Privacy Policy

Last updated: 9 October 2026

The short version

To run Stormless we collect only your account details, your subscription status and basic technical data; usage analytics and ad measurement are optional and described below. Your quiz answers, check-in answers and plan stay on your device. They are never sent to us, and analytics never includes them or your plan’s topic. Nothing about your health or what you listen to is ever shared with Meta or used for advertising.

Usage analytics, in the app and on this website, stays off unless you agree, and you can change your mind at any time. These usage events aren’t linked to your name, email or account.

We advertise the app on Facebook and Instagram. If you choose Allow when your iPhone asks whether the app may track you, we share your device’s advertising ID and a few basic events (the install, app opens, a new account and, through our subscription provider, your subscription) with Meta, so we can see which of our ads work. If you don’t allow it, nothing is sent to Meta, and the app works just the same. You can change your answer at any time in your iPhone’s Settings.

We don’t sell your data and we don’t show ads. You can delete your account at any time, in the app or on this website.

1. Who is responsible for your data

This Privacy Policy explains how Slow Mind, MB (“Stormless”, “we”, “us”), the data controller, handles your personal data when you use the Stormless mobile app, the website stormless.app (including its account page), or contact us.

Controller: Slow Mind, MB
Registered address: Burbiškių g. 6-59, LT-03164 Vilnius, Lithuania
Company code: 307673657
Privacy contact: privacy@slowmind.app (general support: info@slowmind.app)

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data-protection laws. If you don’t agree with this Policy, please don’t use the Service.

2. What we collect, why, and for how long

2.1 Your account

Data	Email address; name (as you enter it, or as provided by Google or Apple sign-in); authentication identifiers; account creation and last sign-in dates.
Purpose	Creating and securing your account and signing you in, in the app and on the website.
Legal basis	Contract (GDPR Art. 6(1)(b)).
Retention	Until you delete your account. Deleting it removes your account from our production systems; residual copies in our providers’ encrypted backups expire on their backup cycle.

2.2 Your quiz, plan and progress, kept on your device

Your answers to the starting-point quiz, your 28-day plan, daily check-ins and weekly scores, listening progress, favourites, downloads, streaks and reminder settings are stored only in the app’s storage on your device. They are not sent to us or to anyone else (apart from the optional usage events below), so we can’t see them.

Some quiz answers can relate to your health, such as sleep, stress, pain, eating, smoking or drinking. Because they never leave your device, we don’t process them. Daily reminders are scheduled by your phone itself, so we don’t collect a notification token.

This data is removed when you delete the app, and your quiz answers are replaced when you start a new plan. If you back up your phone, for example with iCloud, the backup may include this data under your own account with Apple.

If you turn on Share usage data (section 2.6), the app also sends an event when you play or finish a session, play a soundscape, start or finish a breathing exercise, pin something or finish a download. Those events name the content, for example “program s01, session 2”, and never include your answers, scores, check-ins, plan topic or anything you type. They go only to Google Analytics, never to Meta.

2.3 Purchases and subscription status

Data	Your subscription status, product identifiers, purchase and expiry dates, the store (Apple or Google), and your account ID as a pseudonymous identifier. We never receive your card number or payment details: payments are processed entirely by Apple or Google. The software of RevenueCat, our subscription provider, also sends your device’s IDFV (an ID iOS gives each app maker for your device) with its requests, and, if you open Manage subscription, which of its screens you see and any reason you pick when cancelling.
Purpose	Unlocking Stormless Pro, restoring purchases and handling changes to your subscription. What RevenueCat also does for ad measurement is described in sections 2.7 and 2.8.
Legal basis	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for accounting records where applicable.
Retention	While your account exists; transaction records as required by tax and accounting law (typically up to 10 years).

2.4 Technical data

Data	Device type and operating system, app version, language, IP address (transiently, for connections), and request logs kept by our hosting, storage and sign-in providers. We don’t show ads and we don’t use a crash-reporting tool. Analytics is optional and only runs if you agree (sections 2.6 and 9), and ad measurement only runs if you allow tracking (sections 2.7 and 2.8).
Purpose	Delivering audio and pages, keeping the Service secure and working, and fixing problems.
Legal basis	Legitimate interests (Art. 6(1)(f)) in operating and securing the Service.
Retention	For limited periods set by our providers, after which it is deleted.

2.5 Support and correspondence

Data	Your email address, the content of your messages, and the account context needed to help you.
Purpose	Answering questions, resolving complaints, and handling requests about your rights.
Legal basis	Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in keeping a record of how issues were resolved.
Retention	Up to 3 years after the matter is closed, unless a longer period is needed for legal claims.

2.6 Usage data in the app (optional)

The app asks once, on Home, whether you’d like to share usage data. Nothing is collected until you tap Share usage data, and you can change your answer at any time in Profile, under Privacy. Usage data goes to Google Analytics for Firebase.

Data	Which screens you open, for example Home, Programs, a program’s page, a player or the subscription screen, and how long each one stays in front. Which programs, sessions, soundscapes and breathing exercises you start and finish, by their ID (for example “program s01, session 2” or “rain, version 1”), with the narrator, and for breathing the technique and length. These IDs can hint at what you’re working on, for example a program about sleep, drinking less or quitting smoking. The program your 28-day plan is built on is only ever sent as “plan”, so your plan’s topic can’t be read from the data. How long you listen: the seconds of audio actually heard for each session, soundscape or breathing exercise, with the same IDs as above. It is sent when playback pauses or ends, when you leave the app, and once a minute while audio keeps playing. Time before you agree, or after you switch Share usage data off, is never sent. Whether you started and finished the starting-point quiz and started a plan. Never the topic and never your answers. How you signed up or signed in: Apple, Google, email or without an account. Narrator changes, pins and unpins, finished downloads, tapping Get started on the welcome screen, when the Stormless Pro screen is shown and where from, taps on a subscription option (monthly, yearly or lifetime) or on Restore, and completed purchases with that option, never a price. Whether feedback was sent by email or copied. Never the message. Events Google Analytics records itself: first open, app sessions, time in the app, app and iOS updates, and on iPhone your in-app purchases and App Store subscription renewals, conversions, cancellations and refunds (the product, its price and currency). With every event: device model, iOS version, app version, language, an approximate location (country, region and city) that Google works out from your IP address, and a random app-instance ID that tells events from the same install apart. Google Analytics doesn’t store your IP address.
Never	Your quiz answers, scores, check-ins, plan topic, weekly check-in results, the text of your daily step or anything you type; your name or email address. The app never sets a user ID, never sends your account ID with its usage events and never gives the app-instance ID to anyone else. Google never receives your advertising identifier (IDFA), even if you allow tracking for Meta (section 2.7), and Google signals and all advertising features are off.
Purpose	Seeing which sessions, sounds and features help people, finding what is confusing or broken, and deciding what to improve or make next.
Legal basis	Your explicit consent (GDPR Art. 6(1)(a) and, because the content you play can hint at your health, Art. 9(2)(a)), which also covers storing and reading the analytics ID on your device under the ePrivacy rules as applied in Lithuania. You can withdraw it at any time.
Retention	Google Analytics keeps event-level data for 2 months and then deletes it; the reports we keep contain totals only. Switching Share usage data off stops collection straight away, clears the analytics data still waiting on your phone and replaces the app-instance ID with a new one. Because these usage events aren’t linked to you, we can’t look up what was sent from one phone; it is deleted when its retention period ends.
Processor	Google Ireland Limited (section 4).

2.7 Ad measurement with Meta (only if you allow tracking)

We advertise the app on Facebook and Instagram and want to know which ads lead to installs and subscriptions. For that, the app can share a small amount of data with Meta, but only if you choose Allow when your iPhone asks whether the app may track your activity across other companies’ apps and websites. The question comes at most once, at the end of the starting-point quiz, never when the app first starts.

Until you choose Allow, Meta’s software in the app isn’t even started, so nothing is sent to Meta, and RevenueCat gets no advertising identifiers. The app works the same whatever you choose.

Data	Identifiers: your device’s advertising identifier (IDFA) and an anonymous ID that Meta’s software creates for this install. Events the app sends through Meta’s software: that the app was installed, each time it is opened from scratch (with how long the previous visit lasted), and that a new account was created, without any details about it. Events RevenueCat (section 2.3) sends from its servers: when you start a free trial, subscribe, renew or buy lifetime access, with the product, price and currency. For this, the app gives RevenueCat the two identifiers above and your IP address, and RevenueCat adds the IDFV it already has (section 2.3) and its customer ID for you, which is your account ID if you’re signed in and a random ID if not. Technical details that come with these requests, such as device model, iOS version, app version, language, time zone, screen size, storage space and your IP address, and, if Meta’s own software ever crashes, a report about that crash.
Never	Anything about your health or what you do in the app: no quiz answers, scores, check-ins, plan or its topic, no names or IDs of programs, sessions, soundscapes or breathing exercises, no listening time and nothing you type. Not your name or email address. We keep Meta’s automatic logging of in-app events and its automatic advanced matching switched off.
Purpose	Measuring which of our ads on Facebook and Instagram lead to installs, new accounts and subscriptions, so we can stop paying for ads that don’t help. Meta also uses this data under its own terms, for example to improve how it delivers ads.
Legal basis	Your consent (GDPR Art. 6(1)(a)), given by choosing Allow, which also covers reading the advertising identifier on your device under the ePrivacy rules as applied in Lithuania. You can withdraw it at any time.
How to withdraw	Open Settings on your iPhone, then Privacy & Security, then Tracking, and turn tracking off for the app. After that the app sends nothing more to Meta, and Meta’s software isn’t started the next time the app opens. The next time you open the app, it also removes Meta’s anonymous ID from RevenueCat, and RevenueCat stops sending your subscription events to Meta. If you change it while the app is open, Meta’s software stops logging straight away but may still check its settings with Meta until you close the app.
Retention	Meta keeps the data it receives under its own privacy policy. RevenueCat keeps the identifiers with your subscription record (section 2.3). After you turn tracking off and open the app again, the advertising identifier collected earlier stays on that record but is no longer passed to Meta. If you won’t open the app again, write to us and we’ll have it removed. For data Meta already holds, you can use the tools in Meta’s privacy policy, or write to us and we’ll help.
Recipients	Meta Platforms Ireland Limited, and RevenueCat, Inc. as our processor (section 4).

2.8 Apple Ads attribution (only if you allow tracking)

We may also advertise in App Store search results with Apple Ads (formerly Apple Search Ads). To see whether an install came from one of those ads, the app asks iOS for a short-lived attribution token and passes it to RevenueCat, which asks Apple. Apple answers whether the install came from one of our campaigns and, if so, which campaign, ad group and search keyword. This doesn’t use your advertising identifier, and Apple doesn’t require the tracking permission for it, but it happens only if you allow tracking (section 2.7).

Data	The attribution token, and Apple’s answer, kept with your subscription record at RevenueCat.
Purpose	Measuring which of our Apple Ads lead to installs and subscriptions.
Legal basis	Your consent (GDPR Art. 6(1)(a)), given by choosing Allow, which also covers reading the token on your device under the ePrivacy rules as applied in Lithuania. You can withdraw it in your iPhone’s Settings.
Retention	As for your subscription record (section 2.3).

3. Where your data comes from

We collect data directly from you (when you create an account or write to us), automatically from your use of the Service (technical data, and usage data if you agree to it), from Google or Apple if you sign in with them (your name and email address), from the app stores and our subscription provider (purchase events), and from Apple, whether your install came from one of our Apple Ads (section 2.8). Meta’s ad reports show us only totals, not data about you. We don’t buy data about you, and we don’t collect it from data brokers or public profiles.

4. Who we share data with

We never sell your personal data. We share it only with service providers who process it on our behalf under data-processing agreements, with Meta for ad measurement if you allow tracking (section 2.7), or with independent controllers where the law provides for it:

Recipient	Role	What and why
Google Cloud / Firebase (Authentication, Cloud Storage, Hosting)	Processor	Your account and sign-in, delivering session audio, and hosting this website. Google may process this data in the EU and in the United States.
Google Ireland Limited (Google Analytics and Google Analytics for Firebase)	Processor	Usage data, only if you agree (sections 2.6 and 9). Google processes it on our behalf under its data processing terms, in the EU and in the United States. Google signals and all advertising features are off, and Google never receives your advertising identifier.
RevenueCat, Inc.	Processor	Managing subscription status across platforms (pseudonymous account ID, purchase status and your device’s IDFV; no payment card data), and the Manage subscription screens (section 2.3). Also, as sections 2.7 and 2.8 describe: if you allow tracking, your advertising identifiers and IP address, to send your subscription events to Meta, and the Apple Ads attribution token.
Meta Platforms Ireland Limited	Joint controller, then independent controller	Ad measurement for our Facebook and Instagram ads, only if you allow tracking (section 2.7). Meta is a joint controller with us for collecting and sending the data, and an independent controller for its own use of it after that. The essence of our arrangement is set out in Meta’s Controller Addendum. Meta may transfer data to Meta Platforms, Inc. in the United States. See Meta’s privacy policy.
Apple / Google	Independent controllers	App distribution, payment processing and refunds, Sign in with Apple or Google, and Apple Ads attribution (section 2.8), under their own terms and privacy policies.
Authorities, courts, advisers	Independent controllers	Only where required by law, to defend legal claims, or to prevent fraud or abuse.

If we are involved in a merger, acquisition or asset sale, personal data may be transferred as part of it. We will tell you before your data becomes subject to a different privacy policy.

5. International transfers

Some of our providers and partners process data outside the European Economic Area, for example Google (including Google Analytics), Meta and RevenueCat in the United States. We protect it through European Commission adequacy decisions (including the EU-US Data Privacy Framework, under which Google LLC and Meta Platforms, Inc. are certified), the Commission’s Standard Contractual Clauses supplemented by transfer impact assessments, and technical safeguards such as encryption in transit and at rest.

6. How we protect your data

Encryption in transit (TLS) and at rest on our cloud infrastructure;
internal access to production systems limited to what running the Service requires;
no payment card data ever touches our systems;
your quiz answers and plan never leave your device;
nothing about your health or what you listen to is ever sent to Meta.

No system is perfectly secure. Please use a strong, unique password and keep your device protected. If a data breach affecting your rights occurs, we will notify you and the supervisory authority as required by GDPR Articles 33 and 34.

7. Your rights

Under the GDPR (and equivalent laws), you have the right to:

Access: get a copy of the personal data we hold about you (Art. 15);
Rectification: correct inaccurate or incomplete data (Art. 16);
Erasure: have your data deleted (Art. 17). The fastest way is to delete your account, in the app under Profile, then Delete account, or on your account page. You can also email us;
Restriction of processing in the situations set out in Art. 18;
Portability: receive your data in a structured, machine-readable format (Art. 20);
Objection to processing based on legitimate interests (Art. 21);
Withdrawing consent at any time, without affecting earlier processing (Art. 7(3)). For usage data in the app, switch off Share usage data in Profile, under Privacy; for ad measurement with Meta and Apple Ads, turn tracking off for the app in your iPhone’s Settings, under Privacy & Security, then Tracking; on this website, choose Cookie settings at the bottom of any page;
Complaint to your local supervisory authority or to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

To exercise any right, email privacy@slowmind.app from the address linked to your account; we may ask you to verify your identity. We respond within one month. For complex requests we may extend this by up to two further months, and we’ll explain why. Exercising your rights is free unless a request is manifestly unfounded or excessive.

8. Children

Stormless is for adults aged 18 and over. It isn’t directed at children, and we don’t knowingly collect their personal data. If you believe a child has created an account, contact us and we will delete it promptly.

9. Cookies and the website

Storage the website needs

stormless.app sets no advertising or cross-site tracking cookies. Its account page uses only the technical storage needed to keep you signed in (a Firebase Authentication token in your browser’s storage), which signing out removes. To sign you in, the account page loads Google’s Firebase code from Google’s servers (gstatic.com), which involves a technical request that includes your IP address. Your cookie choice is kept in your browser’s local storage (easemind-analytics-consent-v1) for up to 12 months, and then we ask again. Our fonts are hosted on our own site.

Google Analytics, only if you accept

On your first visit, a banner asks whether we may use Google Analytics. Until you choose Accept, no Google Analytics code is loaded and no analytics cookies are set, and Reject is as easy as Accept. If you accept, Google Analytics sets these first-party cookies:

Cookie	What it does	Expires
`_ga`	A random ID that tells visits from the same browser apart.	After 13 months
`_ga_0HVFYP5LV5`	Keeps track of the current visit.	After 13 months

Google Analytics then records the pages you view (their address without any query string), the site you came from, how long a page stays open, taps on our App Store and Create account buttons, and your browser, device type, language and approximate location, which Google works out from your IP address without storing the address. Google Analytics doesn’t run on the account page, where you sign in. It isn’t linked to your name, email or account: we don’t set a user ID, and Google signals and all advertising features are off. It is processed by Google Ireland Limited (section 4) and kept as described in section 2.6. The legal basis is your consent (GDPR Art. 6(1)(a) and the ePrivacy rules as applied in Lithuania).

To change your mind, choose Cookie settings at the bottom of any page. Reject stops Google Analytics and deletes its cookies from this site. You can also delete cookies in your browser’s settings at any time.

10. Regional notes

United Kingdom

If you are in the UK, the rights above apply under the UK GDPR and the Data Protection Act 2018. Transfers from the UK are safeguarded by adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You may complain to the Information Commissioner’s Office (ico.org.uk).

United States

Depending on your state (for example under the CCPA/CPRA in California), you may have rights to know, access, correct, delete and port your personal information, and to opt out of “sales” or “sharing” of personal information and of targeted advertising. We don’t sell your personal information. If you allow tracking, the data sent to Meta for ad measurement (section 2.7) may count as “sharing” or targeted advertising under some state laws; you can opt out at any time by turning tracking off for the app in your iPhone’s Settings, under Privacy & Security, then Tracking. We don’t use your personal information for profiling with significant effects. You can exercise your rights via privacy@slowmind.app, and we won’t discriminate against you for doing so.

Other jurisdictions

Where local law gives you additional rights (for example in Australia, Canada or Brazil), we honour them on request through the same contact.

11. Changes to this Policy

We may update this Policy from time to time. The current version, with its “Last updated” date, is always at stormless.app/privacy. For material changes, we’ll give notice in the app or by email before they take effect.

12. Contact

Privacy requests: privacy@slowmind.app
General support: info@slowmind.app
Controller: Slow Mind, MB, Burbiškių g. 6-59, LT-03164 Vilnius, Lithuania, company code 307673657