Calm Koala (“Calm Koala,” “we,” “us,” or “our”) provides a sleep and recovery wellness app for iPhone. This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices you have.
If you have questions, contact us at privacy@getcalmkoala.com.
1. Scope
This policy applies to:
- The Calm Koala mobile app
- Our website at getcalmkoala.com, including share landing pages and social media.
It does not cover third-party services you connect through Apple Health (for example, your wearable’s companion app) or Apple’s own services.
2. Information we collect
2.1 Account information
When you create an account, we collect:
- Email address (for sign-in via magic link)
- Account identifiers (internal user ID, authentication ID)
- Profile and preference data you provide, such as display name, timezone, wearable preference, and notification settings
2.2 Health and fitness data
With your permission, Calm Koala reads health and fitness data from Apple HealthKit (and, on supported devices, Health Connect on Android). Depending on your device and permissions, this may include:
- Sleep analysis (duration, stages, timing)
- Heart rate and heart rate variability (HRV)
- Resting heart rate
- Steps and activity/workout summaries
- Related metrics used to compute sleep and recovery insights
Calm Koala uses HealthKit data to provide app features and does not use HealthKit data for advertising or sell it to third parties.
We store processed sleep and health metrics on our servers so you can view history, trends, streaks, and personalized insights across sessions and devices signed into your account.
2.3 Data we generate in the app
We compute and store insights derived from your data, such as:
- Sleep Score, Overnight Calm, Evening Ease, and Recovery scores
- Bedtime and wind-down guidance
- Experiment and practice recommendations
- Streaks, milestones, and mascot progress
2.4 Optional wearable connections
If you connect a supported third-party wearable account (when offered), we may store OAuth tokens needed to sync data on your behalf. v1 primarily uses data already present in Apple Health from your wearable’s companion app.
2.5 Support and export/deletion requests
If you contact us or use in-app data tools, we may process:
- Your email address
- Request metadata (export or deletion status, timestamps)
2.6 Website analytics (share pages only)
When someone visits a Calm Koala share link on our website (for example after tapping a link shared from the app), we may log anonymous events such as page views and App Store button clicks. These logs may include mascot ID, referral parameters, page path, and browser user agent. They are not linked to your in-app account unless you separately sign in to the app.
We do not use third-party advertising trackers in the app.
3. How we use information
We use your information to:
- Create and maintain your account
- Sync and display your sleep and health data
- Generate personalized insights, scores, and recommendations
- Run sleep experiments, streaks, and gamification features
- Send local push notifications you enable (for example, evening guidance or morning sleep score)
- Respond to support, export, and deletion requests
- Maintain security, prevent abuse, and improve reliability
We do not sell your personal information.
4. Legal bases (EEA/UK users)
Where applicable, we process personal data based on:
- Contract — to provide the app you signed up for
- Consent — for HealthKit access and optional notifications
- Legitimate interests — to secure our service and improve features, balanced against your rights
You may withdraw consent for HealthKit or notifications in iOS Settings at any time.
5. How we share information
We share information only as follows:
| Recipient | Purpose |
|---|---|
| Supabase (database & authentication) | Host account data and app data securely |
| Apple | HealthKit (on your device, under your control) |
| Service providers | Infrastructure needed to operate the app, under confidentiality obligations |
We may disclose information if required by law or to protect rights, safety, and security.
We do not share HealthKit data with third parties for advertising or marketing.
6. Data retention
We retain your account and associated data while your account is active.
When you delete your account in the app (see Section 8), we delete your account and associated personal data from our systems, subject to limited backup retention described below.
Anonymous share-page analytics are retained for aggregate reporting and may be kept after account deletion because they are not linked to your account.
7. Security
We use industry-standard measures including encrypted transport (HTTPS/TLS), authenticated access, and row-level security so users can access only their own data. No method of transmission or storage is 100% secure.
8. Account deletion
You can delete your account and associated data in the app:
Settings → Personal Data → Delete my account & data
Deletion is initiated immediately from the app. We remove your authentication account and cascade-delete associated profile, sleep, experiment, and related records from our database.
After deletion:
- You will be signed out
- You should not be able to sign back in with the same credentials and recover the same account data
- Data on your device in Apple Health remains under your control in Apple’s Health app; deleting your Calm Koala account does not delete HealthKit history
If deletion fails, contact privacy@getcalmkoala.com.
9. Data export
You may request a copy of your data in Settings → Personal Data → Export my data. We will email a CSV export to the address on your account. We aim to fulfill export requests within a reasonable period (typically within 30 days).
10. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or port your data, and to object to or restrict certain processing.
- HealthKit: iPhone Settings → Privacy & Security → Health → Calm Koala
- Notifications: iPhone Settings or in-app notification toggles
- Account deletion: in-app as described above
California residents may have additional rights under the CCPA/CPRA. EEA/UK residents may have rights under GDPR. To exercise rights, email privacy@getcalmkoala.com. We may verify your request.
11. Children’s privacy
Calm Koala is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.
12. International transfers
We operate in the United States. If you use Calm Koala from other countries, your information may be processed in the U.S. and other locations where our service providers operate, with appropriate safeguards where required.
13. Wellness disclaimer
Calm Koala provides wellness and educational insights. It is not a medical device and does not diagnose, treat, cure, or prevent any disease. Do not use Calm Koala as a substitute for professional medical advice.
14. Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised version at getcalmkoala.com/privacy and update the “Last updated” date. Material changes may also be communicated in the app where appropriate.
15. Contact us
Email: privacy@getcalmkoala.com
Web: https://www.getcalmkoala.com