Privacy Policy

This privacy policy explains what personal data we collect when you use the Superchill iOS app and the superchillapp.co website, why we collect it, who we share it with, and the rights you have over it. We follow the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Who is responsible

The data controller (Verantwortlicher in the sense of Art. 4(7) GDPR) is:

Björn Schefzyk
[Postal address — to be added]
Germany
Email: [email protected]

A data protection officer is not appointed because we do not meet the thresholds in § 38 BDSG. You can reach us about any privacy matter at the email above.

2. What we collect, and why

2.1 Information you provide to personalize sessions

When you generate a personalized meditation, the app sends the following information to our backend and to OpenAI to create the script:

• The first name you optionally entered during onboarding
• The focus areas you select (e.g. sleep, shoulders, stress)
• The session duration you choose
• Optional context such as your experience level or goals, if you provide it

Legal basis: performance of a contract under Art. 6(1)(b) GDPR — without this information we cannot generate a personalized session for you. We do not use this information for advertising and we do not enrich it with third-party data.

2.2 Subscription status

If you subscribe, we use RevenueCat, Inc. to manage your subscription state. RevenueCat receives an anonymous app-generated user ID, your subscription product, and the start/expiry of your subscription. Apple, not we, processes the actual payment.

Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

2.3 Analytics and crash reports

We use Google Firebase Analytics and Firebase Crashlytics to understand which features people use and to fix crashes. This is limited to aggregated, app-generated identifiers and event data — we do not collect names, emails or contact info through analytics. IP addresses are processed for anti-abuse purposes and are not stored long-term.

Legal basis: our legitimate interest in keeping the app working and improving it, Art. 6(1)(f) GDPR. You can switch off Firebase analytics from inside the app's Settings screen at any time.

2.4 Apple Health

If you grant permission, the app writes a Mindful Minutes entry to Apple Health each time you finish a session. This data stays on your device — it is never sent to our servers, OpenAI, or any other third party. We do not read any data from Apple Health.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can revoke the permission at any time in iOS Settings → Health → Data Access.

2.5 Audio

The narrator audio is generated by OpenAI text-to-speech from the script we send and is streamed to your device. The microphone is never used — Superchill does not record you.

2.6 Website

The marketing website (superchillapp.co) does not set tracking cookies. The only browser storage we use is a single localStorage entry that remembers the language you selected. Standard server log data (IP address, user agent, requested URL) is processed for a short period to operate the site and prevent abuse, on the basis of Art. 6(1)(f) GDPR.

3. Who we share data with (processors)

We use the following processors. They are bound by data processing agreements that comply with Art. 28 GDPR.

Processor	Purpose	Location / transfer
OpenAI, OpCo, LLC	Generates meditation scripts and text-to-speech audio	USA — EU Standard Contractual Clauses; OpenAI does not use API inputs to train its models.
RevenueCat, Inc.	Subscription management	USA — EU Standard Contractual Clauses.
Google Ireland Limited (Firebase)	Analytics, crash reporting	EU primary; some sub-processing in the USA under Standard Contractual Clauses and the EU–US Data Privacy Framework.
Railway Corp.	Hosts the backend API and this website	USA — EU Standard Contractual Clauses.
Apple Inc.	App Store distribution and payment processing for subscriptions	EU/USA — handled directly under Apple's privacy policy.

We do not sell your data and we do not share it with advertisers.

4. International transfers

Some of our processors are located outside the European Economic Area, primarily in the United States. Where we transfer personal data there, we rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, the EU–US Data Privacy Framework as additional safeguards.

5. How long we keep data

• Session prompts sent to OpenAI: not stored on our servers; OpenAI retains API logs for up to 30 days for abuse-monitoring then deletes them.
• Subscription records: kept while your subscription is active and for tax-record retention thereafter (up to 10 years under § 147 AO).
• Analytics events: retained according to the Firebase default (typically 14 months).
• Server logs: rotated within 30 days.

6. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Have your data erased (Art. 17)
• Restrict processing (Art. 18)
• Receive your data in a portable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, where processing relies on consent (Art. 7(3))

To exercise any of these rights, email [email protected]. We respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for our seat is the data protection authority of the federal state in which the controller is based; you may contact any EU supervisory authority.

7. Children

Superchill is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent change. Material changes will be announced in the app or by email if you have given us one.

9. Contact

Questions about your data: [email protected]