Privacy Policy
Last updated: October 4, 2026
Introduction
Rizeora ("Rizeora," "we," "us," or "our") is a sleep-tracking and routines app that helps you understand your sleep, build morning and night routines, and reduce nighttime phone distractions. This Privacy Policy explains what personal information we collect through the Rizeora mobile application (the "App"), how we use and share it, and the choices you have.
This Privacy Policy is incorporated into and forms part of our Terms of Service. If you have questions, contact us at privacy@rizeora.app.
We are a small, independently developed app. We do not use advertising networks or ad-tracking SDKs, and we do not sell your personal information. We use a privacy-conscious product analytics tool, PostHog, to understand how people move through onboarding, to catch app crashes and errors, and to run optional in-app surveys — see below for details.
Personal Information We Collect
Information you provide us
- Account data — email address and password, used to create and log into your Rizeora account. Authentication is handled by our backend provider, Supabase; your password is never stored by us in plain text.
- Onboarding and profile data — information you enter when setting up the app, such as your name, birth year, sleep goal, self-reported chronotype, sleep blockers (things that get in the way of your sleep), typical bedtime and wake time, and how consistent you consider your sleep schedule.
- Routine data — the morning and night routine tasks you create or edit, and your daily completion status for those tasks (including tasks completed via the iOS Live Activity or Android notification action, outside the app itself).
- Sleep diary and mood entries — any sleep notes or mood entries you choose to log manually in the app.
- Chronotype quiz results — your answers and resulting score/category if you take the in-app chronotype assessment.
- Lesson progress — which educational lesson screens you've viewed or completed.
- Communications — any messages you send us, e.g. for support requests or feedback.
Information collected automatically through the app's features
- Sleep and heart-rate data — with your permission, the App reads sleep session data (bed/wake times, sleep duration) and heart-health data (resting heart rate, heart rate variability) from Apple Health (HealthKit) on iOS or Health Connect on Android. We use this data solely to power your in-app sleep insights, streaks, and baseline comparisons — never for advertising or marketing.
- Subscription and purchase data — if you subscribe to a premium plan, the purchase is processed by Apple's App Store or Google Play. We (via our subscription-management provider, RevenueCat) receive your subscription status and entitlements, but we never see or store your payment card details.
- Onboarding analytics, crash reports, and survey responses — we use PostHog, a product analytics provider, to understand how people move through onboarding (e.g., which steps are viewed, completed, or abandoned, and whether an account is created or a subscription started), to automatically catch app crashes and errors anywhere in the app so we can fix them, and to run optional in-app surveys if we ask for your feedback. These events are tied to an anonymous, randomly generated ID — never to your name or email address — and PostHog does not automatically track your general screen-by-screen usage of the app or app-open/close activity.
Information we do not collect
- We do not use any advertising or ad-tracking SDKs, so we do not collect device advertising identifiers or build browsing/app-usage profiles for ad targeting. Our analytics use (described above) is limited to onboarding, crash reporting, and surveys, does not use cookies, and is not used for advertising.
- Our night-time app blocker (built on Apple's Screen Time / Family Controls framework on iOS, and an equivalent mechanism on Android) lets you choose apps to block during your night routine. On iOS, Apple's framework keeps your app selection private even from us — the App only ever receives an opaque authorization to enforce the block, never the identity of the apps you picked. This information is not transmitted to us or stored on our servers.
- We do not request access to your camera, photos, contacts, or location.
How We Use Personal Information
We use the personal information described above to:
- Create and maintain your account, and authenticate you when you log in.
- Operate the App's core features: generate your sleep summaries, heart-rate baselines, sleep score, streaks, and routine tracking.
- Sync your data across your devices and preserve it if you reinstall the app or get a new device.
- Process and manage your subscription.
- Schedule the local reminder notifications you enable (these are generated and delivered entirely on your device — we do not operate a push-notification server and do not see when or whether you receive them).
- Respond to your support requests and feedback.
- Maintain the security of the App and prevent misuse of our systems.
- Comply with legal obligations.
- Understand and improve the onboarding experience, catch and fix crashes, and collect your answers to optional in-app surveys, using the anonymized analytics described above.
We do not use your health data (sleep, heart rate) for advertising, marketing, or any purpose other than providing the App's features to you. Data obtained from Apple Health (HealthKit) or Health Connect is never sold, never used for advertising or data-broker purposes, and never disclosed to third parties other than Supabase, which stores it on our behalf as a service provider so that it can be synced to your account.
How We Share Personal Information
We do not sell your personal information, and we do not share it with advertisers or data brokers. We share personal information only with:
- Service providers who help us operate the App:
- Supabase — our backend provider, which hosts your account, profile, sleep, routine, and other in-app data described above, and handles authentication.
- RevenueCat — our subscription-management provider, which processes subscription status and entitlements on our behalf.
- PostHog — our product analytics provider, which receives onboarding interaction events, app crash/error reports, and optional survey responses, tied to an anonymous ID rather than your name or email.
- Apple (App Store) / Google (Play Store) — process in-app purchases and, where applicable, deliver Live Activity or notification-based routine updates on-device.
- Legal and safety reasons — if required to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Rizeora, our users, or others.
- Business transfers — if Rizeora is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you if this happens and your data becomes subject to a different privacy policy.
All service providers above are contractually permitted to use your information only to provide services to us, not for their own independent purposes.
Data Storage and Retention
Your data is stored both locally on your device (for offline access and app performance) and, once you create an account, synced to our Supabase-hosted database so it's available across devices. We retain your personal information for as long as your account is active. If you delete your account, we permanently delete your account and the associated personal data stored on our servers (including synced sleep, heart-rate, routine, diary, and mood data) promptly and in any event within 30 days, except where we're required to retain limited records for legal, security, or fraud-prevention purposes. Onboarding analytics, crash reports, and survey responses sent to PostHog are retained under PostHog's standard retention period and are tied only to the anonymous ID described above, not your account directly.
Your Choices
- Access, correct, or delete your data. You can update your profile information directly in the App. You can delete your account and all associated data at any time directly in the App, from Settings → Delete Account. To request a copy of your data, email privacy@rizeora.app.
- Revoke health data access. You can turn off Rizeora's access to Apple Health or Health Connect at any time from your device's system settings (Settings → Privacy → Health on iOS, or the Health Connect app on Android). Turning this off will limit sleep- and heart-rate-based features.
- Manage notifications. You can disable reminder notifications in the App's settings or your device's system settings at any time.
- Manage the app blocker. You can change or remove blocked apps, or disable the feature entirely, from within the App at any time.
- Manage your subscription. Subscriptions are managed through your Apple ID or Google Play account settings.
Data Security
We rely on Supabase's infrastructure, which encrypts data in transit and at rest, and we use industry-standard authentication practices to protect your account. No method of transmission or storage is 100% secure, so we can't guarantee absolute security, but we take reasonable measures to protect your information.
International Users and Data Transfers
Our service providers (Supabase, RevenueCat, PostHog) may process and store data in the United States or other countries outside of your own. Where required by law (for example, for users in the EEA, UK, or Switzerland), we and our service providers rely on appropriate safeguards, such as standard contractual clauses, to protect data transferred internationally.
Children's Privacy
Rizeora is not intended for use by children under 16. We do not knowingly collect personal information from children under 16. If we learn that we've collected personal information from a child under 16 without appropriate consent, we will delete it. If you believe a child has provided us with personal information, please contact us at privacy@rizeora.app.
Notice to European (EEA/UK/Switzerland) Users — GDPR
If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following applies to you under the General Data Protection Regulation ("GDPR") and equivalent UK/Swiss laws.
Controller. Rizeora is the controller responsible for your personal data described in this Policy. You can reach us at privacy@rizeora.app.
Legal bases for processing.
| Data | Purpose | Legal basis |
|---|---|---|
| Account data (email, password) | Create and secure your account | Performance of a contract |
| Onboarding/profile data | Personalize the app, generate insights | Performance of a contract |
| Sleep and heart-rate data | Generate sleep summaries, baselines, and scores | Performance of a contract |
| Routine, mood, and diary entries | Provide the routine-tracking and journaling features | Performance of a contract |
| Subscription data | Process and manage your subscription | Performance of a contract |
| Support communications | Respond to your requests | Legitimate interest (providing support) |
| Security logs | Detect and prevent misuse | Legitimate interest (security) |
| Onboarding, crash/error, and survey data (tied to an anonymous ID) | Improve onboarding, fix bugs, collect feedback | Legitimate interest (product improvement) |
Your rights. You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data ("right to be forgotten").
- Restrict or object to certain processing.
- Port your data to another service in a structured, machine-readable format.
- Withdraw consent at any time where processing is based on consent (e.g., health data permissions).
- Lodge a complaint with your local data protection authority.
You can delete your account at any time in the App (Settings → Delete Account). To exercise any of the other rights, email privacy@rizeora.app. We will respond within the timeframes required by law.
Notice to California Residents — CCPA
If you are a California resident, the California Consumer Privacy Act ("CCPA") gives you the right to:
- Know what personal information we collect, use, and share, as described in this Policy.
- Access a copy of the personal information we hold about you.
- Delete your personal information.
- Non-discrimination — we will not discriminate against you for exercising these rights.
We do not sell or share personal information for cross-context behavioral advertising, so there is no "opt-out of sale/sharing" mechanism required. Our use of PostHog for onboarding analytics, crash reporting, and surveys is limited to anonymized product-improvement data and does not constitute a "sale" or "share" under the CCPA.
To submit a request, email privacy@rizeora.app. We may need to verify your identity (e.g., by confirming the email associated with your account) before fulfilling your request.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where required by law, notify you through the App. Continued use of the App after changes take effect means you accept the revised Policy.
Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact us at:
privacy@rizeora.app