers removed. When a request fails you see a short reference code so that, if you contact us, we can find that one log entry. These logs are used only to keep the Service running and are never combined with your health data.

The Service is operated from the United States and the processors in section 4 are also there.

4. Who else handles your data

We use these processors, each only for the purpose stated:

  • Cloudflare, Inc. — hosting, storage and delivery of the Service.
  • Stripe, Inc. — payments and subscription management, as merchant of record through Stripe Link and Managed Payments. Stripe receives your email address and billing details and is an independent controller of the payment data it collects.
  • Resend, Inc. — sending the emails we send you (sign-in links, receipts of account changes, a reminder if you have not uploaded a card yet, a thank-you when you donate a card and a notice when your machine becomes supported, and trial and deletion notices).
  • Anthropic, PBC — generating AI summaries and answers, when you use those features. We send a numeric digest of your nights, your journal ratings and tags, your question and the earlier turns of that conversation — never your uploaded files or your name, with one exception: the files of a data card you donate (section 8), which our developers may read with Anthropic's coding tools while building support for your machine, under the same terms. Anthropic's commercial terms prohibit it from training its models on what we send; it may keep a request for a limited time for abuse monitoring under those terms.
  • Cloudflare Workers AI — the fallback AI model when Anthropic is unavailable, under the same limits. Cloudflare does not train models on what we send either.
  • Oura Health Oy — only if you connect an Oura ring; we fetch your sleep data from Oura with your permission.
  • Google LLC — only if you sign in with Google; Google tells us your email address and its account id.
  • An AI assistant you connect (for example Anthropic for Claude, Google for Gemini, OpenAI for ChatGPT) — your display name and machine model, and the nights, waveforms, sleep stages, oximeter data and journal entries it asks for while you use it. It acts for you under its own terms, not as our processor. You choose this when you click Allow, and it stops when you disconnect in Settings.

5. Cookies and storage in your browser

We use cookies and browser storage to run the Service and to see, in total, which links bring people to us: a sign-in cookie that keeps you signed in and a marker cookie that only records that you are signed in, short-lived cookies during Google sign-in, a referral cookie (`br_via`, kept for 90 days) when you arrive through a referral link so we can credit the person who referred you (that person sees how many people signed up and subscribed through their link, and their commission amounts with dates, but never your name or email address; if they have referred only a few people, they may be able to tell that you subscribed), a source cookie (`br_src`, kept for 90 days) when you arrive through one of our own tagged links so we can see which links bring people to us (if you then create an account, we note that link on it), and browser storage for your preferences, the current session, a marker that keeps your visit from being counted twice and a marker that keeps an attempt to upload an unsupported data card from being counted twice. We count visits to our public pages per link as a daily total that is not linked to you. For a visit without a tagged link we also count the name of the website that linked to us (such as `example.com`), never the full address. If you try to upload a data card from a machine we don't support yet, we count that attempt per manufacturer as a daily total that is not linked to you. There are no advertising or third-party analytics cookies.

6. How long we keep it

  • Your account and everything in it: until you delete the account, plus a 14-day grace period during which you can restore it. After that everything is permanently deleted, except the consent, security and upload records below. Our database provider keeps point-in-time recovery copies for up to 30 days beyond that; we use them only to recover from a disaster affecting the whole Service, never to restore a deleted account.
  • Consent records: kept after deletion as evidence that you accepted the Terms, with the IP address and browser recorded at acceptance, identified only by an internal id.
  • Sign-in, security and upload events, and billing webhook events: 365 days, then deleted.
  • Technical logs: 7 days, then deleted by Cloudflare.
  • Donated card copies: until you remove them, until a year after you sent them, or until we have finished with them, whichever comes first; deleted with your account.
  • A record that you donated a card — the manufacturer, model, number of files, size and dates, never the files — is kept for a year from the donation even after the copy is removed, so the donation limits still apply; deleted with your account.
  • An account that has never subscribed and has been unused for 60 days after its trial ended is deleted after a warning email and a further 30 days (unless you have donated a card we still hold).
  • Stripe keeps its own records of payments as the law requires.

7. Your rights and how to use them

  • Access and portability: every account can download its account export (account.json: your profile, journal, settings, consents and generated text such as AI conversations) at any time from Settings → Data & devices; the night-level downloads (CSV, JSON and PDF of your nights, sessions and events) are part of Premium. Raw device files are not included (section 8).
  • Correction: edit your profile from Settings → Profile.
  • Deletion: delete your account from Settings → Account (see section 6).
  • Withdrawing consent: disconnect a sleep tracker, Google or an AI assistant from Settings, delete an imported oximeter recording from the Dashboard, remove a donated card copy from Settings → Data & devices, or stop using the AI features.
  • Depending on where you live you may also have the right to object to or restrict processing and to complain to a data-protection authority. For anything not covered by the in-app controls, email support@breathingroom.io; we answer within 30 days.
  • Consumer health data notice. If you live in Washington, Nevada or Connecticut, sections 1, 2, 4 and this section are our consumer health data privacy notice: the health data we collect, why, who we share it with, and how to withdraw consent or delete it. We collect health data only from you and, if you connect one, your sleep tracker. We do not sell it, we do not share it for advertising, and we do not use it to identify you across other sites. If you disagree with how we handle a request, you can appeal by replying to our answer; we will reply to the appeal within 30 days.

8. Your raw files

The files on your device's data card are yours. The copy we keep is used only to show you your data and is deleted with your account. We do not return raw files through the Service; keep your own card or backup.

Donating a card we cannot read yet. If the Upload page recognises your machine but cannot read its card, you can choose to send us a copy of the files. We use that copy only to build and test support for your machine. Our developers and the coding tools they work with (section 4) read it; we never share it with anyone else. The copy is kept for at most a year, you can remove it at any time from Settings → Data & devices, and it is deleted with your account. When Breathing Room can read your machine we email you and add a month of Premium to your account.

9. Children

The Service is for people aged 18 or over. We do not knowingly hold data about anyone younger; if you believe we do, contact us and we will delete it.

10. Changes

We will ask you to accept a new version of this policy in the app when a change matters. The version number and effective date at the top tell you which version applies. Read the Terms of Service alongside this policy.

See also the Terms of Service. Back to sign in.