Sleep Stories: Meditation
Legal

Privacy Policy

Last updated 8 October 2026

Sleep Stories: Meditation (shown as Sleep Stories on your device) is a guided sleep and meditation app developed by HDFoundry. This policy describes what the app collects, why, and what it does not do. It is written to match version 1.0.0 and is updated when the app changes.

The short version

You can use the app as a guest with no email and no sign-up. Every user, guest or not, has an account identifier created by Google Firebase on first launch, so that favourites and progress can be saved on our server. If you sign in, we also store your email address and name. We do not sell or trade your information, the app contains no advertising, and it has no purchases. We use Google Firebase for sign-in, crash reports and notifications.

Using the app as a guest

On first launch the app asks Firebase Authentication to create an anonymous account. It holds no email, name or password, and it lets you save favourites and progress without signing up. Every request the app makes to our server carries this account's identifier. If you later create an account or sign in, your guest favourites and progress are moved into that account.

If you create an account

Signing in is optional. You can use an email address and password, Sign in with Apple, or Google Sign-In. Depending on the method, we store:

  • Your email address, used to sign you in. Firebase Authentication also sends the verification email for email accounts. It is never shown to anyone else and never used for marketing.
  • Your name, the display name you enter or the one your Apple or Google account provides. You can change it in Personal info.
  • Your password, if you use email sign-in. It is held by Firebase Authentication as a hash; we cannot read it.

What the app stores about your use

On our server, linked to your account identifier (guest or signed in):

  • Favourites, the sessions you have saved.
  • Listening progress, how far you got in each session and whether you finished it.
  • Usage events, a record that a session was played, with the session's identifier, title and category and the time. We use these to see which sessions people listen to and to keep the app working. They are not used for advertising.
  • Notification registration, if you allow notifications: the push token for your device, its platform and your device time zone, so that a notification can be sent at the right local time. The token is removed when you log out or delete your data.

Audio is streamed from our server. To play a session the app asks the server for it, and the device keeps a temporary copy of audio you have played so that replays are quicker. That copy stays on your device, is never sent to us, and is removed when you clear the app's cache or uninstall. The app has no download feature.

Stored only on your device

  • Reminders. If you turn on reminders, the days and time you choose are kept on your device and the reminder is scheduled by your device. We do not receive them.
  • App settings, such as notification choices and whether you have seen the introduction.

Crash reports

The app uses Firebase Crashlytics (Google LLC) to send a crash report when it fails: where in the code it happened, the device model, operating system version and app version, and a random installation identifier. We do not attach your account identifier, email or name to crash reports. The app does not use Firebase Analytics.

Notifications and permissions

  • Notifications: optional. The app asks only when you turn on reminders or after you finish your first session, and you can refuse or change it in your device settings. Push notifications are delivered through Firebase Cloud Messaging and Apple's notification service or Google's, which handle your push token for that purpose.
  • Audio playback: used to play sessions, including in the background with the screen off and from the lock screen.
  • Internet: used to stream audio and to reach our server.

What we do not collect

  • No advertising and no advertising identifier used for ads or tracking. We do not track you across other apps or websites.
  • No precise location, contacts, photos, microphone or camera.
  • No health data. The app does not read from or write to Apple Health or Health Connect.
  • No payment information. Version 1.0.0 has no purchases or subscriptions.

Who else sees your data

Our own server and the service providers that run it for us, acting on our behalf:

  • Google Firebase (Google LLC): Authentication, Crashlytics and Cloud Messaging. See Google's Privacy Policy.
  • Apple and Google, when you choose Sign in with Apple or Google Sign-In, and as the operators of the push notification services.
  • Cloudflare, which sits in front of our server and passes requests to it, so it handles the network traffic between the app and our server, including your IP address.
  • Our hosting provider, a virtual private server on which the server and its database run.

We do not sell, rent or trade personal information. Data travels to our server over an encrypted connection. Nothing you save is visible to other users.

Deleting your data and your account

In the app, open Profile, then Settings, then Delete account (guests: Delete my data), and confirm. Your account and its data (favourites, listening history, progress and settings) are deleted within 7 days of the request. Until then your account keeps working, and you can cancel the request from the same place in Settings. Anonymous usage statistics that are not linked to you are kept.

Can't open the app? Email [email protected] from the address on your account and we will delete it within 7 days.

To stop notifications, turn them off in your device settings or in the app. To revoke Sign in with Apple or Google Sign-In for this app, remove it from the connected apps in your Apple or Google account.

How long we keep data

Favourites, progress, profile and push registration are kept until you delete them or your account, as described above. Push tokens that a notification service reports as no longer valid are removed. Guest accounts you never delete are kept until you ask us to remove them. Crash reports follow Firebase's retention settings.

Children

Sleep Stories: Meditation is intended for adults aged 18 and over and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will address it promptly.

Security

We use reasonable measures to protect data, including encrypted connections between the app and our server. However, no method of electronic transmission or storage is 100% secure.

Changes to this policy

We may update this policy from time to time. Significant changes are reflected by an updated date above.

Contact

Questions about this privacy policy? Email [email protected].