App Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account data: name and email address provided during sign-up or via Apple/Google Sign-In.

• Onboarding data: your wellness goals, usage contexts (sleep, focus, relaxation), prior experience with binaural audio, and how you heard about WellAudio.

• Listening activity: which sessions you play, their category (sleep, focus, relax, energize), listening duration, and timestamps. This is used to personalise your experience.

• Engagement data: sessions you like or download.

• Subscription status: your current plan, trial status, and renewal dates (managed via Apple App Store or Google Play).

• Push notification token: your device push token if you opt in to notifications. You can revoke this at any time in Settings.

• Affiliate code: if you were referred to WellAudio by a partner, we store the referral code associated with your account.

• Feedback messages: content you submit via the Help & Support form, including your email address. We also store your user ID and the timestamp of each submission for rate-limiting and abuse-prevention purposes. This metadata is automatically deleted after 7 days.

We do not collect precise location data, contacts, photos, camera, or microphone input. We do not sell your personal data.

2. How We Use Your Information

We use your information to:

• Create and maintain your account and personalise your session recommendations.

• Process and verify your subscription through Apple App Store or Google Play.

• Send push notifications you have opted into (session reminders, new content).

• Analyse aggregate usage patterns to improve our content library and app experience.

• Respond to support and feedback requests.

• Detect and prevent fraud or abuse of the service.

• Fulfil obligations to referral partners (affiliate code attribution only — no personal data is shared with affiliates).

3. Audio Content & Downloads

All audio files are stored securely and are only accessible to authenticated users with an active subscription. Audio is delivered via short-lived signed URLs that expire automatically and are never publicly accessible.

Downloaded sessions are stored on your device for offline personal use only. If your subscription lapses, downloaded content becomes inaccessible within the app until a valid subscription is restored.

4. Third-Party Services

WellAudio uses the following third-party services. Each operates under its own privacy policy and we share only the minimum data necessary for each service to function:

• Supabase (supabase.com) — database, authentication, file storage, and server functions. Stores your account, profile, listening history, and session files.

• RevenueCat (revenuecat.com) — subscription management. Receives your anonymised user ID and purchase/entitlement data from Apple or Google.

• Apple App Store / Sign In with Apple — subscription billing and optional single sign-on. Governed by Apple's Privacy Policy.

• Google OAuth / Google Play — optional sign-in and Android subscription billing. Governed by Google's Privacy Policy.

• Amplitude (amplitude.com) — product analytics. Receives your user ID and in-app events (e.g. session played, subscription started). IP address collection is disabled. No sensitive health data is sent.

• Resend (resend.com) — transactional email. Receives your email address and the content of feedback messages you submit.

• Expo / Expo Application Services (expo.dev) — over-the-air app updates and push notification delivery. Receives your device push token (if notifications are enabled) and app version information.

5. Analytics & Tracking

We use Amplitude to understand how users interact with WellAudio in aggregate. The events we track include: account creation method, onboarding completion, session category tapped, session liked or downloaded, subscription started or managed, and sign-out.

We do not use advertising trackers, third-party ad networks, or cross-app tracking. IP address collection in Amplitude is explicitly disabled. We do not share analytics data with advertisers.

6. Data Retention

Your account data is retained while your account is active. Downloaded audio files are stored locally on your device and can be removed at any time from Settings → Downloads.

Feedback submission metadata (user ID and timestamps) collected for rate-limiting purposes is automatically deleted after 7 days.

You may delete your account at any time via Settings → Account → Delete Account. Deletion is immediate and permanent — your profile, listening history, likes, and linked authentication credentials are removed at the time of request. Aggregated, anonymised analytics data may be retained. You may also contact hello@wellaudio.com for assistance.

7. Your Privacy Rights

Depending on your location, you may have rights under applicable law (including GDPR and CCPA/CPRA) to:

• Access the personal data we hold about you. • Request correction of inaccurate data. • Request deletion of your data. • Object to or restrict certain processing. • Data portability (receive your data in a structured format). • Opt out of the sale or sharing of personal information (we do not sell or share personal data).

To exercise any of these rights, contact hello@wellaudio.com. Account deletion is available immediately in-app via Settings → Account → Delete Account.

8. Security

We use industry-standard encryption for data in transit (HTTPS/TLS) and at rest. Authentication sessions are stored securely on-device using encrypted storage.

Audio files are delivered via short-lived signed URLs generated server-side that expire within 30 minutes. All audio signing is performed by authenticated server functions — the signing credentials are never exposed to client devices.

We apply rate limiting to account sign-ups, sign-ins, and support form submissions to protect against automated abuse. Submission metadata used for rate limiting is retained for 7 days and then automatically purged.

Subscription entitlement is verified server-side before granting access to premium content. Access to the administration panel is restricted to authorised personnel only.

9. Children's Privacy

WellAudio is not directed at children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact hello@wellaudio.com and we will delete it promptly.

10. International Data Transfers

WellAudio is operated from the United States. If you access the app from outside the US, your information may be transferred to and processed in the US or other countries where our service providers operate. We rely on appropriate safeguards (such as Standard Contractual Clauses where required) for international transfers.

11. Changes to This Policy

We may update this policy periodically. We will notify you of material changes via in-app notice or email at least 14 days before they take effect. The date of the most recent revision is shown at the top of this policy. Continued use of WellAudio after changes take effect constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or to exercise your rights, contact us at hello@wellaudio.com or via the Help & Support form in Settings.