Privacy Policy

1. Controller

The controller responsible for data processing through the DreamSleep app is:

Mental Mobile Coach GmbH
Gutenbergstraße 10
55257 Budenheim
Deutschland
Email: info@dreamsleep-app.com

2. Overview

DreamSleep is a sleep improvement app that provides personalized sleep coaching, evidence-based practices, and educational content. This policy explains what personal data we collect, why we collect it, how we process it, and what rights you have under the General Data Protection Regulation (GDPR).

Because DreamSleep is a sleep-coaching app, some of the data you share with it (such as sleep patterns and information you provide about your sleep problems) can constitute health-related data within the meaning of Art. 4(15) and Art. 9 GDPR. We process such data only on the basis of your explicit consent, which you give when creating your account and can withdraw at any time (see Sections 3.2, 3.3, and 6).

3. Data we collect

3.1 Account data

When you create an account, we collect:

• Email address – for authentication and account recovery
• First name – for personalized coaching
• Age and sex (Geschlecht) – for sleep-relevant personalization
• Timezone – for accurate scheduling of practices and notifications

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)) – necessary to provide the service.

3.2 Sleep and health-related data

During your use of the app, we collect:

• Sleep habits – bedtime, wake time, sleep quality self-assessment
• Chronotype assessment results – to determine your optimal sleep schedule
• Sleep protocol data – daily sleep logs, protocol progress, and weekly comparisons
• Personal information (optional) – any additional context you choose to share for coaching
• Coaching notes – short summaries and notes the AI Sleep Coach derives from your conversations (for example about your habits, goals, and practices you have tried) so that coaching stays consistent over time. These notes are stored in your profile, are not shown in the app, and are included in your data copy (Section 6).
• Program report – at the end of the 8-week program, a summary of how your sleep diary developed (for example sleep quality, time to fall asleep, night-time awakenings) together with a personal sleep plan. It is stored in your profile, shown in the app and included in your data copy.
• Health information (optional) – your answers to the voluntary health questions in onboarding and in your profile: sleep-relevant conditions a doctor has diagnosed or is clarifying, pregnancy, snoring with breathing pauses, and sleep medication. They are stored in your profile and used for two purposes only: to leave out practices that are not suitable for you, and as context for the AI Sleep Coach. Every question can be skipped, and you can change or remove the answers in your profile at any time.

Legal basis: Your explicit consent (GDPR Art. 9(2)(a) in conjunction with Art. 6(1)(a)), given when you create your account. This data can constitute health-related data. You can withdraw your consent at any time (see Section 6); without it, the core coaching service cannot be provided.

3.3 Chat data

Conversations with the AI Sleep Coach are stored to provide continuity and context-aware coaching. Messages are processed by Google Cloud Functions and, to generate responses, transmitted to Anthropic in the USA (see Section 4). Before suggesting certain practices (for example bedtime restriction), the coach may ask you for safety reasons about relevant medical conditions or medication; any such information you choose to share is processed like all other chat messages. From your conversations the coach also creates a rolling summary and coaching notes (see Section 3.2), which are stored to keep coaching consistent.

Legal basis: Your explicit consent (GDPR Art. 9(2)(a) in conjunction with Art. 6(1)(a)), given when you create your account, since chat messages may contain health-related information.

3.4 Practice and progress data

We store information about practices you accept, complete, or decline, including task history, streaks, and knowledge module completion status.

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)).

3.5 Device and technical data

• Push notification tokens (FCM) – to deliver notifications you have opted into
• App version and build number – for compatibility checks
• Device model and operating system – collected automatically by Firebase

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) – ensuring app stability and compatibility.

3.6 Usage and diagnostic data (only with your consent)

We use Firebase Analytics and Firebase Crashlytics (both provided by Google) to understand how users interact with the app and to find and fix crashes and errors — but only if you actively enable it. Both are switched off by default and are activated only when you opt in during onboarding or in the app settings. If enabled, we collect:

• Screen views and navigation patterns
• Session duration and frequency
• Feature usage (e.g., which screens are visited, chat session starts)
• App instance ID (a pseudonymous device identifier)
• Crash and error reports: the technical error message and stack trace, the type of error, the screen you were on and the last actions in the app (e.g. "save sleep log"), app version, device model and operating system version, free memory and storage, device orientation, whether the device is rooted or jailbroken, and a Crashlytics installation identifier

Analytics events and crash reports are associated with pseudonymous identifiers (the app instance ID and the Crashlytics installation identifier); we do not link them to your user account, and they never contain your sleep log entries, chat messages or health information. The data is used solely for product improvement and for fixing errors. It is not used for advertising or sold to third parties.

You can withdraw your consent at any time in the app under Settings > Legal Documents > Usage and diagnostic data. Collection stops immediately; the lawfulness of processing before the withdrawal remains unaffected.

Legal basis: Your consent (GDPR Art. 6(1)(a); Section 25(1) TDDDG for storing/reading identifiers on your device).

3.7 Purchase and subscription data

If you purchase the 8-week coaching program or a subscription through the Apple App Store or Google Play, we process your purchase and subscription status, the product identifier, the purchase date and access period, and a store transaction identifier via our subscription management provider RevenueCat (see Section 4). If you redeem a promotional code, we additionally record the code you used as an attribute of that purchase so that we can account for the discount and remunerate the partner who distributed the code; partners only receive redemption counts per code, never your name, email address or other account data. Payment details (e.g., credit card numbers) are processed exclusively by Apple or Google; we never receive them. When you delete your account, we also delete your customer record at RevenueCat; your purchase history remains with Apple or Google and can be restored in the app after a new registration with the same store account.

Records of promotional-code redemptions (code, product, transaction identifier, date) are accounting records and are retained for the statutory retention period (currently eight years, § 147 (3) AO as amended in 2025). When you delete your account, the link to your user ID is removed from these records.

Legal basis: Contract fulfillment (GDPR Art. 6(1)(b)) – managing your access and entitlements; legal obligation (GDPR Art. 6(1)(c)) for retaining accounting records.

3.8 Waitlist (website, closed)

Until the launch of the app in October 2026 you could join a launch waitlist on our website. The waitlist is closed; all entries were deleted after the launch notification had been sent.

3.9 Reporting of chat replies

You can report an individual reply of the AI Sleep Coach in the app (long-press the reply, then "Report reply"). If you do, we store the reported reply, the reason you selected and your optional comment together with your user ID, app version and platform for up to 12 months. We use this to review the reply, improve the coach and meet the content requirements of the app stores. Reports are not shared with third parties. When you delete your account, the link to your user ID is removed from your reports; the reported reply, reason and comment remain for the review period of up to 12 months. Please do not enter data about other people in the comment.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) in safe and correct coaching content; insofar as the reported reply contains health-related data, your explicit consent (GDPR Art. 9(2)(a)) already given for the AI Sleep Coach (Section 3.3).

3.10 Email newsletter (only with your consent)

If you enable the email newsletter in the app (during onboarding, when accepting updated legal documents, or in the settings), we store your choice, the time of your last change and the version of the consent text in your profile. The newsletter is switched off by default. With your consent we send emails with sleep knowledge, news about DreamSleep and offers to the email address of your account. Before the first newsletter we ask you to confirm your email address (double opt-in); without this confirmation you will not receive a newsletter.

You can also subscribe to the newsletter on our website (dreamsleep-app.com), without an app account. In that case we store your email address, your language, the time of signup and confirmation, the version of the consent text you agreed to and a random code for the unsubscribe link. We first send you an email in which you confirm the signup (double opt-in); without this confirmation you will not receive a newsletter. Signups that are not confirmed are deleted after 30 days. To protect against abusive signups, we count requests per IP address for at most one hour in our server's memory, without storing or logging the IP address.

The newsletter is sent via our email provider Brevo (see Section 4). For this purpose Brevo receives your email address, your language and the time of your consent. No sleep or health data is passed on to Brevo. Your consent to the newsletter is not a condition for using the app.

You can withdraw your consent at any time in the app under Settings › Legal Documents › Email newsletter, or via the unsubscribe link in every newsletter; if you subscribed on the website, via the unsubscribe link in every email. The lawfulness of processing before the withdrawal remains unaffected.

Legal basis: Your consent (GDPR Art. 6(1)(a); Section 7(2) of the German Act against Unfair Competition, UWG).

3.11 Website analytics (Pirsch, cookie-free)

On our website (dreamsleep-app.com) we use Pirsch Analytics, a cookie-free web analytics service of Emvi Software GmbH, Germany (see Section 4), to measure how many people visit the website, which pages they view, where they come from (for example a search engine, a social network or a campaign link) and which buttons they click (for example the link to the app store). Pirsch does not set cookies and does not store or read anything on your device. To count visits, your IP address, your browser identification (user agent) and a random value that changes daily are combined into a short hash; this hash cannot be reversed, is not kept beyond the day and your IP address itself is not stored. The following data is recorded in aggregated form: page viewed, referring page and campaign parameters, country, region and city derived from the IP address (rough localisation via a database on the provider's servers), browser, operating system, device type, screen size and language. The app itself does not use Pirsch.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) in measuring the reach of our website and improving it. Because no information is stored on or read from your device, no consent under Section 25 TDDDG is required. You may object to this processing at any time (see Section 6).

3.12 Gift cards

When you redeem a DreamSleep gift card, we process the card's code and assign it to an account. On our website (purchase.dreamsleep-app.com/r) you enter the code and the email address of the account the coaching should be credited to. If an account with this address exists, we credit the coaching right away. Otherwise we store an irreversible hash of the address on the card – not the address itself – and credit the coaching as soon as an account with this address is registered in the app; the hash is then deleted. The website never tells whether an account exists for an address. We also store on the card when it was activated, reserved and redeemed and which account (user ID) it was credited to. In the Android app you can also enter the code directly; we then process only the code and your user ID.

To protect against abusive requests, we count redemption attempts per IP address for at most one hour in our server's memory. The IP address is neither stored nor logged.

Legal basis: Performance of a contract (GDPR Art. 6(1)(b)) – redeeming the gift card; legitimate interest (GDPR Art. 6(1)(f)) in protecting our website against abusive requests.

3.13 Internal statistics

To improve the onboarding, the free trial and our offer, we evaluate account data internally for statistical purposes: whether the onboarding was completed, age and sex, how the free trial was used (number of messages sent to the coach, start and end of the trial) and whether a purchase followed, and whether usage and diagnostic data and the newsletter are switched on. For this we use only the account and purchase data described in Sections 3.1 and 3.7 and your consent settings – never your sleep protocols, chat messages or health information. The evaluation is independent of the setting for usage and diagnostic data (Section 3.6): it uses no analytics data and reads nothing from your device.

We carry out the evaluation ourselves. It contains no names or email addresses, its results are used in aggregated form only and are not passed on to anyone, and we take no decisions about you and do not contact you on its basis. No additional data is stored for it; working files with per-account data are deleted once the evaluation is done, at the latest after 30 days.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) in improving our service. You may object to this processing at any time, for example by email to info@dreamsleep-app.com (see Section 6); your account is then left out of all further evaluations.

4. Data processors

We use the following third-party services to operate DreamSleep:

Google processes data under the Google Cloud Data Processing Addendum (Art. 28 GDPR). Data is stored in the EU (database and file storage in Google's EU multi-regions, Cloud Functions in europe-west3, Frankfurt) with no third-country transfer for core services.

Anthropic processes data as a processor under a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. Data transfers to Anthropic are covered by EU Standard Contractual Clauses (Art. 46 GDPR). Data sent to Anthropic is limited to what is necessary to generate your coaching response and is not used to train Anthropic's models.

RevenueCat processes data as a processor under a Data Processing Agreement pursuant to Art. 28 GDPR. Data transfers to RevenueCat are covered by EU Standard Contractual Clauses (Art. 46 GDPR).

Emvi Software GmbH (Pirsch Analytics) processes data as a processor under a Data Processing Agreement pursuant to Art. 28 GDPR. All data is processed and stored exclusively in Germany; there is no third-country transfer.

5. Data retention

• Active accounts: Data is retained as long as your account exists.
• Deleted accounts: Your app content (profile, sleep logs, chat history, practice data) is deleted immediately upon account deletion; copies may remain in our backups for up to 7 days before they are overwritten. Upon deletion, your account record is immediately reduced to your user ID, your email address and your consent and acceptance record (which version and language of our legal documents you accepted and when, and your explicit consent to the processing of health data with its date). This reduced record is retained until the end of the third calendar year after deletion so that we can demonstrate your consent and defend legal claims (Art. 7(1), Art. 6(1)(f) and Art. 17(3)(e) GDPR; limitation period under Section 195 BGB), and is then automatically and permanently deleted.
• Usage and diagnostic data: If you enabled usage and diagnostic data, analytics event data is retained by Firebase for up to 14 months and crash and error reports for 90 days.
• In-app feedback: In-app feedback and ratings are stored anonymously, without any link to your account, are therefore not affected by account deletion, and are deleted after 2 years at the latest.
• Inactive accounts: We delete accounts that are no longer used so that your data is not stored longer than necessary. An account in which nothing was ever purchased is deleted 12 months after it was last used; an account in which a program or subscription was purchased is deleted 24 months after it was last used, provided that no subscription or program is active any more. Before deleting we notify you twice by email to the address of your account (90 days and 30 days before the deletion date); any sign-in to the App within that time keeps the account. The deletion then follows the same rules as a deletion by you (immediate deletion of your app content, reduced record as described above).
• Newsletter: Your newsletter choice and its consent record are stored in your profile for as long as your account exists. If you withdraw your consent, we stop sending the newsletter without delay and remove your address from the mailing list at Brevo. If you subscribed on the website, your address and its consent record are stored until you unsubscribe and are then deleted; signups that are never confirmed are deleted after 30 days.
• Website analytics: Pirsch statistics are stored in aggregated form without any personal reference. The daily hash used to count visits is not kept beyond the day it was created.
• Gift cards: The hash of an email address is deleted as soon as the card has been credited to an account, at the latest when the card's redemption period ends. We keep the other card data (code, status, timestamps) so that a card cannot be redeemed twice; if you delete your account, we remove the link to your user ID.

6. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15) – request a copy of your data
• Right to rectification (Art. 16) – correct inaccurate data (available in-app via Profile settings; the email address of your account can be changed on request via support@dreamsleep-app.com)
• Right to erasure (Art. 17) – delete your account and all data (instructions here)
• Right to data portability (Art. 20) – request your data in a machine-readable format
• Right to restrict processing (Art. 18) – request limitation of processing
• Right to object (Art. 21) – object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3)) – you may withdraw any consent at any time with effect for the future: consent to usage and diagnostic data and newsletter consent via the toggles in Settings (the newsletter also via the unsubscribe link in every newsletter), and your consent to the processing of sleep and health-related data by contacting us or deleting your account. Note that without the latter consent, the coaching service cannot be provided. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, contact us at info@dreamsleep-app.com. We will respond without undue delay, at the latest within one month.

7. Data security

We implement the following measures to protect your data:

• All data is transmitted over encrypted connections (TLS/HTTPS)
• Firebase Authentication secures access to your account
• Firebase App Check protects against unauthorized API access (Play Integrity on Android, App Attest on iOS)
• Firestore security rules restrict data access to the authenticated owner
• Cloud Functions run in isolated, secure environments

8. Children's privacy

DreamSleep is not intended for children under 16 years of age. We do not knowingly collect data from children. If you believe a child has provided personal data, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. When we make significant changes (major version update), you will be asked to review and agree to the updated policy within the app. Minor updates will be reflected in the version number.

10. Right to lodge a complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. If you live in Switzerland, see Section 12.

11. Contact

For all data protection inquiries:

Mental Mobile Coach GmbH
Gutenbergstraße 10
55257 Budenheim
Deutschland
Email: info@dreamsleep-app.com

12. Users in Switzerland

If you live in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies to the processing of your personal data in addition to the GDPR. Everything this policy says about the data we process, the purposes, the recipients, the retention periods and your rights applies equally under the FADP; the controller is the company named in Section 1.

Sleep and health-related data (Sections 3.2 and 3.3) are sensitive personal data within the meaning of Art. 5(c) FADP. We process them only with your express consent (Art. 6(7)(a) FADP), which you give when you create your account and can withdraw at any time (Section 6).

Disclosure abroad (Art. 16 and 17 FADP): your data is stored in the European Union, in countries with an adequate level of data protection according to the list of the Federal Council (Annex 1 of the Data Protection Ordinance). Transfers to our processors in the USA (Anthropic and RevenueCat, see Section 4) are safeguarded by standard contractual clauses recognised by the Federal Data Protection and Information Commissioner, with the adaptations required for Switzerland (Art. 16(2)(d) FADP).

Your rights under the FADP include in particular the right of access (Art. 25 FADP), the right to receive your data or have it transferred (Art. 28 FADP), the right to rectification (Art. 32 FADP) and the right to have your data deleted. To exercise them, contact us as described in Section 6. You may also contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland, www.edoeb.admin.ch.