Download SuccessRelax

Privacy Policy for SuccessRelax

Last Updated: July 2, 2026 — v2.1

In Plain Language (Summary)

Here's the short version of how we handle your data. The full policy below is the authoritative version.

  • Who we are: SuccessRelax is operated by Dotwtfbubble OÜ, based in Estonia (EU). Contact: info@successrelax.com.
  • What you give us: your email, name/display name, optional profile picture, and (optionally) date of birth (for the "days until your age goal" feature). If you rate or review a meditation, your display name and review are shown publicly.
  • Analytics are opt-in only: we only collect a small amount of pseudonymous usage data (e.g. which session you played) if you say yes on the in-app consent screen. We use PostHog, hosted in the EU. We never send your name or email to analytics, and you can turn it off anytime.
  • We treat your usage data as sensitive, because what you listen to can reveal something about how you feel. That's why analytics are strictly opt-in and pseudonymous.
  • Subscriptions: handled by Apple/Google; we use RevenueCat to check your subscription status. We never see your card details.
  • Technical providers: Firebase/Google (account + database), Cloudflare (audio delivery). Some of these are in the US and may see your IP address, as any internet service does. Fonts are bundled with the app and self-hosted on our website — nothing is loaded from Google Fonts servers.
  • No automated decision-making or profiling. No algorithm makes decisions about you, and we don't build behavioral profiles.
  • What we DON'T do: no advertising trackers, no selling your data, no location/biometrics, no microphone/camera/contacts access, no crash/analytics SDKs beyond opt-in PostHog.
  • Your rights: access, correct, delete, export, and (in the EU) restrict or object. Withdraw consent anytime. Email info@successrelax.com to exercise any right.
  • Deleting your account removes your data within 30 days — but you must cancel your subscription separately in the App Store / Google Play.

This summary is for convenience only and is not a substitute for the full Privacy Policy below.

Full Privacy Policy

1. Who We Are

This Privacy Policy informs you, as required by Articles 13 and 14 GDPR and other applicable privacy laws, how Dotwtfbubble OÜ ("we," "our," "us"), operating as SuccessRelax, collects, uses, and protects your information when you use our app and website (the "Service"). Dotwtfbubble OÜ is the data controller for the processing described here.

  • Legal Entity: Dotwtfbubble OÜ
  • Registry Code: 14677692
  • Address: Harju maakond, Tallinn, Kesklinna linnaosa, Pärnu mnt 105, 11312 Estonia
  • VAT ID: EE102152432
  • Contact: info@successrelax.com

We have not appointed a Data Protection Officer, as we are not legally required to do so; you can direct all privacy matters to the contact above.

2. Information We Collect

2.1 Information you provide: email address; name / display name; optional profile picture; optionally, your date of birth / target age (only if you choose to use the "days left until your age goal" feature — providing it is voluntary and the feature works only if you do); and your favorites, ratings, and reviews. If you submit a rating or review, the display name you provide and your review text are visible to other users.

2.2 Account & authentication: we use Firebase Authentication (Google) for sign-in. Depending on your method we receive your email and an encrypted credential (Email/Password), or your email, name, and profile picture (Sign in with Google / Apple — Apple may use a private relay email). Passwords are never stored in plain text. An account is required; we do not offer anonymous accounts.

2.3 Usage & analytics — opt-in only: if you consent on the in-app privacy screen, we collect a small set of pseudonymous events (such as which session was started) via PostHog (hosted in the EU), identified only by your pseudonymous Firebase user ID. We do not send your email or name to analytics, do not use autocapture, and do not record your screen or sessions. Because what you listen to can reveal information about your wellbeing, we treat this as sensitive and keep it strictly opt-in. You can withdraw consent anytime in the app's privacy settings, after which we stop collecting new events. If you do not consent, no analytics are collected.

2.4 Payment & subscription: payments are processed by Apple/Google — we never collect or store your card details. We use RevenueCat (US) to verify subscription status; it receives an app user identifier (your Firebase user ID) and your purchase/subscription status, but not your card details.

2.5 Technical & connection data: to deliver content and operate the Service, we process your IP address and connection metadata (visible to Cloudflare and our servers, as with any internet service), secure authentication tokens (your Firebase ID token, sent with certain requests like fetching a secure audio link, rating, or deleting your account), and basic device/OS information. Fonts used in the app are bundled with the app itself, and fonts on our website are self-hosted on our own infrastructure — no font requests are sent to Google Fonts or other third-party font servers.

2.6 Stored locally on your device: login/session tokens (to keep you signed in), listening history and playback preferences, your analytics consent choice and a local analytics ID (only if you opted in), and app settings. This stays on your device.

2.7 What we do NOT collect: precise geolocation; biometric data; your contacts, photos, microphone, or camera; journal entries or notes; advertising/profiling data. We do not use Firebase Analytics, Google Analytics, crash-reporting SDKs (Crashlytics, Sentry), push-notification tracking, or social-media tracking pixels.

3. How We Use Your Information

  • Provide the Service: manage your account and sign-in; deliver meditation, hypnosis, and breathwork content; store/display favorites, ratings, and reviews; verify subscriptions (via RevenueCat) and unlock premium content; provide support.
  • Improve the Service: with your consent, analyze limited pseudonymous usage events (PostHog) to understand which content is used. Without consent, we do not analyze your individual usage.
  • Communicate: service messages (verification, password reset, important updates); respond to support; marketing only with your separate consent and an opt-out anytime.
  • Security & legal: detect/prevent fraud and unauthorized access; enforce our Terms; comply with the law.

No automated decision-making or profiling: we do not use automated decision-making within the meaning of Article 22 GDPR and do not create behavioral profiles about you.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only with service providers who help us run the Service:

  • Firebase / Google LLC (US): authentication, database (Firestore) storage of account data, favorites, ratings, reviews; backend.
  • PostHog (EU hosting): product analytics, only if you opted in; pseudonymous events + Firebase user ID, no email/name.
  • RevenueCat, Inc. (US): subscription verification; app user identifier + subscription status.
  • Cloudflare, Inc. (US): audio delivery/storage (R2) and backend request handling; processes IP as technically necessary.
  • Apple / Google: payment processing via their app stores.

These providers are contractually required to keep your information confidential and use it only for the purposes we specify.

We may also disclose information when required by law (court, authority, law enforcement), to protect rights/safety, or in a business transfer (merger/acquisition — with notice). We share other information only with your consent.

Publicly visible: ratings/reviews and the display name you provide are visible to other users — please don't include sensitive information in reviews.

5. Storage, Security & Retention

Account data (name, email, date of birth, favorites, ratings, reviews, subscription status) is stored via Firebase (US and other Google locations). Audio is on Cloudflare R2. Opt-in analytics is on PostHog's EU infrastructure. Subscription data is processed by RevenueCat (US).

We protect your data with HTTPS/TLS encryption in transit, token-based authentication, signed time-limited links for audio, access controls, and reputable providers. No method is 100% secure, but we use commercially acceptable measures.

We retain data while your account is active. On deletion we delete or anonymize your data within 30 days, and backups are deleted within 90 days. Data we are legally required to keep is retained for the statutory period and then deleted — in particular, invoicing and accounting records must be kept for 7 years under the Estonian Accounting Act; such records are stored separately and are not used for any other purpose.

6. Your Rights

All users: access, correction, deletion, objection, and data portability.

EU/EEA (GDPR): also restriction of processing, withdrawal of consent anytime (including analytics and marketing) without affecting the lawfulness of processing before withdrawal, and the right to complain to your local data protection authority. Legal bases: contract performance, Art. 6(1)(b) (account/content/subscription); consent, Art. 6(1)(a) (opt-in analytics, marketing, the optional age-goal feature); legitimate interests, Art. 6(1)(f) (security, fraud prevention, reliable operation); and legal obligation, Art. 6(1)(c) (e.g. accounting retention).

US state privacy laws: depending on your state of residence you may have rights under laws such as the California CCPA/CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and similar state laws: the right to know/access, correct, and delete your personal data; data portability; the right to opt out of the "sale" or "sharing" of personal data and of targeted advertising (we do not sell or share personal data and do not engage in targeted advertising); the right to limit the use of sensitive personal information (we use it only to provide the Service and, for analytics, only with your opt-in consent); and the right not to be discriminated against for exercising your rights. We honor these rights for all US users regardless of whether the relevant law technically applies to us. You may also appeal a refusal by replying to our decision email; we will respond to appeals within the timeframe required by your state's law. Nevada: opt-out of sale (we don't sell). Brazil (LGPD): access, correction, deletion, portability.

To exercise any right: email info@successrelax.com with subject "Privacy Rights Request," including your name, account email, and the right you want to exercise. We respond within 30 days (45 days for CCPA requests, with possible extension where permitted). We may verify your identity first. You may also use an authorized agent where your state's law provides for one.

7. Account Deletion & Data Export

Delete your account: in the app, Settings → Account Settings → Delete Account → confirm. This permanently deletes your name, email, date of birth, favorites, ratings, and reviews; access is revoked immediately; backups are removed within 90 days. Deletion is immediate and irreversible, and we cannot email a confirmation because your email is deleted — contact us first if you need confirmation.

Important — subscriptions: deleting your account does not cancel your subscription. Cancel separately: Apple — Settings → your name → Subscriptions → SuccessRelax → Cancel; Google — Play Store → Menu → Subscriptions → SuccessRelax → Cancel.

Export your data: email info@successrelax.com with subject "Data Export Request" (or use the in-app export if available). After identity verification, within 30 days we provide a JSON or CSV file with your account information, favorites, ratings, reviews, and any other personal data we hold.

8. Children's Privacy

SuccessRelax is not intended for anyone under 18, and we do not knowingly collect data from children under 18. If you believe a child has provided us data, contact info@successrelax.com and we will delete it.

9. International Data Transfers

We operate from Estonia (EU). Some providers (Firebase/Google, RevenueCat, Cloudflare) process data in the US and other countries; PostHog stores opt-in analytics within the EU. For transfers to the US we rely primarily on the EU–US Data Privacy Framework, under which Google LLC, Cloudflare, Inc., and RevenueCat, Inc. are certified, supplemented by Standard Contractual Clauses as a fallback safeguard, together with appropriate technical and contractual measures. You can request a copy of the relevant safeguards via info@successrelax.com.

10. Cookies & Tracking

App: no advertising or cross-app tracking. Local device storage is used only to function (keep you signed in, remember preferences/history). Opt-in analytics via PostHog as described in Section 2.3.

Website: only essential cookies necessary to function. All fonts are self-hosted — no requests to Google Fonts or other external font services. No advertising or marketing trackers (no Facebook Pixel, etc.). If we ever add analytics/marketing cookies to the website, we will update this policy and provide a consent banner where required.

Do Not Track: there is no industry standard for DNT signals; since we do no cross-site tracking and our analytics are strictly opt-in, you control analytics directly through your in-app consent.

11. Third-Party Links

Our Service may link to third-party sites/services we don't control; this policy applies only to SuccessRelax. Relevant third-party policies: Apple (apple.com/legal/privacy), Google (policies.google.com/privacy), PostHog (posthog.com/privacy), RevenueCat (revenuecat.com/privacy), Cloudflare (cloudflare.com/privacypolicy).

12. Data Breach Notification

If a personal data breach occurs, we will investigate and contain it without delay. Where required by Article 33 GDPR, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also inform you directly without undue delay (Article 34 GDPR), describing the nature of the breach, the data affected, the likely consequences, the measures we have taken, and recommended steps you can take. We will also comply with any applicable US state breach-notification laws.

13. Changes to This Policy

We may update this policy to reflect changes in practices, technology, or law. We will update the "Last Updated" date, notify you of significant changes by email or in-app, and seek fresh consent where a change affects processing that is based on your consent.

14. Contact Us

  • Email: info@successrelax.com
  • Website: https://successrelax.com
  • Address: Dotwtfbubble OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Pärnu mnt 105, 11312 Estonia (Registry Code 14677692, VAT EE102152432)

EU users may also lodge a complaint with their local data protection authority; the authority responsible for us is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). We aim to respond to privacy inquiries within 5 business days.

Last updated July 2, 2026 — v2.1.