BreathBeats Privacy Policy

This Privacy Policy describes how SHORESIDE LLC, doing business as BreathBeats ("BreathBeats," "we," "us" or "our"), collects, uses, discloses and otherwise processes personal information in connection with the BreathBeats mobile application (the "App"), our website at breathbeats.app (the "Site"), and the related services we provide (together, the "Services"). "Personal information" means information that identifies, relates to or could reasonably be linked with you or your device. It does not include de-identified or aggregated information.

Our Consumer Health Data Privacy Policy describes how we handle consumer health data, as defined by Washington, Nevada and similar state laws, and the rights those laws provide. It supplements this Privacy Policy.

At a glance. This summary is for convenience; the full Policy below controls.

Camera mode works on your device. Camera mode is optional. When it is on, the App analyzes camera frames on your device to follow your breathing. No photos or video are ever recorded, saved, or sent anywhere, and the App does not use the camera to identify you.
We collect what the Services need. This includes account details and session history if you sign in, your subscription status, and, if you allow them, usage analytics tied to a random identifier for your installation rather than to your account.
No selling, no ad tracking. We do not sell personal information, use it for targeted advertising, or let advertising companies track you through the App.
Health-related information has limited uses. We use it to provide the Services, and we ask before using it for anything else.
You have choices. You can use the App without an account or camera mode, turn analytics off, and delete your data in the App.

1. Information We Collect

We collect the categories of personal information described below. What we collect depends on how you use the Services; for example, we collect less if you use the App without an account.

1.1 Information you provide to us.

Account information. If you create an account, we receive your name (if you or your sign-in service share it), your email address (or a private relay address, if your sign-in service offers one and you choose it), and an account identifier and related sign-in tokens from the sign-in service you use, such as Sign in with Apple or Sign in with Google.
Communications. If you contact us, send feedback or respond to a survey, we receive your message, your contact details and any other information you choose to include.
Newsletter and waitlist sign-ups. If you sign up for updates on the Site, we receive your email address and related sign-up information.
Optional information. If we offer a feature that invites you to provide optional information, we receive what you choose to enter.

1.2 Information collected when you use the Services.

Session information. Information about your use of the App's breathing and music features, such as the pattern you choose, when and for how long you use it, and whether you complete a session. If you use the App without an account, your session history is stored on your device. If you sign in, we store your session history on our servers so that it is kept with your account. If you allow analytics, the App also sends us a usage event when each session ends, as Section 5 describes.
Usage and diagnostic information. Information about how you interact with the App, such as the screens and features you use, the actions you take, purchase and subscription events, and errors and performance data, including technical information about how camera mode is performing, such as whether it started. If you allow analytics, the App sends this information to us, and we associate it with a random identifier created for your installation of the App, not with your name, email address or account.
Device and connection information. Information such as your device model, operating system, App version, language and region settings, and the IP address your device uses to connect to our servers.
Purchase information. Information about your subscriptions and purchases, such as the plan, price, transaction identifiers and subscription status, which we receive from the app store and our subscription-management provider. We do not receive your full payment card number.
Site information. When you visit the Site, our hosting, security and newsletter providers receive technical information such as your IP address, browser type and the pages you view. Section 5 describes the Site's use of cookies and similar technologies.

1.3 Information derived on your device. In camera mode, the App derives information about the timing of your breathing on your device. Section 2 explains how this works and what stays on your device.

1.4 Information from third parties. We receive information from the sign-in services you choose to use; from app stores and our subscription-management provider about your purchases; from app stores in the form of aggregated statistics about App downloads and usage; and from service providers that help us operate the Services, such as email delivery status.

1.5 Inferences. We may derive information from the categories above, such as your preferred patterns or music, to personalize the Services.

2. Camera Mode

Camera mode is optional. It starts only after you turn it on, and you can turn it off at any time in the App or withdraw the App's camera permission in your device settings.

How it works. When camera mode is on, the App uses your device's front-facing camera to detect points on your face, such as points around your mouth and eyes, in each frame. It uses how far your mouth opens to estimate when you breathe out, and it uses that estimate during your session to pace the on-screen guide and adjust the music. All of this processing happens on your device, in real time.

What stays on your device. No photos or video are ever recorded, saved, or sent anywhere. The App discards the facial points it detects frame by frame; they are not stored, and they are not sent to us or to anyone else. The App does not use camera information to recognize or identify you, and it does not keep any map or template of your face. The breathing timing that the App derives from the camera is used on your device during your session and is not sent to us. If you allow analytics, the App may send us basic technical information about camera mode, such as whether it started and whether it was able to follow your breathing, so that we can fix problems; this information never includes images, facial points, breath counts or breathing timing.

What we never do. We do not use camera information, or anything derived from it, to identify you, to build a profile of you, or for advertising, marketing or use-based data mining, and we do not sell it.

Changes. If we offer a feature that would send images, video, facial points or breathing timing off your device, we will describe the feature and ask for your consent before anything is sent.

3. How We Use Information

We use personal information for the following purposes:

To provide the Services, including to run sessions, stream music, keep your session history, manage your account and provide customer support.
To personalize the Services, such as by remembering your preferences.
To process purchases and manage subscriptions, including to confirm what you are entitled to, restore purchases, and work with app stores on billing and refunds.
To communicate with you, including to send service-related messages and respond to your requests and, if you have signed up or where the law otherwise permits, to send newsletters and updates, which you can unsubscribe from at any time.
To understand and improve the Services, including to measure how features are used, diagnose problems and develop new features. Where practicable, we use aggregated or de-identified information for these purposes.
To protect the Services and our users, including to secure our systems, prevent fraud and abuse, and enforce our Terms of Service.
To comply with law, including to respond to lawful requests, keep the records the law requires, and establish, exercise or defend legal claims.
With your consent or at your direction, for other purposes we describe when we ask.

Health-related information. Some information we process, such as session information, may be considered health-related information or "consumer health data" under state laws. We use it to provide the Services you request and, with your consent, for other purposes that we describe when we ask, as our Consumer Health Data Privacy Policy explains. We do not use it for advertising. We do not collect precise location information, and we do not use geofences around health care facilities or any other location to identify or track you or to send you notifications or advertising.

De-identified information. We may de-identify or aggregate personal information so that it can no longer reasonably be linked to you or your device, and use that information for any lawful purpose. We will maintain and use de-identified information only in de-identified form, will not attempt to re-identify it (except as the law permits to test our de-identification processes), and will contractually require anyone who receives it from us to do the same.

Research and artificial intelligence. We do not use personal information to train large language models or other generative artificial intelligence models. If we want to use personal information for research, or to develop or train other machine-learning models, we will ask for your separate consent first. Taking part in any research study will be optional and explained before you decide, and any study involving health-related information will be reviewed by an independent ethics review board.

4. How We Disclose Information

We disclose personal information only as follows:

Service providers. We use service providers to help us operate the Services, including providers of cloud hosting and databases; content delivery, networking and security; subscription management and in-app purchase processing; email delivery and support inboxes; and newsletter services. They may use personal information only to provide services to us and for limited purposes the law allows, such as security and fraud prevention, and we require them by contract to protect it at least as well as this Policy does.
App stores and sign-in services. Apple, Google and other platforms receive information in connection with the purchases you make, the sign-in services you use and the distribution of the App, and they handle it under their own privacy policies.
Legal requirements and protection. We may disclose personal information if we believe in good faith that the law or legal process requires it, or that it is necessary to protect the rights, property or safety of our users, the public or BreathBeats, or to enforce our Terms of Service. We disclose health-related information in response to legal process only when the law requires it.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership or sale of assets, personal information may be disclosed in connection with the transaction, including during due diligence under confidentiality obligations, and may be transferred to a successor. We will require any successor to honor this Privacy Policy for information collected under it. If we stop operating the Services without a successor, we will delete personal information, except where the law requires us to keep it.
At your direction. We disclose information when you direct us to, for example when you use a feature to share content from the App.
De-identified and aggregated information, as Section 3 describes.

No sale or targeted advertising. We do not sell personal information, and we do not share or process personal information for targeted advertising or cross-context behavioral advertising, as state privacy laws define those terms. We have not done so in the past 12 months. We do not disclose personal information to third parties for their own direct marketing purposes.

5. Analytics, Cookies and Similar Technologies

In the App. When you first open the App, we ask whether you want to share usage analytics, and the App sends none until you choose. If you agree, the App sends usage information, such as the screens you open, purchase steps, errors, and the pattern, length and completion of each session, to our own servers, tagged with a random identifier created for your installation rather than with your name, email address or account. You can change your choice at any time in the App's settings; if you turn analytics off, we stop collecting analytics from that installation and replace its identifier. The App includes no third-party advertising or analytics software; the third-party software in the App is limited to what we need for purchases and sign-in. We do not track you across apps and websites owned by other companies, and we do not use your device's advertising identifier.

On the Site. The Site uses cookies and similar technologies that it needs to function. Our newsletter provider's sign-up tools, which load on [the Site pages that have a sign-up form], may also use cookies or similar technologies, for example to record how you arrived at a sign-up form, and emails sent through our newsletter provider may use technologies that tell us whether an email was opened or a link was clicked. You can control cookies through your browser settings.

Tracking across websites. Other than our service providers acting on our behalf as this Policy describes, we do not allow third parties to collect personal information about your online activities over time and across different websites or online services when you use the Services. Because we do not track Site visitors across third-party websites to provide targeted advertising, we do not respond differently to Do Not Track signals. [We treat a Global Privacy Control signal as a request to opt out of the sale of personal information and of targeted advertising, where the law requires; we do not engage in either.]

6. How Long We Keep Information

We keep personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, comply with legal obligations, resolve disputes and enforce our agreements, and then we delete or de-identify it. How long depends on the type of information:

Account and session information: while your account is active. When you delete your account, we delete this information within [30 days], except as described below.
Usage and diagnostic information: up to [13 months] after we collect it, after which we delete it or keep it only in aggregated or de-identified form.
Server and security logs: up to [30 days], unless we need them longer to investigate or address a security issue.
Backups: information deleted from our active systems may remain in backups until those backups are overwritten, within [30 days].
Communications: up to [two years] after our last interaction with you.
Purchase and consent records: for as long as the law requires and as needed to resolve disputes. [We keep verification of your consent to an automatically renewing subscription for at least three years, or one year after the subscription ends if that is longer.]
Newsletter information: until you unsubscribe or ask us to delete it, except that we keep a record of your request so that we can honor it.

7. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption of information in transit, encryption of account contact details at rest, and access controls that limit access to personnel who need it. We limit access to health-related information to personnel and processors who need it to provide the Services or for purposes you have consented to, and we require them to keep it confidential. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you and others as applicable law requires.

8. Your Choices and Rights

8.1 Choices available to everyone.

Delete your data. You can delete your account and its associated data in the App's settings. If you use the App without an account, you can delete the data stored on your device in the App's settings. [Either way, the App also asks us to delete the usage analytics sent from that installation, and then replaces its random identifier.] You can also ask us to delete your data by contacting us.
Access and correction. You can ask us for a copy of the personal information we hold about you, or ask us to correct it.
Analytics. You can change your analytics choice at any time in the App's settings.
Camera. Camera mode is optional. You can turn it off at any time, or withdraw the App's camera permission in your device settings.
Emails. You can unsubscribe from newsletters and other marketing emails using the link in each email. We may still send you service-related messages.

8.2 State privacy rights. Depending on where you live, and subject to exceptions in applicable law, you may have the right to:

confirm whether we process your personal information, and access it;
correct inaccurate personal information;
delete personal information;
obtain a copy of your personal information in a portable format;
opt out of the sale of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in these activities);
withdraw consent you have given, including consent to process sensitive data;
obtain a list of the specific third parties to which we have disclosed personal information, where your state provides that right; and
appeal our decision on a request.

We honor requests to access, correct, delete and obtain a copy of personal information from all users in the United States, regardless of where they live.

8.3 How to make a request. Email us at support@breathbeats.app, or use the options in the App's settings described in Section 8.1. You may use an authorized agent; we may ask for proof of the agent's authority and ask you to verify your identity directly with us. We verify requests by matching the information you provide with information we hold, for example by confirming that you control the email address associated with your account. Because analytics information is associated only with a random installation identifier, we may be unable to verify that it relates to you. We will respond within 45 days after we receive your request. Where the law permits, we may extend that period by up to 45 more days, and we will tell you why within the first 45 days. We do not charge for requests unless they are manifestly unfounded or excessive.

8.4 Appeals. If we decline to act on your request, you may appeal by replying to our decision, or by emailing support@breathbeats.app with "Appeal" in the subject line. We will respond in writing within 45 days, explain our decision, and, if we deny your appeal, tell you how to contact your state attorney general.

8.5 Nondiscrimination. We will not discriminate against you for exercising your privacy rights, for example by denying you the Services or charging you a different price.

8.6 Nevada. Nevada residents may submit a request directing us not to sell their covered information by emailing support@breathbeats.app. We do not sell covered information, as Nevada law defines that term.

8.7 California. California's "Shine the Light" law lets California residents request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make those disclosures.

9. Children and Teens

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has given us personal information, please contact us. Users who are at least [13] but under 18 (or under the age of majority where they live) may use the Services only as our Terms of Service permit, with a parent's or guardian's permission. We do not sell the personal information of any user, including users we know to be under 18, or use it for targeted advertising.

10. Users Outside the United States

The Services are intended for users in the United States. We store personal information in [the United States]; our network providers may handle it in transit in other countries. If we make the Services available in other countries, we will provide any additional information that local law requires.

11. Third-Party Services and Links

The Services may link to or integrate with third-party services, such as app stores, sign-in services and websites we link to. This Policy does not apply to those services, which are governed by their own privacy policies.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new "Last updated" date and keep prior versions available on request. If we make a material change, we will notify you in advance in the App, by email or on the Site. We will not use or disclose personal information we collected before a material change in a way that is materially different from what this Policy described when we collected it, unless you consent.

13. Contact Us

If you have questions about this Policy or our privacy practices, contact us at support@breathbeats.app or write to SHORESIDE LLC, doing business as BreathBeats, 221 1st Ave SW, Suite 610, Rochester, MN 55902.