Skip to content

Privacy Policy

Last updated 8 November 2026 · Adam Richard Turner, trading as Sleep Coach

This policy explains how personal data is handled in the Sleep Coach iPhone app and on cbtinsomnia.app. It matches the Privacy notice in the App (More → Legal & safety). The short version: I collect only what the App needs, I never sell your data, I never use health data for advertising, and you can delete everything from inside the App.

1. Who is responsible for your data

The data controller is Adam Richard Turner, an individual sole trader based in the United Kingdom, trading as Sleep Coach. Contact: hello@adamrichardturner.dev. I am not required to appoint a Data Protection Officer; I handle privacy requests personally.

2. The law this policy follows

I process personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Where the EU GDPR applies to you, the same rights and protections apply.

3. Data I collect

  • Account: name, email address, sign-in method (email and a hashed password, Sign in with Apple, or Google), and preferences such as theme. If you use Sign in with Apple’s “Hide My Email”, I only receive the relay address.
  • Sleep diary: bed, sleep and wake times, how rested you felt, notes, and optional factors such as caffeine, alcohol units, naps or that you took sleep medication.
  • Tracker data you choose to connect: sleep sessions and stages from Apple Health, or from Fitbit / Pixel Watch through the Google Health API.
  • Plan: wake time, target bedtime, window length, weekly check-in history and the safety acknowledgements you confirm.
  • Worksheets and advice: answers you type in worksheets and which articles you open.
  • Chat and Sleep review: messages you send and the AI replies generated for you.
  • Notification preferences: which reminders are on. Reminders are scheduled locally on your device.
  • Technical data: IP address, device type, iOS and app version, and server logs needed for security and to fix errors.

I do not collect your contacts, precise location, photos, advertising identifier (IDFA), or browsing history. The App contains no advertising and no third-party analytics or tracking SDKs, and it does not “track” you as defined by Apple’s App Tracking Transparency.

4. Health data (special category data)

Sleep logs, tracker data and notes such as medication use are data concerning health under Article 9 UK GDPR. I process them only with your explicit consent, which you give by creating an account and agreeing to this policy, by confirming the wellness acknowledgement when you set up your plan, and separately by granting Apple Health or Google Health access and choosing to use diary, chat or review features.

You can withdraw consent at any time by disconnecting a source, deleting entries, or deleting your account. Withdrawal does not affect processing that already happened lawfully. Health data is never used for advertising, marketing, profiling with legal effects, or sold or shared with data brokers. See the Health Data notice for HealthKit and Google API commitments.

5. How I use your data and lawful bases

  • Providing the App — creating your account, syncing your diary, calculating your window and charts: contract (Art. 6(1)(b)), and explicit consent for health data (Art. 9(2)(a)).
  • Chat and Sleep review — generating AI replies when you ask: explicit consent (Art. 6(1)(a), 9(2)(a)).
  • Security, abuse prevention and fixing errors: legitimate interests (Art. 6(1)(f)) in keeping the service safe.
  • Legal obligations — such as responding to lawful requests or keeping records of deletion: legal obligation (Art. 6(1)(c)).
  • Service emails — such as password resets or important changes to these terms: contract or legitimate interests. I do not send marketing emails without your consent.

No decisions with legal or similarly significant effects are made about you by automated means. The weekly window suggestion is simple arithmetic that you are free to accept or ignore.

6. Who I share data with

I never sell or rent personal data. I share it only with processors that help me run the App, under written contracts that require them to protect it and use it only on my instructions:

  • Cloud hosting and database providers — store your account and diary.
  • Anthropic, PBC (USA) — the AI provider for Chat and Sleep review, only when you use those features. Under its commercial terms, Anthropic does not use API inputs or outputs to train its models.
  • Apple — if you use Sign in with Apple, and on your device for Apple Health and notifications.
  • Google — if you use Google sign-in, or connect Fitbit / Pixel Watch through the Google Health API.
  • Vercel Inc. and Cloudflare, Inc. — host and protect this website.
  • Professional advisers, courts or authorities — only where the law requires it.

7. International transfers

Some processors, including Anthropic, Vercel and Cloudflare, process data in the United States. Where personal data leaves the UK I rely on UK adequacy regulations (including the UK–US Data Bridge where the recipient is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate safeguards.

8. How long I keep data

I keep account and sleep data while your account is open. If you delete your account, personal data is erased within 30 days, except limited records I must keep for legal, tax or security reasons (for example, a record that an account was deleted). Encrypted backups roll over within a further 30 days. Server logs are kept for a limited period, normally no longer than 30 days.

9. Your rights

You have the right to access your data, correct it, erase it, restrict or object to processing, receive a portable copy, and withdraw consent at any time. To use any of these rights, email hello@adamrichardturner.dev or use the in-app options. I will respond within one month.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. I would appreciate the chance to resolve your concern first.

10. Security

I use TLS encryption in transit, signed and expiring access tokens, salted password hashing, encryption of Google access grants at rest, least-privilege access, and secure storage on your device (iOS Keychain) for sign-in tokens. No system is perfectly secure; if a breach occurs that is likely to put you at risk, I will notify you and the ICO as the law requires.

11. Children

The App is for adults aged 18 and over. I do not knowingly collect data from children. If you believe a child has created an account, contact me and I will delete it.

12. This website

cbtinsomnia.app is a static information site. It does not use cookies, analytics or advertising trackers, and has no forms. Our hosting and security providers (Vercel and Cloudflare) process standard request data such as IP address and browser type to deliver the site and protect it from abuse. See the Cookie notice.

13. App Store privacy summary

For transparency, this is how the App’s data is described in its App Store privacy details:

  • Data used to track you: none.
  • Data linked to you: Health & Fitness (sleep), Contact Info (name, email), User Content (diary notes, worksheets, chat messages), Identifiers (user ID).
  • Purpose: App Functionality only. No third-party advertising, no developer advertising or marketing, no data broker sharing.

14. Changes to this policy

I will update this policy when my processing or the law changes. The “last updated” date shows the current version, and material changes will be shown in the App before they take effect.

Questions about this document? Email hello@adamrichardturner.dev.