Sonopeace Legal & Privacy Provisions

1. Data Retention & Deletion

We keep your data only for as long as we need it for the purpose it was collected:

Account data (email, name): kept until you delete your account.
Sleep, diary, and AI insight data: kept until you delete your account.
Wearable connection tokens: kept until you disconnect the device or delete your account.
Product analytics (only if you enable it): kept until you turn analytics off or delete your account.
Error, crash, and sync logs: kept for 30 days.
Security and consent audit records: retained, with personal identifiers removed, to meet our legal record-keeping obligations.

Account Deletion

When you delete your account, your sleep, heart-rate, diary, AI insight, and other health-related records are erased from our database, and your sign-in account is removed. Your profile email and name are obfuscated.

A limited set of security and consent audit records is retained for legal compliance, but with your identifiers stripped so the records can no longer be linked to you.

Account history cannot be recovered after deletion.

2. Privacy Policy

Information We Collect

Personal Data: Email address, name, encrypted password.
Health Data: Sleep duration, stages, heart rate, HRV, respiratory rate, SpO2, workouts, and caffeine records from connected wearables or Apple Health when granted.
Device Data: Device model, OS version, notification tokens.

How We Use Your Data

To provide sleep tracking, summaries, trends, reminders, and account features.
To generate personalized AI sleep insights and coaching — only when you opt in (provider: OpenAI; not used for model training or advertising).
To collect anonymous product analytics — only when you opt in (no health data is included).

3. Cookie Policy

We use essential cookies and similar technologies for:

Authentication: To keep you logged in.
Security: To prevent fraud and abuse.
Preferences: To remember your settings.

4. Research & Third-Party Data Sharing

Current status: research package generation is disabled. Google Health data is used only for Sonopeace consumer features and is not sold, licensed, used for advertising, or used for research.

Existing research and data-sharing consent records are historical preferences only. They do not enroll you in a study or authorize study sharing or export.

HealthKit and Health Connect are not currently exported for research or commercial licensing. Oura requires written approval. Any future study requires source-aware provenance, study-specific informed consent, and compliance with provider/platform restrictions; unknown or bridged origin fails closed. Anonymization does not remove those restrictions.