This Privacy Policy explains how Softmode Labs AB ("Softmode Labs," "we," "our," or "us"), a company registered in Sweden, handles your information when you use the Cloody mobile application ("App"). Softmode Labs AB is the data controller responsible for the limited personal data processed in connection with the App.
The short version: Almost all of your data stays on your device. We don't sell your data, we don't run ads, and we don't track you across apps.
1. Information We Collect
1.1 Data Stored On Your Device (and synced via your iCloud)
The following data is stored on your iPhone and, where you have iCloud enabled, synced between your own devices through Apple's iCloud (CloudKit). It is never transmitted to our servers:
- Sleep data: Bedtime commitments, sleep session records, sleep quality ratings, Good Nights count
- Voice recordings: Morning voice messages you record for your evening self. These are stored as audio files on your device and, if you've enabled iCloud, in your private iCloud container.
- Personal preferences: Your name, target bedtime, wake time, wind-down preferences, quiz answers
- Routine data: Evening routine activities and completion status
- Screen Time data: If you enable the App Shield feature, app usage data is processed entirely on-device through Apple's Screen Time API. We never see or access this data.
iCloud sync is managed by Apple under your Apple ID and is governed by Apple's Privacy Policy. We have no access to your iCloud data.
1.2 Data Processed by Third Parties
The following providers act as our data processors / service providers, processing data only on our instructions and not for their own purposes:
- Subscription data — RevenueCat, Inc. (United States): If you subscribe to Cloody, your purchase is processed by Apple through the App Store. We use RevenueCat to manage subscription status. RevenueCat receives an anonymized user identifier and purchase receipt data — never your name, email, or personal details. See RevenueCat's Privacy Policy.
- Anonymous usage analytics — PostHog Inc. (data hosted in the European Union): We use PostHog to collect anonymous, aggregated usage data — for example, how features are used and where users drop off in onboarding. We never transmit your messages, voice recordings, notes or any text you write within the App, signatures, the apps you select to shield, or your name. Events are associated with a random anonymous identifier, not with you personally. An approximate country and city may be inferred from your IP address before the IP is discarded. You can disable analytics at any time in Settings > Privacy. See PostHog's Privacy Policy.
1.3 Data We Do NOT Collect
- We do not use advertising SDKs or ad tracking
- We do not collect your email address, phone number, or precise location
- We do not sell your data or share it with data brokers or third-party advertisers
- We do not use cookies or cross-app tracking
- Our analytics provider never receives the content you create (messages, notes, voice recordings, signatures, any text you write within the App, or the apps you shield)
2. How We Use Information
Your on-device data is used solely to provide the App's core features:
- Tracking your sleep commitments and Good Nights progress
- Playing back your morning voice messages at bedtime
- Sending you local push notifications at times you chose
- Displaying your personalized sleep schedule and routines
- Managing your subscription status
We use anonymous, aggregated analytics data (described in §1.2) solely to understand how Cloody is used at the population level and to improve the product. Our legal basis under the GDPR is legitimate interest. You can object to this processing at any time — see §8.
3. Apple Screen Time API
Cloody's App Shield feature uses Apple's Family Controls and Screen Time frameworks. These operate entirely within Apple's privacy sandbox:
- App selection tokens are opaque — Cloody cannot see which specific apps you selected
- All usage monitoring happens on-device through Apple's DeviceActivity framework
- No Screen Time data is transmitted to us or any third party
4. Notifications
Cloody sends local push notifications (bedtime reminders, wind-down prompts, morning check-ins, voice message alerts). These are generated and scheduled entirely on your device. No notification data is sent to our servers.
5. Data Retention
On-device and iCloud-synced data is retained for as long as you use the App. You can delete all on-device data at any time through Settings > Reset All Data. Uninstalling the App also removes locally stored data; iCloud-synced content is removed via your Apple ID's iCloud storage management.
Anonymous analytics events held by PostHog are retained for up to 12 months and then deleted or aggregated beyond reversal. Subscription records held by RevenueCat are retained for as long as required to manage your subscription and meet Apple's reporting and refund requirements.
6. Data Security
Your data is protected by Apple's iOS security infrastructure, including device encryption and the iOS sandbox. Since your data remains on-device, it benefits from the same security protections as all other data on your iPhone.
7. Children's Privacy
Cloody is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use Cloody.
In EU countries where the digital-services age of consent under the GDPR is higher than 13 (Germany and the Netherlands at 16, France at 15), parental consent is required if the user is below that local threshold.
8. Your Rights
Because almost all of your data is stored on your own device, you have direct control:
- Access: All your data is visible within the App
- Rectification: Edit your data directly in Settings
- Erasure: Use Settings > Reset All Data, or uninstall the App
- Restriction of processing: Turn off the features you do not wish to use
- Portability: Your data is yours — it lives on your device
- Withdraw consent / object to analytics: Turn off the analytics toggle in Settings > Privacy. Once disabled, no further analytics events leave your device.
For subscription-related data managed by RevenueCat, contact hi@cloodyapp.com and we will facilitate any access or deletion request.
Right to lodge a complaint. If you are in the EU, EEA, UK, or Switzerland and believe your data has been handled in violation of applicable law, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Swedish Authority for Privacy Protection (IMY) — imy.se. You may also lodge a complaint with the authority in your country of residence.
9. Notice for California Residents (CCPA / CPRA)
If you reside in California, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
- We do not sell or share your personal information, including for cross-context behavioural advertising. We do not have a "Do Not Sell or Share My Personal Information" link because we do not engage in those activities.
- Sensitive personal information: We do not use sensitive personal information for any purpose other than what is necessary to provide the App.
- Categories of personal information collected in the past 12 months are described in Section 1.2 above (anonymized identifiers and aggregated usage data, subscription identifiers and receipt data). Categories of sources: directly from you and your device. Categories of recipients: our service providers listed in Section 1.2. We do not disclose personal information for direct marketing purposes.
- Your CCPA rights — to know, to access, to delete, to correct, and to limit use of sensitive information — are exercised the same way as the rights described in Section 8. Contact hi@cloodyapp.com to make a request.
- No discrimination: We will not discriminate against you for exercising your privacy rights.
Residents of other U.S. states that have enacted comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others) have substantially similar rights. To exercise them, please contact us at hi@cloodyapp.com.
10. International Data Transfers
Softmode Labs AB is based in Sweden. Our analytics provider PostHog hosts our project's data in the European Union; no analytics transfer outside the EU/EEA takes place on our side. RevenueCat is based in the United States; subscription identifiers transferred to RevenueCat are governed by Apple's App Store agreements and RevenueCat's own contractual safeguards. iCloud data is handled by Apple under your Apple ID and may be processed in Apple's global infrastructure as described in Apple's Privacy Policy.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or by updating the "Last updated" date above.
12. Contact Us
For questions about this Privacy Policy or to exercise your rights:
- Cloody product support: hi@cloodyapp.com
- Softmode Labs AB (data controller): hello@softmode.se · Sweden
13. Legal Disclaimer
This Privacy Policy is provided for transparency and to comply with applicable privacy laws. It does not constitute legal advice. The English version of this policy is the authoritative version; translations are provided for convenience only. To the extent permitted by applicable law, in case of any conflict between this policy and a written agreement between you and Softmode Labs AB, the written agreement prevails.