Privacy Policy

Effective November 08, 2026 · Developer: Moimaere OU

Cotton helps you track sleep with your iPhone or with a compatible watch or band through Apple Health, play sleep sounds, and explore personal sleep habits. It is a wellness app, not a medical device, diagnosis, or treatment service. It does not detect sleep apnea or any other condition.

Your account and local records

The current sign-in screen uses Sign in with Apple. Existing local profiles are preserved. Your sleep records, journal and experiments stay in this iPhone’s protected local store unless you choose to export them or explicitly enable account backup. Signing in does not enable cloud backup.

Account information

Sign in with Apple authenticates your account through Supabase. We receive the Apple account identifier and, when you provide them, your name and email or Apple private relay email. Supabase stores account information. Account-linked welcome-offer presentation and dismissal records prevent repeated offers. Account access does not require cloud backup.

Health access and local records

Apple Health access is read only and requires your permission for each category. Depending on those permissions and your connected source, the current app reads sleep, heart rate, resting heart rate, heart-rate variability (HRV), respiratory rate, blood oxygen, sleeping wrist temperature and breathing disturbances. Earlier imports of other Health or fitness categories remain available for export and deletion; reducing permissions does not erase existing records. Your profile, journal, experiments and imported readings are stored in the app’s protected local store. Your watch or band must write compatible records to Apple Health; missing readings are not invented. Synthetic samples are labeled and kept separate from your records.

Sleep tracking with your iPhone

Phone tracking starts only when you tap Start and stops when you end it, or after 14 hours at most. When you first start, the app asks for microphone access, which tracking needs, and for Motion & Fitness access, which is optional and only lets the app read the motion iOS records while the app is suspended. With the phone on the bed, the app uses motion and sound to estimate sleep and wake, still and restless time and a night score. On a nightstand it uses sound only, for snoring, talking, coughs and noise. These are wellness estimates; phone tracking does not measure sleep stages, heart rate or HRV.

All of this is analysed on your iPhone. Sound is reduced to numbers as it arrives, and no speech is transcribed. Loud moments are held on the phone until the morning review names them, then deleted. Short clips are kept only if you turn on Keep clips, which is off by default; they stay on your iPhone and are deleted after 30 days, or earlier when you delete them or the night. Tracked nights and clips are kept in the app’s protected local store, excluded from iPhone backups and never included in cloud backup. Audio and clips never leave your iPhone. Only if you choose to share Track accuracy are anonymous numbers about each night sent to us (see Analytics).

Analytics

To understand how Cotton is used and to improve it, the app sends anonymous usage events to our Supabase project: when the app opens and for how long, which screens are viewed, onboarding steps, whether subscription and offer screens are shown, accepted or closed, purchase outcomes, when tracking starts and stops, which sleep sounds are played, and errors. Each event carries a random install identifier created by the app, the app and iOS version, device model, language and time-zone offset. The install identifier is not linked to your account, name or email, and we do not combine it with other companies’ data. Usage events never include Health readings, scores, journal answers, notes, audio or recordings. We use them on the basis of our legitimate interest in running and improving the app. You can turn them off at any time in Settings → Settings → Privacy → Share usage data, which also deletes the events this install already sent.

Track accuracy is separate and off until you say yes. After your first tracked night the app asks once whether to share anonymous numbers about each night: how long tracking ran, phone placement, how much of the night motion and sound covered, the phone’s sleep, latency, wake and snoring estimates, and, if you also wear a band, how its sleep and wake times compared. These numbers are health-related, so they are sent only with your consent, carry the same random install identifier, and never include audio or your account. Change this any time in Settings → Settings → Privacy → Share Track accuracy. Analytics records are kept for up to 400 days and are not used for advertising.

Optional private cloud backup

Cloud backup is off until you explicitly enable it. When enabled on an iPhone, your profile, journal/context, experiments, permitted Health readings and derived sleep summaries are transmitted to your private Supabase account for backup, synchronization and your personal Sleep Lab insights. Archived sound recordings from earlier builds can also be synchronized. Nights and clips from phone tracking are not part of cloud backup.

Turning backup off in Account stops future uploads from that iPhone and attempts to remove its cloud sleep and audio copy while preserving local records. If removal fails, the app displays a retry action. Other signed-in devices with backup enabled can upload their copies again; turn backup off there as well, or delete the account to stop all account access.

Purchases

Apple processes payments. We do not receive your card details. StoreKit verifies purchases and restores access. RevenueCat processes Apple purchase and receipt history with an anonymous SDK identifier or your authenticated account identifier for subscription functionality, entitlement reporting and purchase analytics. This processing is separate from optional Health-data backup. We do not send Health readings, tracked nights, sleep scores, diary, journal, experiments, audio, name or email to RevenueCat through this integration. SDK diagnostics collection is disabled. Subscription prices and renewal terms are displayed before purchase; subscriptions are managed in your App Store account. Deleting an app account does not cancel an Apple subscription.

How data is used

Account and cloud data are used for app functionality, security, backup and personal insights. We do not sell your data, use it for advertising, or use it to track you across other companies’ apps or websites. Anonymous analytics are used only to understand and improve Cotton. The app has no advertising SDK. RevenueCat provides purchase analytics using purchase history and identifiers, rather than Health or journal content. Apple, Supabase and RevenueCat provide authentication, purchase or account infrastructure and may process operational security logs under their policies. This public website is hosted by Vercel, which may process visitor IP addresses and request information for delivery and security. The website has no advertising, analytics scripts, login or Health-data upload form. See Supabase’s privacy policy, RevenueCat’s privacy policy and Vercel’s privacy policy.

Retention and deletion

Local records remain until you remove them or erase the app’s data. Account/cloud records remain until removed through the app or account deletion. For local-only use, Settings → Settings → Account → Delete local data removes local records, including tracked nights and clips. For signed-in use, Settings → Settings → Account → Delete account & all data removes private archived audio before deleting the account and its database records, then removes local app records, including tracked nights and clips, alarms and reminders. If a step fails, the app reports it so you can retry. Apple Health originals, exported files and Apple purchase records are separate and remain.

Deleted information may persist in restricted provider backups or operational logs until those expire according to the provider’s retention policies; it is no longer available through your app account. Contact us for a data access or deletion request. Do not include Health records or recordings in an email unless you choose to share them.

Your choices

Contact and policy updates

For support, privacy requests or questions, contact Moimaere OU at destek@sirada.com. Material changes to this policy will be reflected on this page and, where needed, presented in the app before a new use of sensitive information.