Privacy Policy — Blisstening

Version: 1.0
Effective Date: May 26, 2026
Entity: Blisstening LLC

Blisstening LLC ("we," "us," or "our") operates the Blisstening mobile application (the "App"). This policy describes what information we collect when you use the App, how we use it, and what rights you have over it.

We keep it short because our data footprint is small. We built Blisstening to deliver sound sessions — not to build a data profile about you.

1. What We Collect

Account Information

To use Blisstening, you sign in with an email address and password. We store:

Your email address
A hashed password (Supabase Auth manages hashing; we never store plaintext passwords)
A unique user ID generated at account creation

We do not collect your name, phone number, billing address, or any other personal details at sign-in.

During the TestFlight beta phase, accounts are provisioned manually for invited testers; there is no in-app self-registration. The public release will introduce a standard self-registration flow.

Session Event Data

When you interact with audio sessions in the App, we log events to your account record in our database. Logged events include:

Which session or program you started, completed, or stopped
The event type (started, completed, stopped, error, stage transition — see note below)
A timestamp generated at the time of the event
Optional program ID when you are running a multi-stage program

Some events also carry a small amount of structured context — for example, an error code if playback fails, or a stage index during a multi-stage sleep program. This context is operational metadata, not personal information, and is used for troubleshooting.

During development builds, the App may also emit debug events with diagnostic breadcrumbs (timing measurements and code-path tags). These events do not contain personal information and are not generated on production or TestFlight builds.

This data is tied to your user ID. It is used to understand how sessions are being used and to support troubleshooting. We do not use it to build behavioral profiles for advertising.

Application Diagnostic Logs

The App writes structured diagnostic logs (warn- and error-level events) to an app_logs table in our database. These logs include:

Log level (warn or error)
A message describing what happened
Contextual data about the event (app version, app variant, subsystem tag)
Your user ID (if a session is active at the time)

Before any log is written, a redactor strips tokens (Supabase signed-URL tokens, JWTs, Bearer tokens) and email addresses from message content and context fields. This is enforced in code at lib/remoteLog.ts; it is not optional.

These logs are used exclusively for diagnosing app errors and stability issues. They are not used for analytics, advertising, or behavioral tracking.

Local Device Storage

The App stores a small amount of data on your device using the operating system's local storage facility (AsyncStorage). This includes your authentication session token (so you stay signed in across app launches), your audio quality preference, and — if you start a multi-stage sleep program — the program's runtime state (current stage and timing) so the App can resume the program correctly after a restart. This data is not transmitted to any third party; it lives only on your device and is removed when you sign out or uninstall the App.

Device and Technical Information

When you use the App, Supabase (our backend provider) and Expo (our build and update platform) may collect standard technical data in connection with service delivery, including IP address and device type. On each launch, the App may check Expo's update service for a newer JavaScript bundle ("over-the-air update"); this check transmits standard request metadata to Expo but does not transmit your account information or session events. See Section 5 (Third-Party Processors) for how each party handles this.

We do not independently collect device identifiers, IDFA (advertising identifier), or precise location.

2. What We Do Not Do

This is worth stating plainly:

We do not sell your personal information. To anyone. Ever.
We do not share your information with advertising networks.
We do not run third-party analytics SDKs (no Mixpanel, Amplitude, Segment, Firebase Analytics, Google Analytics, Crashlytics, or equivalent). The app's dependency tree has been verified to contain none of these.
We do not collect payment information. Blisstening has no in-app purchases. No payment data passes through the App or our systems.
We do not collect health or biometric data. The App does not integrate with Apple HealthKit, Google Health Connect, or any health data API.
We do not use cookies. This is a native mobile app; there is no web-browser cookie layer.
We do not use push notifications. The App does not register for, request, or send remote push notifications. Android builds declare a POST_NOTIFICATIONS manifest entry that supports lock-screen and Now Playing media controls during audio playback; this is a transport feature, not a remote-push capability.
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
We do not make the App available to children. See Section 7.

3. How We Use Your Information

We use the information described in Section 1 for these purposes:

Providing the App. Your account information is required to authenticate you and deliver your session library.
Improving reliability. Session event data and diagnostic logs help us identify what's working and what isn't across different devices and usage patterns.
Security. Account data and logs help us detect and investigate unauthorized access or abuse.

We do not use your information for advertising, profiling, or selling to third parties.

Legal basis (GDPR). For users in the European Economic Area, UK, or Switzerland, we process your personal data on the following bases: performance of a contract (providing the App you signed up for), and our legitimate interests in operating a reliable and secure service. Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms given the limited and non-commercial nature of the data we process.

4. Who We Share Your Information With

We do not sell or rent personal information. We share it only in these narrow circumstances:

Service providers acting on our behalf. We use a small number of processors to run the App (see Section 5). These parties may receive your data only to perform services for us, under contractual obligations not to use it for their own purposes.

Legal requirements. We may disclose information if required by law, court order, or government process, or to protect the rights, property, or safety of Blisstening LLC, our users, or others.

Business transfer. If Blisstening LLC or the Blisstening business is acquired, merged, or transferred to a new legal entity, your information may be transferred as part of that transaction. We will notify you in advance of any material change to this policy that results from such a transition.

5. Third-Party Processors

The following companies process personal data as part of delivering the App. Each operates under its own privacy policy, which governs their handling of your data.

Processor	Role	Privacy Policy
Supabase, Inc.	Database, authentication, and storage backend. Hosts the `session_events` and `app_logs` tables. Manages password hashing and JWT-based session tokens. Data is stored on infrastructure operated by Supabase.	supabase.com/privacy
Expo / EAS (Expo Application Services)	Build pipeline and over-the-air update delivery. May collect device identifiers and IP addresses in connection with update checks.	expo.dev/privacy
Apple, Inc.	TestFlight distribution (during beta); App Store distribution (at public release). Apple's own data practices govern the TestFlight and App Store platforms.	apple.com/legal/privacy

Our Supabase project is hosted in the United States (Amazon Web Services US East region). For users in the European Economic Area, this involves transfer of personal data outside the EU. We rely on the standard contractual clauses incorporated in Supabase's data processing terms as the lawful transfer mechanism.

We do not use any advertising, analytics, crash-reporting, or data-broker processors.

6. Data Retention

Account data. We retain your account information for as long as your account is active. If you request account deletion (see Section 9), we will delete your email address, user record, and associated session event data within 30 days of receiving your request.

Diagnostic logs. app_logs entries are retained for operational triage purposes and reviewed periodically. We do not retain logs longer than necessary to diagnose and improve App stability.

Local device data. Data stored in local device storage (see Section 1) is removed when you sign out or uninstall the App.

What happens when you stop using the App. If your account is inactive, we do not proactively delete your data. If you want your data removed, contact us (Section 10).

7. Children

The App is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, please contact us at info@blisstening.com and we will promptly delete the account and associated data.

For users in the European Economic Area, the minimum age threshold is 16, or the lower age established by the applicable member state's national law.

8. App Store Distribution

The Blisstening App is currently distributed via The Balance King's Apple Developer Program account, which holds the App Store Connect listing. This is a transitional arrangement; the data-handling practices described in this policy are operated by Blisstening LLC and do not change based on which entity holds the App Store listing seat. If the App Store Connect listing transitions to a Blisstening LLC account in the future, we will note that change in a policy update, but it will not affect how your data is handled.

9. Your Rights

For all users:

Access. You can request a copy of the personal data we hold about you.
Correction. You can ask us to correct inaccurate information.
Deletion. You can request that we delete your account and personal data.
Portability. You can request your data in a machine-readable format.

Additional rights for California residents (CCPA):

California residents have the right to know what categories of personal information we collect and how we use them, the right to delete personal information, the right to correct inaccurate information, and the right to non-discrimination for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA, so there is no opt-out process required for those activities.

To submit a request, contact us at info@blisstening.com. We will respond within 45 days. We verify identity by confirming the request originates from the email address associated with the account.

Additional rights for EEA, UK, and Swiss residents (GDPR):

In addition to the rights above, you have the right to object to processing, the right to restrict processing, and the right to withdraw consent where we rely on it. You also have the right to lodge a complaint with your local data protection authority. In the European Economic Area, that is the supervisory authority of the member state where you reside or work. In the UK, it is the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, contact us at info@blisstening.com.

10. Contact

Questions, requests, or concerns about this policy can be sent to:

Blisstening LLC
5900 Balcones Dr # 27311, Austin, TX 78731-4257
info@blisstening.com

11. Changes to This Policy

When we update this policy, we will post the revised version at the same URL, update the effective date, and increment the version number. If changes are material — meaning they affect how we collect, use, or share your information in ways that are meaningfully different from what this policy describes — we will provide notice within the App or by email before the changes take effect.