Privacy Policy

1. Who We Are

Salūs Sleep is operated by Salus Studios Ltd, registered in England and Wales (company number 17268621). Salus Studios Ltd is the data controller for your personal data. For any data protection enquiry, contact [email protected].

2. What We Collect & Why

We collect only what we need to run the service:

• Account & payment: Name, email, and password to manage your account; payments are handled securely by Stripe, Apple, or Google Play (we never store full card details).
• Usage & analytics: Anonymous website and in-app activity (pages viewed, playback, sign-ups, purchases) to understand traffic and improve the service.
• App onboarding: Wellbeing goals and interests you give when setting up the app, stored against your account and deleted with it.
• TikTok connection and posting: If you choose to connect TikTok, we process your TikTok account identifier, display name, avatar, encrypted access and refresh tokens, token expiry, and internal account-link timestamps. We use these only to connect the account you chose, show which TikTok profile will receive a post, read its current posting options, and carry out posts you expressly request.
• Your TikTok video: When you press Post, the video you selected and its caption are sent to TikTok. Video chunks pass through our authenticated Supabase function in memory and are forwarded unchanged to TikTok. We do not store the video, caption, TikTok upload URL, or completed post.
• Advertising measurement (website, only if you accept cookies): Advertising tags from X (Twitter), Pinterest and TikTok record that a page was viewed and whether a sign-up or subscription followed, so we can tell which of our adverts actually work. They receive your IP address, browser and device details, and the address of the page you are on. They are strictly opt-in, they do not load at all until you accept cookies, and they never load on our sign-up, log-in or subscribe pages.
• Embedded video: Our About page embeds one video from YouTube. When that page loads, your browser requests the player from Google, so Google receives your IP address and browser details and can place storage on your device if you play the video. We use the privacy-enhanced youtube-nocookie.com player, which limits what YouTube stores unless you press play.
• Health (sleep) data, mobile apps only: With your explicit permission, sleep data read from Apple Health or Health Connect, processed on your device only (see Section 5).
• Optional promotional app notifications: If you are 18 or over and separately opt in, we process an app installation identifier, your notification permission and consent records, an encrypted-at-rest Firebase Cloud Messaging token, mobile platform, coarse locale territory and time zone. We use only those details, plus whether the relevant subscription offer or conversion already occurred, to deliver and limit optional subscription-offer notifications. We do not use sleep, health, mood, audio, story-listening or other sensitive data to target them. Opening a notification is recorded only after the app validates its opaque delivery token; a purchase is attributed only after Apple or Google verifies the store transaction. Seeing or receiving a notification is never counted as a purchase.
• Communications: Anything you send us when you get in touch. The contact form on this website is run for us by Formspree, so the name, email address, subject and message you type there are sent to Formspree, which passes them to us by email and keeps a copy in our Formspree account so we can reply to you.

Our lawful bases under the UK GDPR are: contract (to provide the service, process payments, and carry out a TikTok connection or post that you request), legitimate interests (to run, secure, and improve the service via anonymous analytics), consent (marketing emails, promotional app notifications, and cookies set by Google Analytics/AdSense), and explicit consent for health data (Article 9(2)(a)).

We do not sell, rent, or trade your personal data, and we never use health data for advertising.

3. Third-Party Services

We rely on a small set of providers to run Salūs, each processing data under its own privacy policy: Supabase (EU, accounts, promotional-notification consent and delivery records, encrypted TikTok connection data, and the non-storing video relay), Cloudflare (CDN & media), GitHub Pages (website hosting), Resend (email), Stripe Payments Europe / Apple / Google Play (payments), PayPal (historic payments processor, earlier web subscriptions only), ipbase.com (city-level geolocation), Google Fonts (fonts), Formspree (the website contact form), YouTube, part of Google (the video player embedded on our About page), X Corp. and Pinterest (advertising measurement tags, loaded only after you accept cookies), Sentry (error monitoring), Plausible (cookie-free analytics), Google Firebase (app analytics and, only after the separate opt-in, notification delivery), Google Analytics (analytics), TikTok (Login Kit, creator-selected Direct Posts, install attribution, and a website advertising measurement tag that loads only after you accept cookies; see TikTok's Privacy Policy), and Google AdSense (advertising). Third-party AI services are used for audio narration only and receive no user data.

So you can see exactly who your browser talks to, these are the outside web addresses this website contacts, and what each one is for. cdn.jsdelivr.net is a public code library service that hands your browser two pieces of open-source software we use: the Supabase sign-in library, and the video player on our room pages. It receives your IP address and browser details, it sets no cookie, and it receives no account data. static.ads-twitter.com (X Corp.) and s.pinimg.com (Pinterest) are our advertising measurement tags, and neither loads at all unless you accept cookies. www.youtube-nocookie.com (Google) serves the privacy-enhanced player for the one video embedded on our About page. formspree.io delivers our contact form to us, so it receives whatever you type into that form, including your email address. play.google.com (Google) is the store listing our download buttons point at, and your browser only contacts it if you click one. To stop these: refuse cookies on our banner to keep the advertising tags off the page entirely, and use your browser's own content blocker for the rest.

Some providers are based in the US; where data leaves the UK we rely on the UK-US Data Bridge, Standard Contractual Clauses, or equivalent safeguards. Health (sleep) data is never shared with any third party, it stays on your device.

4. Cookies & Local Storage

Plausible analytics is cookie-free. Cookies from Google Analytics and AdSense are set only after consent. The X (Twitter), Pinterest and TikTok advertising tags are stricter still: they are not loaded onto the page at all until you accept cookies on our banner, and they are never loaded on the sign-up, log-in or subscribe pages. Playing the YouTube video embedded on our About page lets Google set its own storage on your device, under Google's privacy policy rather than ours. We use your browser's local/session storage for an anonymous visitor ID, your login token, your analytics opt-out preference, and short-lived TikTok sign-in security and return-page values. You can clear this any time via your browser, and opt out of analytics by appending ?salus_notrack to any page URL.

5. Health Data (Mobile Apps Only)

This section applies only to the mobile apps; the website accesses no health data.

With your explicit permission, the app reads only sleep data (sleep periods and stages) from Apple Health (iOS) or Health Connect (Android), no other health data type. It is read-only, processed on your device only, and is never uploaded to our servers, stored in our database, sold, or shared. It is used solely to show you your own recent nights and sleep trends.

The optional Sleep Recorder (iOS) records and analyses overnight audio entirely on your device using Apple's on-device sound recognition; nothing is uploaded or shared, and you can delete recordings at any time.

You can review or withdraw health permission at any time in Apple Health → Sharing → Apps or Health Connect → App permissions; the rest of the app works normally without it. Sleep data is special category data processed on the basis of your explicit consent (Article 9(2)(a)).

6. Storage, Security & Retention

Your data is encrypted in transit (TLS) and at rest, held on secure servers with access limited to those who need it. We will report any qualifying personal data breach to the ICO within 72 hours.

We keep data only as long as needed: account data, including a linked TikTok identity and encrypted tokens, is deleted within 30 days of account deletion; payment records are kept for 7 years (HMRC); anonymous analytics for up to 24 months; newsletter sign-ups until you unsubscribe. Promotional-notification consent and delivery ledgers are kept for up to 24 months for compliance and dispute handling. A notification delivery token expires after no more than 30 days, attribution is accepted for no more than 7 days, and withdrawn, stale or invalid Firebase tokens are no longer used. TikTok video bytes and captions are not retained by us. Health (sleep) data is never stored by us, it stays in Apple Health or Health Connect.

7. Your Rights

Under the UK GDPR you have the right to access, correct, delete, restrict, port, or object to the use of your personal data, and to withdraw consent at any time. Promotional notifications can be withdrawn in the app's Notifications screen or blocked in your phone settings; withdrawal stops further promotional sends and invalidates the registered token for our service. To exercise any other right, email [email protected] and we will respond within one month.

If you are unhappy with our response you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or call 0303 123 1113.

8. Children

Salūs is not directed at children under 13 and we do not knowingly collect their data. The separate promotional-notification programme is restricted to people who attest that they are 18 or over. If you believe we have collected a child's data, contact [email protected] and we will delete it.

9. Changes & Contact

We may update this policy from time to time; the "last updated" date above shows the latest revision, and we will give notice of significant changes. Questions? Email [email protected] or get in touch.