Privacy

Controller

The controller within the meaning of Art. 4(7) GDPR is:

The app

Sleep Well processes settings, preferences, and sounds on your device; they go to your own iCloud only while syncing is switched on (see below). The controller receives no personal data from your use of the app. There is no app server, no account, no sign-up, no advertising identifier, and no embedded analytics, advertising, or crash-reporting services.

On the device, the app stores what it needs in order to work:

• settings such as playback, timer, and the length of a sound
• favorites and sounds you have hidden
• changes to a sound from the catalog: which layers you have taken out or added, and how loud you have set them
• sounds you have created from an existing one
• which sound played last, so the app can pick up there
• the audio files that come out of listening, so that a sound plays offline

This data sits in the app's protected area on the device. Other apps cannot access it directly. Sleep Well does not transmit it automatically while “Sync with iCloud” is off. If you export a file or share it through the system share sheet, you choose the recipient. “Free up storage” in the settings deletes those audio files; removing the app takes everything else on the device with it.

A backup of your device may include this data. Apple's privacy terms apply to that.

“Sync with iCloud” in the app's settings additionally places the sounds a listener made themselves — along with favorites, hidden sounds, layer choices, and playback settings — in that person's own iCloud, so they survive a new device or a reinstall and several devices on the same account keep the same state. The switch is off to begin with; without it the app transfers none of this. The sounds' audio files and usage data never travel. The data is held in the private iCloud area of the Apple account in question; the controller has no access to it, and Apple's privacy terms apply. Switching it off removes this device’s data from iCloud again. Another device on which the switch stays on puts its own copy back there at its next sync.

Settings contains links that lead outward: to the Bluesky account, which opens in the browser, and to the privacy policy and legal notice, which the app loads from this website. A connection to the server in question is made only when one of those pages is opened, and it produces the data described in the section “This website” or by the provider concerned. Help inside the app needs no such request.

Buying Pro

Pro is a one-time purchase on the App Store. Apple handles the payment. Your payment details are never transmitted to the controller. The controller receives only aggregated statements from Apple with no reference to individual people. Apple is the controller for the purchase.

The app checks the purchase on the device through Apple's interface. It does not create an account in the process.

This website

When you open these pages, your browser transmits technically necessary information: IP address, date and time, the file requested, the volume of data transferred, where applicable the page visited before, and your browser and operating system. STRATO stores complete IP addresses for no more than seven days to detect and defend against attacks. Anonymized access logs are available for six weeks.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and trouble-free operation of the website. The logs are not combined with other data.

The website is hosted by STRATO GmbH, which processes the log data as a processor under a contract pursuant to Art. 28 GDPR. STRATO may use additional processors for this purpose. The possible recipients and safeguards for transfers to third countries are set out in STRATO's data processing agreement.

There are no cookies, no audience measurement, and no fonts, maps, videos or scripts embedded from third-party servers. That is why no consent banner appears.

These pages link to third-party services, among them Apple, STRATO, and the Bluesky account. Those links are plain links: they load nothing, and data reaches the provider concerned only once such a link is followed. From that point on, that provider's privacy policy applies.

This website stores nothing on your device — neither cookies nor entries in your browser's local storage. On the first visit to the home address, the language order sent by the browser is used only to open an available language address; it is not stored. After that, the language is part of the address, for example lofi-nights.app/de/ or lofi-nights.app/en/.

Contact by email or on Bluesky

When you contact the support address, your email address and the content of your message are processed in order to answer your request. The legal basis is Art. 6(1)(f) GDPR, and for matters concerning a purchase additionally Art. 6(1)(b) GDPR.

The message is kept for as long as it takes to deal with it and is deleted afterward unless a statutory retention period applies.

The support mailbox is operated by STRATO as a processor. The additional processors described in the following section may be used in the process.

A message to the Bluesky account @lofi-nights.bsky.social is processed for the same purpose, on the same legal basis, and kept for the same period. The route, however, is a different one: the message, the reply to it, and the fact that contact was made travel through Bluesky's servers rather than through the mailbox at STRATO. The service is operated by Bluesky Social, PBC, based in the United States, which processes its users' data on its own responsibility and not under instructions. To that extent Bluesky's privacy policy applies.

Depending on the kind of post, a message on Bluesky is publicly visible. For matters involving a purchase or other personal details, the email address is therefore the appropriate route.

Recipients and transfers to third countries

Using the sound features results in no automatic transfer to the controller or any other recipient. Your settings, favorites, and sounds of your own leave your device only if you export a file, share it through the system share sheet, or switch on “Sync with iCloud” — which puts the sounds you made, favorites, hidden sounds, layer choices, and playback settings into your own iCloud.

STRATO receives website visitor data and messages sent to the support address and processes them under instructions. Under the data processing agreement, processing generally takes place in the EU or EEA. Where a transfer to a third country is required for a contracted service, STRATO ensures that the requirements of Art. 44 et seq. GDPR are met. STRATO lists its approved additional processors and the respective safeguards in its data processing agreement. Data is received only by recipients used for the contracted service.

In connection with the App Store and your purchase, Apple processes data on its own responsibility, including in the USA. The controller has no influence over this processing; Apple's privacy policy applies.

The same holds for Bluesky as soon as the account there is opened or written to: the processing takes place on Bluesky's servers, including in the United States, and is Bluesky's own responsibility. Anyone who would rather not take that route reaches the same place through the email address.

Your rights

You have the right to information about the data stored about you, to rectification, to erasure, to restriction of processing, to data portability, and the right to object to processing based on a legitimate interest.

In practice, this concerns almost only this website's server logs and emails sent to the support address — no data is held about your use of the app that could be provided in response to an information request.

Without prejudice to any other remedy, you also have the right to lodge a complaint with a supervisory authority — in particular in the Member State of your residence, your place of work, or the place of the alleged infringement — if you consider that the processing of your personal data infringes the GDPR.

The competent supervisory authority is:

Changes

This policy will be updated when the app or website changes. The version published here, with the date given above, is the one that applies.