LEGAL

Drifty Privacy Policy

Effective date: August 29, 2026  ·  Last updated: August 29, 2026  ·  Version 1.0

Drifty, Inc. ("Drifty," "we," "us," or "our") makes the Drifty iOS and watchOS application, including the Drifty Wake and Drifty Night features (together, the "App"), and the website at driftysleep.com (the "Site").

This policy explains what information the App and Site collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to everyone who uses Drifty.

Drifty is a general wellness product. It is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease or condition.

The short version

• Your sleep data stays on your device. Sensor analysis for Drifty Wake and Drifty Night runs entirely on your iPhone and Apple Watch.
• We never record or store your audio. Sound is analyzed in real time in memory and discarded immediately. Raw audio is never written to storage and never leaves your device.
• We do not sell your data. We do not sell or share personal information, and we do not use health data for advertising or marketing.
• We do not use Health data for anything except the App's features. Data from Apple Health is used only to power Drifty Wake and Drifty Night.
• You can delete everything. Delete your account and all associated data from inside the App at any time.

The full detail follows.

1. Information we collect

1.1 Health and sensor data (processed on your device)

With your explicit permission, the App reads the following from Apple Health (HealthKit) and from your device's sensors:

How audio is handled. When Drifty Night is active, audio is analyzed in real time by a machine-learning model that runs entirely on your device. Audio is held only in temporary memory for the moment it takes to classify it, then discarded. We do not record, save, buffer to disk, upload, or transmit audio. What is kept is a structured event record: a timestamp, a classification label, and a confidence value. There is no audio to recover, review, or hand over.

How health data is handled. Physiological samples remain in Apple Health under Apple's retention controls. Drifty stores only derived values on your device: your personal baselines, event logs, intervention outcomes, and nightly summaries.

1.2 Information you give us

• Account information (optional): your email address and display name, if you choose to create an account.
• Settings and preferences: alarm times, wake sequence configuration, haptic intensity, notification preferences.
• Support correspondence: the contents of any message you send us, and the email address you send it from.
• Research participation (optional): if you separately enroll in a clinical study or research pilot, information you provide under that study's own consent form. See Section 9.

1.3 Information collected automatically

• Device and app diagnostics: device model, operating system version, App version, and crash and performance diagnostics.
• Subscription status: whether your subscription is active, its tier, and its renewal state.

1.4 Purchases

Subscriptions are sold through Apple's In-App Purchase system. Apple processes your payment. We never see or receive your payment card number, billing address, or Apple Account credentials. We receive only an anonymous transaction identifier and subscription status from Apple so we can unlock paid features. Apple's handling of that transaction is governed by Apple's privacy policy.

1.5 The Site

driftysleep.com is a static marketing site. It does not run advertising or analytics trackers and does not set advertising cookies. Standard server logs may be kept by our hosting provider for security and reliability. Web fonts are loaded from Google Fonts, which receives your IP address as part of that request. If you submit a form on the Site, we collect the information you enter: the contact form sends your name, email address, role, and message to us by email, and the newsletter signup sends your email address to our email service provider so we can send you updates. You can unsubscribe from any email we send.

2. How we use information

We use the information above only to:

1. Operate Drifty Wake, timing your wake sequence and verifying sustained motion and elevated heart rate before an alarm can be dismissed.
2. Operate Drifty Night, detecting breathing disturbance events and delivering the escalating haptic response.
3. Build and maintain your personal baselines, so scoring is relative to you rather than to a population average.
4. Show you your own nightly summaries, trends, and history.
5. Manage your subscription and account.
6. Diagnose crashes, fix defects, and improve reliability and battery performance.
7. Respond to your support requests.
8. Meet legal obligations and enforce our Terms of Service.

We do not use your information to build advertising profiles, to serve you ads, to train models for third parties, or for any use-based data mining unrelated to the App's wellness features.

3. Apple Health (HealthKit) commitments

Because the App reads from HealthKit, we make these commitments explicitly:

• We request access to specific HealthKit data types only, and only after you grant permission on the HealthKit authorization screen. You can grant or deny each type individually.
• We do not use HealthKit data for advertising, marketing, or any use-based data mining other than delivering the App's health and fitness features to you.
• We do not disclose HealthKit data to third parties for advertising, for sale, or for any purpose other than improving your health, fitness, or wellness experience within the App, and never without your separate, explicit consent.
• We do not store HealthKit data in iCloud or in any other third-party cloud service.
• We do not sell HealthKit data, and we will not share it with data brokers.
• We do not write false or synthetic data into Apple Health.

Revoking Health access. You can withdraw HealthKit permissions at any time in Settings → Health → Data Access & Devices → Drifty. Doing so stops all further reading. Features that rely on those signals will degrade or stop working, and the App will tell you which ones. Data already derived and stored on your device stays there until you delete it (see Section 6).

4. What leaves your device

By design, the App's core analysis is local. The following is the complete list of what may be transmitted off your device:

Optional encrypted backup. If you turn on backup, your event logs and baselines are encrypted before they leave your device and stored so you can restore them to a new device. Backup is off by default. You can turn it off and delete the backup at any time.

Machine-learning models used by the App are trained offline by us on de-identified and licensed datasets and then shipped inside the App. Your data is not used to train our models unless you separately and explicitly opt in.

5. Sharing and disclosure

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We disclose information only in these situations:

Service providers. We use a small number of vendors to operate the business, such as website hosting, our email newsletter provider, contact form delivery, and crash reporting. They may process personal information only on our documented instructions, only to perform the service, and they are contractually prohibited from using it for their own purposes. We require each of them to provide protections for your data at least equivalent to the protections in this policy. None of them receive HealthKit data.

Legal requirements. We may disclose information if required by law, regulation, subpoena, court order, or valid governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of Drifty, our users, or the public. Where we are legally permitted to do so, we will notify you first.

Business transfers. If Drifty is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. Any acquirer will remain bound by this policy with respect to information collected before the transfer, and we will give you notice and a meaningful opportunity to delete your data before any change in how it is handled.

With your consent. We will share information in any other circumstance only with your specific, informed, opt-in consent, given separately at the time.

6. Retention and deletion

On-device data. Event logs, baselines, and summaries stay on your device until you delete them or delete the App. Deleting the App from your iPhone removes the App's local data store.

Account data. If you have an account, we retain account information for as long as your account is active.

Deleting your account. You can permanently delete your account and all associated data from inside the App: Settings → Account → Delete Account. No email, phone call, or support ticket is required. When you delete your account:

• Your account record and any optional encrypted backup are permanently deleted from our systems within 30 days.
• On-device data is erased immediately.
• Data in Apple Health is not affected. It belongs to you and remains under your control in the Health app.
• We may retain a minimal record of the deletion itself, and any data we are legally required to keep (for example, transaction records for tax purposes), for as long as the law requires.

Diagnostics. Crash and performance diagnostics are retained for 90 days and then deleted.

Support messages. Retained for 24 months so we can maintain continuity on ongoing issues.

Canceling a subscription is separate from deleting your account. Manage subscriptions in Settings → [your name] → Subscriptions on your device.

7. Your choices and permissions

The App asks for the following permissions. Each is optional, each is explained at the moment we ask, and each can be changed later in iOS Settings.

You can change any of these in Settings → Drifty on your iPhone, or for Health specifically in Settings → Health → Data Access & Devices.

8. Security

We protect your information with:

• Local-first architecture. The most sensitive data never leaves your device, which removes the largest category of risk.
• Encryption in transit. All network communication uses TLS 1.2 or higher.
• Encryption at rest. On-device data is protected by iOS file-level encryption tied to your device passcode. Any optional backup is encrypted before transmission.
• Access controls. Access to production systems is limited to personnel who need it, and is logged.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any required regulator without undue delay and in accordance with applicable law.

9. Research and clinical pilots

Drifty may run clinical or research pilots with partner institutions. Participation is always separate, always voluntary, and always requires its own written informed consent. Nothing in this policy authorizes the use of your data for research. If you enroll in a study, that study's consent form and protocol, not this policy, governs how your data is used, and you may withdraw at any time under the terms of that consent.

Data from users who have not enrolled in a study is never included in research datasets.

10. Your privacy rights

10.1 If you are in the United States

Depending on your state, you may have the right to know what personal information we collect and how we use it, to access a copy of it, to correct it, to delete it, and to not be discriminated against for exercising these rights.

We do not sell personal information, and we have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months. We do not process personal information for targeted advertising or profiling with legal effects.

The health and sensor data described in Section 1.1 may constitute sensitive personal information under state law. We use it only to provide the App's features, one of the purposes for which no right to limit use applies, and never for inferring characteristics about you for any other purpose.

We honor Global Privacy Control signals on driftysleep.com.

To exercise your rights, use in-app deletion (Section 6) or contact us at hello@drifty.io. We will verify your request through the email associated with your account and respond within 45 days, or tell you why we need more time. You may use an authorized agent; we will ask for proof of authorization.

10.2 If you are in the European Economic Area or the United Kingdom

Drifty, Inc. is the controller of your personal data.

Legal bases. We rely on your explicit consent (Article 9(2)(a) GDPR) to process health data, since it is a special category of personal data. We rely on contract to provide the App and manage your subscription, on legitimate interests to secure our systems and fix defects, and on legal obligation where the law requires.

Your rights. You have the right to access, rectify, erase, restrict processing, object to processing, and to data portability. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. Revoke Health or microphone permission in iOS Settings, or delete your account.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

You have the right to lodge a complaint with your local supervisory authority.

10.3 International transfers

Drifty is based in the United States and our systems are located in the United States. If you use the App from outside the United States, the limited information described in Section 4 will be transferred to the United States. Where required, we use the European Commission's Standard Contractual Clauses and the UK Addendum as our transfer mechanism. You can request a copy at hello@drifty.io.

11. Children

Drifty is intended for adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18, and the App is not directed to children. If you believe a child has provided us with personal information, contact hello@drifty.io and we will delete it promptly.

12. Changes to this policy

We will update this policy when our practices change. If we make a material change, particularly one that expands how we use health data, we will notify you in the App before the change takes effect and, where the law requires it, ask for your renewed consent. The effective date at the top of this policy always reflects the current version. Previous versions are available on request at hello@drifty.io.

13. Contact us

Drifty, Inc.
Privacy questions: hello@drifty.io
General support: hello@drifty.io

We aim to respond to every privacy request within 5 business days and to resolve it within 45 days.

Drifty is a general wellness product. It does not diagnose, treat, cure, or prevent any disease or condition, and it is not a substitute for professional medical advice. If you have concerns about your sleep or breathing, talk to a qualified healthcare provider.