Privacy Policy

Effective 1 October 2026

The short version: the Drowsly app’s data stays on your device, and we never collect or see it. There is no account, no analytics, no advertising and no tracking. Drowsiness detection runs on your device, and your settings and night history are stored there. Your phone’s own backup (iCloud on iPhone, your Google Account on Android) may include them, and they can move with your data when you transfer it to a new phone. That copy sits in your Apple or Google account; we never receive it. The personal data we do handle is limited: messages you send to our support address, any purchase records Apple or Google share with us, and the technical data our web host, Cloudflare, records when you visit this site.

1. Who we are

Drowsly is a mobile app for iPhone and Android that notices, from motion, when you may be drifting off while holding your phone, and gently nudges you to rest. This policy covers both the Drowsly app and this website.

The data controller responsible for the limited personal data described below is:

Questions about this policy, or about exercising any of the rights in section 7, are welcome at that address. We have not appointed a Data Protection Officer, as we are not required to.

2. The app: your data stays on your device

Drowsly works without an account and without a server of ours. The app processes the data below on your device only to provide the service you chose to use (GDPR Art. 6(1)(b), performance of a contract). Specifically:

• Raw motion readings are never stored. The sensor readings used to detect drowsiness are processed in memory, on your device, in real time. Only the few summary values described under the diagnostic log below are written down, and the app never uploads or shares any of them.
• Your settings and night history are stored on your device. This covers your preferences (such as your active hours and alert choices) and the night history behind the morning recap. They stay in the app’s private storage until you delete the app; there is no automatic time limit and no separate delete button. Deleting the app (or, on Android, clearing its storage in Settings) removes them from your phone; a copy may remain in your phone’s backup, as described next.
• Your phone’s own backup may include them. If backup is turned on, your iPhone includes this app data in its iCloud backup, and your Android phone includes it in its backup to your Google Account. It can also move to a new phone when you transfer your data. That copy is stored under your Apple or Google account and governed by Apple’s or Google’s terms; we never receive it. A backup copy may remain after you delete the app; Apple and Google provide the controls for managing and deleting backups.
• A short diagnostic log. To help work out why a night did not go as expected, the app keeps a small log file for each day on your device. It records the app’s own activity during your active hours (such as when monitoring starts and stops, and whether the motion readings arrived on time) and, at each alert decision, a few summary measurements: how the phone was tilted and moving, whether it seemed to be in use and, on Android, whether the screen was on or locked. Each entry is stamped with its time. The app keeps the last seven days and deletes older files. The log is excluded from backup, and the app never sends it to us.
• No analytics, advertising or tracking SDKs. The app contains no analytics or tracking code of any kind and makes no network calls to us — we have no servers for it to call. Its only network use is your platform’s own purchase system (the App Store on iPhone, Google Play Billing on Android), which talks to Apple or Google, not to us. Links in the app to this policy or our terms open in your browser; that visit is handled like any other visit to this site (section 5).

3. Permissions the app asks for

Motion sensing needs no permission on iPhone or Android, so the app never asks for one. You can change any of the permissions below at any time in your device’s Settings.

On iPhone

• Notifications (optional). Used to deliver the reminders, nudges and alerts you set up.

On Android: permissions you are asked to grant

• Notifications (Android 13 and later). Used for nudges, alerts, the morning recap, and the notification shown while Drowsly is running.
• Full-screen notifications (Android 14 and later; granted automatically on earlier versions). Used to show a wake call over the lock screen. Without it, the wake call may appear as a regular notification instead.
• Display over other apps. Used to show a wake call on top of the app you are using. Without it, the wake call may use the full-screen notification instead.
• Alarms & reminders (Android 14 and later; granted automatically on earlier versions). Used to start Drowsly on time when your active hours begin. Without it, the start may be delayed.
• Unrestricted battery use (an exemption from battery optimisation). Requested to reduce the chance that Android pauses Drowsly during the night.

On Android: permissions granted at install

Android also grants these when you install the app, without a separate prompt: vibration; running in the foreground, with an ongoing notification, during your active hours; keeping the phone’s processor awake during an active night; starting again after the phone restarts, so the night is set up again; and network access and billing, which Google Play Billing uses for purchases.

4. Purchases

Drowsly’s subscription (including the free trial) and the one-time Founder Lifetime purchase are offered and billed through your platform’s app store — Apple’s App Store on iPhone, Google Play on Android. Apple and Google handle the checkout under their own privacy policies (Apple’s or Google’s). We never see or store your payment details, such as your card or bank details, and entitlement checks happen on your device. Buying is voluntary, but Drowsly’s detection needs an active subscription, free trial or Founder Lifetime purchase.

Apple and Google send us sales and financial reports. If they share details of an individual purchase with us, for example for a refund, tax or accounting, we use them only to provide and support your purchase (legal basis: performance of a contract, GDPR Art. 6(1)(b)) and to keep the accounting records Swedish law requires (legal obligation, Art. 6(1)(c)). We keep accounting records for as long as Swedish accounting law requires, currently seven years.

5. This website and support

This site is static. It sets no cookies, runs no analytics and embeds no third-party trackers.

Visiting this site. This site is hosted by Cloudflare, Inc., based in the United States. Like any web host, its servers record standard technical data when you visit, such as your IP address, browser type, the page requested and the time. Cloudflare processes this data on our behalf to deliver the site and keep it secure. The visit records we can see in our Cloudflare account are kept for 7 days. Cloudflare also uses some of the data for its own purposes, such as protecting its network. For that use Cloudflare, not we, is responsible, under its own privacy policy (cloudflare.com/privacypolicy), which says it keeps such data as long as its business purposes or legal duties require. Our legal basis is our legitimate interest in running a working, secure website (Art. 6(1)(f)).

Emailing us. If you write to support@drowsly.com, we use your address and message to answer you, and keep the conversation only as long as we need it to help you. Our legal basis is our legitimate interest in answering you (Art. 6(1)(f)). Writing to us is voluntary; we need your address only to reply. Messages to our support address are received by Cloudflare, Inc. (Cloudflare Email Routing), which forwards them to our email provider. Our email provider stores the messages on its servers in Sweden, inside the EU/EEA, and also sends our replies. Both handle these messages on our behalf. The record of each forwarded message we can see in our Cloudflare account (sender, recipient, subject and time) is kept for 31 days.

Transfers to Cloudflare. Because Cloudflare is in the United States, your visit data and support messages may be transferred outside the EU/EEA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide adequate protection (Art. 45). For the data it handles for us, its data processing addendum relies on that framework and uses the EU Standard Contractual Clauses if the framework stops applying (cloudflare.com/cloudflare-customer-dpa). Its privacy policy says the same for the data it uses for its own purposes. Our email provider stores support messages in Sweden, so storing them involves no transfer outside the EU/EEA.

6. Who receives personal data

We do not sell personal data, and we share it only with the service providers described above, each for its stated purpose:

• Cloudflare, Inc. (United States) — hosting this website (technical data from visits) and forwarding messages to our support address.
• Our email provider (servers in Sweden) — storing messages to our support address and sending our replies.
• Apple and Google — purchases, as independent controllers under their own privacy policies.

7. Your rights

Under the EU General Data Protection Regulation you have the right to access your personal data, to correct or delete it, to restrict its processing, and to receive it in a portable format where the GDPR’s conditions for portability are met. You may object to processing based on our legitimate interests. We make no decisions about you by automated means that have legal or similarly significant effects.

We do not hold your night history, settings or diagnostic files, so for the app these rights are in your hands: deleting the app removes its data from your phone, and Apple and Google provide the controls for any copy in your iCloud or Google Account backup. For anything we do hold — a support conversation, purchase records — a single message to support@drowsly.com is enough. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or your local supervisory authority.

8. Children

Drowsly is not directed at children, and we do not knowingly receive personal data from children.

9. Changes to this policy

If we ever change how Drowsly handles data — for example, if a future feature requires something this policy doesn’t cover — we will update this page and change the effective date above before the change takes effect. The promise at the top is the bar any change is measured against.