Privacy policy

As of October 2026 · GDPR · Translation — the German version is binding

In short

We collect as little as possible. Without an account your sessions stay on your device. We do not sell data, run no advertising and embed no trackers from advertising networks.

Controller

Florian Wagner (nowa), 13 rue du Temple, 68300 Saint-Louis, France. Email: support@nowabreathing.com. We are not required to appoint a data protection officer; please direct enquiries to the address above.

What we process

Depending on how you use nowa, the following data arises:

• Account: email address and, when signing in with email, a password hash. If you sign in with Apple, we receive an identifier, your email address or an Apple relay address and, the first time you sign in, your name; we store your first and last name in your profile. If you sign in with Google, we receive an identifier, your email address, your name and the link to your profile picture. Needed so you can sign in.
• Duet: the name you choose for invitations, and when you breathed together. The person you breathe with sees your Duet name and your shared Duets as rings in their year tree; they never see your email address. If you part ways or you delete your account, the shared rings stay in their tree, without your name.
• Session data: technique, date, duration, chosen category and — if mood tracking is on — your entry before and after. Your tree is built from this.
• Settings: language, reminder times, sound and colour options.
• Purchases and subscriptions: purchase status and expiry date. Payment itself runs through Apple or Google; we never see card details.
• Support requests: if you write to us from the app, we store your email address, the subject, the category and your text so we can reply.
• Apple Health: if you allow it, nowa adds completed exercises to Apple Health as mindful minutes. nowa does not read any data from Apple Health.
• Usage statistics: pseudonymised events such as “session started”, with a random installation ID and, if you are signed in, your user ID. Only if you switch measurement on in the app; without an answer it stays off. No advertising IDs and no profiling.
• Duet notifications: only if you allow notifications is a device token created, which we use to send you Duet notifications such as “Mia is waiting for you”. If you withdraw permission, we delete it. Reminders are created on your device; we send nothing for them.
• Technical logs: when the app connects to our server, short-lived logs with IP address, time and type of request are created there. They serve secure operation and are deleted automatically after seven days at the latest.
• Newsletter: email address and time of sign-up, only where you explicitly subscribe.

What we do not process

No microphone, no camera, no contacts, no location data, no advertising IDs, no cross-site tracking. We do not read health data from Apple Health or Google Fit.

Legal bases

Account, syncing and purchases: performance of the contract, Art. 6(1)(b) GDPR. Usage statistics, mood tracking, reminders, Duet notifications and the newsletter: your consent, Art. 6(1)(a) GDPR — revocable at any time. Mood entries may relate to health; we process them only with your explicit consent under Art. 9(2)(a) GDPR and you can switch the feature off entirely in the settings. Support requests: performance of the contract, Art. 6(1)(b) GDPR, and our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR. Entries in Apple Health: your consent, Art. 6(1)(a) GDPR. Technical logs and connection data when visiting the website: our legitimate interest in a secure and available service, Art. 6(1)(f) GDPR.

Retention

Account data and sessions remain until you delete your account; we then remove them within 30 days and backups within 90 days. We keep usage statistics for at most 14 months. Newsletter data until you unsubscribe. Purchase records are kept as long as tax retention rules require. Support requests are deleted with your account. Emails already sent are deleted automatically by our email service Resend after its retention period; in our mailbox we keep them for at most two years after your request is closed, unless a legal obligation requires longer. Purchase records at RevenueCat remain so that you can restore purchases and we can meet legal retention obligations; on request we delete them there as soon as no such obligation applies.

If you delete your account

We delete your account with everything attached to it: exercises, measurements, favourites, custom methods, unlocks, redeemed codes, support requests, usage statistics linked to your account, your profile and the device token for notifications. On your phone we delete everything nowa has stored.

Shared Duets stay in the other person’s tree, without your name and without any link to you. Usage statistics from the time you were not signed in have no link to your account and remain.

Apple or Google keep your purchases. RevenueCat keeps the purchase receipts and your account ID so that purchases remain verifiable and legal retention obligations are met; on request we delete them there as soon as no such obligation applies. Emails already sent are deleted automatically by Resend after its retention period; in our mailbox they remain for at most two years after your request is closed.

Recipients and processors

We use service providers who process on our behalf and on our instructions: Cloudflare, Supabase, RevenueCat, Resend, Brevo and Google with Firebase Cloud Messaging. Data processing agreements under Art. 28 GDPR are in place with them. Apple and Google act as controllers in their own right for app distribution, payment and sign-in, Apple also for its push service. For the support mailbox, see below.

• Website hosting: Cloudflare, Inc., USA. Cloudflare delivers this website and the pages for invitation links and the confirmation after sign-up (duett.nowabreathing.com).
• Database, account and syncing: Supabase, Inc. Supabase stores your account, your exercises, your Duets and your support requests and, if you allow measurement, usage statistics. Storage location: Zurich, Switzerland (region eu-central-2). Switzerland is covered by an adequacy decision of the European Commission. Supabase is based in the USA; where Supabase accesses data from there, we rely on the European Commission’s standard contractual clauses in our agreement with Supabase.
• Usage statistics: no external analytics service. The events are stored in our own database at Supabase. We do not collect crash reports.
• Sign-in: Apple (Sign in with Apple) and Google (Google Sign-In), only if you sign in with them. What they pass to us is listed above under “Account”.
• Purchase management: RevenueCat, Inc., USA. RevenueCat manages purchases and subscriptions for COMPLETE and Duet. RevenueCat receives the purchase receipts from Apple or Google and an identifier: a random one without an account, your account ID with an account. RevenueCat does not receive payment details or your email address. Our server checks with RevenueCat whether a purchase is valid and unlocks the trial week, the Duet bonus and redeemed codes there; RevenueCat notifies our server when a purchase changes.
• Duet notifications: Firebase Cloud Messaging by Google Ireland Ltd. and Apple’s push service deliver Duet notifications. A notification contains the Duet name of the other person. Data may be transferred to Google LLC and Apple Inc. in the USA in the process (see “Transfers to third countries”).
• Email delivery: Resend, Inc., USA. Resend sends the confirmation of your email address when you sign up with email, and your support request to us with a confirmation to you.
• Support mailbox: Gmail by Google Ireland Ltd. This is where we read and answer your request. Google is a controller in its own right for Gmail; we pass the emails there based on our legitimate interest in answering your request, Art. 6(1)(f) GDPR.
• Newsletter delivery: Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France — servers in the EU
• App distribution and payment: Apple Distribution International Ltd. and Google Ireland Ltd. — each a controller in its own right for the purchase

Transfers to third countries

We prefer providers with data centres in the EU. Where a transfer to a third country is necessary, for example to Cloudflare, RevenueCat and Resend in the USA and to Google and Apple, we base it on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses. Switzerland, where Supabase stores your data, is covered by an adequacy decision.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing carried out beforehand. An email to support@nowabreathing.com is enough; no form is needed. You can also delete your account and all data directly in the app.

Right to complain

You may lodge a complaint with a data protection authority. Ours is the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, 75334 Paris Cedex 07, France. You may equally contact the authority in your country of residence.

Website and cookies

This website sets no cookies for advertising or analytics. When you visit, our hosting provider Cloudflare processes technically necessary connection data such as IP address, time and page requested in order to deliver the website and protect it against attacks. If we record logs for troubleshooting, Cloudflare deletes them automatically after seven days at the latest. Fonts are served locally so that no data goes to third parties. The sign-up form only sends your email address to Brevo when you submit it; before that, no connection to Brevo is made.

Children

nowa is intended for people aged 16 and over. We do not knowingly collect data from children. If you believe a child has sent us data, write to us — we will delete it.

Changes

When features change we update this policy. We announce material changes in the app and, if you are subscribed, by email.