Privacy Policy

How we treat
your data.

Plain language. No dark patterns. If something here is unclear, write to /supportand we’ll fix it.

Effective 2026-10-20.

The short version

Breathey is a breathing app. We try to keep things simple and private. The bullet points below are true; the rest of this page just unpacks them.

  • Your breathing sessions live on your device: encrypted at rest in the phone apps, in your browser’s storage in the web app.
  • You can optionally back them up to your own private cloud (Firebase).
  • Analytics and crash reports are off by default. You explicitly opt in.
  • We don’t sell your data, ever. We don’t use ad networks.
  • You can delete everything at any time, from inside the app.

Who we are

Breathey is operated by Amaze Labs(“we”, “us”).

Registered office: 8 Mount Street, Auckland Central, Auckland, New Zealand.
NZBN: 9429053396341.

Questions about this policy or your data: breathey.app/support.

What this covers

This policy applies to:

  • The Breathey apps for iPhone and Android (the “App”).
  • The Breathey web app at app.breathey.app (the “Web App”).
  • The breathey.app website, including the newsletter and support form (the “Site”).

When we say “you” we mean the person using the App, the Web App or the Site. When we say “your data” we mean information that identifies you or that’s tied to your use of Breathey.

What the App collects

The App is designed to do as much as possible on your device. Here is everything it touches.

Stored on your device (always)

  • Breathing sessions — start/end time, duration, pattern (inhale / hold / exhale / hold seconds), completion status, pause count. Stored in an encrypted local database (AES-256).
  • Settings— daily goal, sound & vibration preferences, theme, breath preset, session-completion notification, data-retention preference (none / 90 / 365 days).
  • Reminders— times and days you’ve scheduled. Local notifications only; nothing leaves your device.
  • Onboarding flag— so we don’t show you the welcome flow twice.

Anonymous account (always, automatic)

When the App first launches it creates an anonymous Firebase account. This is just a random identifier (a UID) — no email, no name, no profile. It exists so the App can later sync your sessions across devices if you choose to enable cloud backup.

Optional cloud backup (Firebase Firestore)

Off by default. If you turn on cloud backup in Settings, your sessions are copied to your private Firestore document — same fields as the local database, plus the device platform (ios/android) and an updated timestamp. Strict per-user rules mean nobody else can read your sessions.

Optional health sync

Off by default. If you grant the system permission, completed sessions over 60 seconds are written to Apple HealthKit (iOS) as Mindful Minutes or to Health Connect (Android) as exercise sessions. We don’t store HealthKit data ourselves; the system does. You can revoke the permission anytime in iOS / Android settings.

Optional analytics & crash reports

Off by default and gated by an explicit consent prompt. If you opt in:

  • Firebase Analytics— high-level events (e.g. “reminder added”, “setting changed”, screen views) and a few aggregate properties (your daily goal, whether cloud backup is on). No content of your sessions or reminders is sent.
  • Firebase Crashlytics — crashes and non-fatal errors with stack traces, plus device model and OS version. Helps us fix bugs.

You can turn both off again at any time in Settings → Privacy.

iOS App Tracking Transparency

On iOS, the App may show the standard system prompt asking permission to use the device identifier for analytics. If you say no, nothing changes— analytics are off by default anyway. We don’t share any identifier with ad networks.

Permissions the App may ask for

  • Notifications — to deliver the reminders you scheduled.
  • HealthKit / Health Connect — only if you turn on health sync.
  • Background audio (Android) — to keep the session and its sound cues running when the screen is off.
  • Tracking transparency (iOS) — described above.

All permissions are optional and can be revoked from your device settings.

What the Web App collects

The Web App runs in your browser and keeps your data there. It sends nothing to us unless you allow analytics.

Stored in your browser (always)

  • Breathing sessions— the same fields as in the App, kept in your browser’s IndexedDB storage.
  • Settings and presets— sound and bell preferences, theme, start phase, your breath presets, your analytics choice and whether you closed the install suggestion. Kept in your browser’s local storage.
  • An offline copy of the Web App— its code, fonts and sounds, kept in your browser’s cache so it opens without a connection. This copy holds none of your data.

The Web App does not create a Firebase account, not even an anonymous one, and has no cloud backup. Your sessions stay in this browser on this device.

Keeping your history

After your first completed session, the Web App asks your browser to keep its storage. Safari may still delete a website’s data after 7 days of use without a visit. Adding the Web App to your Home Screen or Dock prevents that, so the Web App suggests it in Safari. Clearing your browser’s site data also deletes your history.

Optional analytics

Off until you choose “Allow”. The Web App asks once, in a bar at the top of the screen. Until you allow it, the Web App loads nothing from Google. If you allow it, the Web App loads Firebase Analytics, which loads Google Tag Manager and sets Google Analytics cookies. It then receives:

  • Session events — a session started, completed or stopped, with its length and breathing pattern.
  • Screen views (Home, History, Settings) and which setting you changed.
  • Two properties: that you use the web, and whether your device asks for reduced motion.

The Web App sends no crash reports. You can turn analytics off again at any time in Settings → Data & Privacy → Usage Analytics.

What the Site collects

Newsletter

If you submit your email to the newsletter form, we send it to Brevo (Sendinblue SAS)who hosts our contact list. We use it to email you occasional updates about Breathey. You can unsubscribe from any email we send. We don’t share the list with anyone.

Support form

When you write to us via /support, your name (optional), email, message and the type you picked (Bug / Feature / Question) are sent to our support inbox via Brevo’s transactional email service. We keep the message in our inbox so we can reply.

Server logs

Like every web server on the internet, ours records request lines (timestamp, IP address, path, user-agent) for short-term diagnostics and abuse prevention. Logs roll over and aren’t used to build profiles.

Cookies & trackers

The Site loads no analytics and sets no analytics cookies until you agree. If you accept Analytics in the cookie banner, the Site loads Google Tag Manager, which loads Google Analytics. Google Analytics sets cookies and records visits to the Site. If you decline Analytics, neither is loaded. Your choice is saved in your browser’s local storage. The Site has no ad pixels. Fonts are served from breathey.app itself; no request goes to Google Fonts.

With Analytics accepted, the Site also records which store button you click, whether your device is an iPhone, an Android phone or another kind, and which site or campaign link brought you here. Without it, that record stays in your browser and is sent nowhere.

Links to Google Play carry a campaign label. The label is the name of the site or campaign that brought you here. The stores use it to count visits. It does not identify you.

Who else sees your data

We use a small number of carefully chosen processors. They act on our behalf, under contract, and only for the purposes listed.

  • Google / Firebase (Google LLC) — anonymous auth, optional cloud backup (Firestore), optional analytics, optional crash reports; in the Web App, optional analytics only. Data may be processed in the United States and other regions where Google operates.
  • Brevo (Sendinblue SAS, France) — newsletter list and transactional email for the support form. Hosted in the EU.
  • Apple— distributes the App via the App Store and may collect download & crash metrics on its own under Apple’s privacy policy. If you enable health sync, the system writes Mindful Minutes to HealthKit on your device.
  • Hetzner (Hetzner Online GmbH, Germany) — hosts the breathey.app website and the Web App.
  • Google (the Site) — Google Tag Manager and Google Analytics, loaded only after you accept Analytics in the cookie banner. Privacy policy.
  • Google Play — distributes the Android App. If you turn on health sync, sessions are written to Health Connect on your device. Privacy policy.

We do not sell your data, do not share it with advertisers, and do not use it to build profiles for anyone else.

How long we keep things

  • Local sessions— kept on your device until you delete them, or automatically pruned if you set the “auto-delete sessions older than” preference.
  • Web App sessions and settings— kept in your browser until you delete them, clear the browser’s site data, or the browser removes them (see “Keeping your history” above).
  • Cloud backup (Firestore) — kept until you turn off cloud backup or delete your data.
  • Newsletter email — until you unsubscribe.
  • Support messages — kept in our inbox for as long as needed to handle the request, then archived.
  • Server logs — short-term, typically rotated within 14 days.

Your rights

You can, at any time:

  • See your data — every breathing session you have is visible inside the App in the History view. Settings and reminders are visible in Settings. You can also ask us by writing to /support.
  • Correct your data — edit reminders and settings inside the App. If anything else is wrong, write to /support.
  • Export your data— write to /support and we’ll send you a copy of what we hold (newsletter status, cloud-backed sessions if any).
  • Delete everything — open the App → Settings → Privacy → Delete All Data. This wipes local sessions, reminders, settings, your cloud data and your Firebase account in one go. In the Web App, Settings → Delete All Data wipes everything it stored in your browser. To unsubscribe from the newsletter, use the link at the bottom of any email or write to /support.
  • Withdraw consent— turn off analytics and crash reports in Settings → Privacy, or analytics in the Web App in Settings → Data & Privacy. Future events stop being collected.
  • Complain — if you’re in New Zealand, you can complain to the Office of the Privacy Commissioner. If you’re in the EU/UK, you can contact your local data-protection authority.

Children

Breathey isn’t directed at children and requires users to be at least 18. We don’t knowingly collect data from children. If you believe a child has used the App and you’d like their data removed, write to /support.

Security

In the App, local sessions are encrypted at rest with AES-256. In the Web App, they rely on the protection of your browser and device. Network calls go over HTTPS. Firebase uses per-user security rules so nobody can read your sessions but you. The App runs an integrity check (jailbreak/root detection) and warns you if the device is compromised. We’re a small team — we’re honest about that — and we’ll tell you if something goes wrong.

Changes to this policy

If we materially change anything that affects your data, we’ll update the “effective date” below and, if it’s significant, mention it in-app or by email to newsletter subscribers. Older versions are available on request.

Effective date: 2026-10-20.