Nefes — Privacy Policy

Effective date: June 15, 2026 · Version: 1.0 Data controller: Ömer Faruk Coşkun, Türkiye · Contact: [email protected]

This Privacy Policy explains how the Nefes mobile app ("Nefes", "the app", "we") handles your data. Nefes is privacy-first by design.

1. Summary

No account, no servers. You don't need to register, and the app works offline.
Your breathing history, mood entries, journal notes, streaks, progress, and settings are stored only on your device. They are never sent to any server of ours — because we don't operate any.
The only data that leaves your device is the purchase information needed to process and validate your subscription, sent to Apple and our subscription infrastructure provider RevenueCat.
No ads, no third-party trackers, no data sales, no location collection.

2. Data controller & contact

The data controller is Ömer Faruk Coşkun (Türkiye). For any privacy request: [email protected].

3. Data we do NOT collect

We don't request or collect identity data such as name, email, phone, or date of birth. (The optional profile name you may enter stays on your device and is never transmitted.)
We don't collect location, contacts, photos, or device identifiers.
We don't use an advertising identifier and we do not track you across apps or websites.

4. Data stored on your device (under your control)

The following is stored only in on-device storage (AsyncStorage):

Your session history, durations, completions, streaks, and progress stats;
Your mood entries (pre/post session);
Your journal notes;
Your preferences/settings (theme, reminder times, voice guidance, etc.);
Anonymous in-app event counters (e.g. number of sessions completed) — kept on-device, never transmitted.

If you delete the app, this data is deleted too. If you have iCloud Backup enabled, this data may be included in your own encrypted iCloud backup, which is managed by Apple under your control — we cannot access it.

5. The limited data that leaves your device (third parties)

a) Apple — platform & payments

Your subscription purchases are processed by Apple via the App Store. We never see your payment card details. Apple's privacy practices apply: https://www.apple.com/legal/privacy/

b) RevenueCat — subscription management

To validate your subscription status and restore it across devices, a pseudonymous app user ID and purchase/receipt data are sent to RevenueCat, Inc., which acts as our data processor. Details: https://www.revenuecat.com/privacy/

c) Apple Health (HealthKit) — optional, only with your permission

If you allow it, we write your completed sessions to Apple Health as "Mindful Minutes", and you may opt in to let us read sleep/HRV data on-device to tailor suggestions. This health data stays in Apple Health and on your device, is never sent to any server of ours, and is never used for advertising, marketing, or data mining. You can revoke access any time in iOS Settings > Privacy > Health.

d) Content delivery / audio streaming (applies when enabled)

When you stream guided audio or soundscapes, our content delivery (CDN) provider may process your device's IP address and technical request data to deliver the file. (In version 1.0 audio ships bundled with the app; this clause applies once streaming is enabled.)

6. Notifications

Reminders are scheduled and shown locally on your device; their content is not sent from a server (they are not push notifications).

7. Siri, Shortcuts, Widgets, Spotlight, Apple Watch

These features run on-device; commands and content are processed through Apple's platform features. Apple Watch ↔ iPhone sync of progress/streaks happens only between your own devices, on-device.

8. AI features (if offered)

Any future "understand how you feel → the right breath" feature is designed to run on Apple's on-device models (Apple Foundation Models): your input is processed on your device and not sent to our servers. If such a feature is enabled, you will be clearly informed in-app and your consent will be requested.

9. Children's privacy

Nefes is not directed to children under 13, and we do not knowingly collect data from them.

10. Your rights (GDPR / KVKK / CCPA)

Because most of your data is on your device, you can directly access it, correct it in the app, and permanently delete it by deleting the app.

GDPR (EU/EEA): rights of access, rectification, erasure, portability, and objection.
KVKK (Türkiye): rights to information, correction, deletion, and objection under Law No. 6698.
CCPA (California, US): rights to know/delete may apply; we do not sell personal information.

For any request, including data held by RevenueCat for purchases, contact [email protected].

11. Data security

Because we run no servers of our own, the attack surface is minimized. On-device data is protected by the operating system's (iOS) protections. No method is 100% secure, but not collecting data is the strongest protection.

12. International transfers

Providers such as Apple and RevenueCat may process limited subscription-related data outside your country; such transfers are made under those providers' contractual and legal safeguards (e.g. standard contractual clauses).

13. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date and announce material changes in-app and/or on this page.

14. Contact

Ömer Faruk Coşkun — [email protected] — Türkiye

See also the Health Disclaimer for safety information and the Terms of Service for subscription terms.