Privacy Policy

What we collect

Plan inputs: the times you enter (when you fell asleep, woke up and need to wake). They contain no name or contact details. We store them with the generated plan so it can be shown, shared by link and emailed.

Email address: only when you ask us to email your plan or join the 14-day reset waitlist. We keep the exact consent sentence you agreed to, the language and the time.

Account data: if you create an account, your email, name, a securely hashed password, language and time zone.

Usage events: first-party, aggregated events such as page views, plans generated and sign-ups, with the page language and campaign tags (utm). An anonymous visitor ID is only set if you accept analytics cookies.

Technical data: IP address and browser details in short-lived server logs, used for security and rate limiting.

Why we use it (legal bases)

To provide the service you ask for — building, showing and emailing your plan, running your account (contract or steps before a contract).

To send waitlist news and optional tips (your consent, which you can withdraw at any time).

To keep Owlback secure, prevent abuse and understand aggregated usage (legitimate interests).

To count unique visitors with a cookie (your consent).

AI features

The short explanation under your plan is written by Claude, an AI model from Anthropic. We send only the plan's times, steps and your language — never your email, name or account details. The times themselves are calculated by our own planner. We also use Claude to translate site content.

Who processes data for us

Hosting and database (Render), file storage (Cloudflare R2 or Amazon S3), email delivery (our SMTP provider) and AI text generation (Anthropic). They act on our instructions under data processing agreements. Where data leaves the EU/EEA, we rely on Standard Contractual Clauses or an adequacy decision.

The iOS and Android apps

The Owlback apps show the same pages as the website inside a native shell, so they process the same data described above and nothing more. They don't ask for your contacts, location, photos, microphone or health data, and they contain no advertising or third-party analytics software.

Notifications

If you allow notifications, we store a notification token for your device (issued by Apple or Google, or by your browser for web notifications) with the platform, app version, language and the date it was last used. We use it only to send the reminders of your own plan, at most 5 a day. Reminders are delivered through Apple Push Notification service or Firebase Cloud Messaging (Google), which receive the token and the reminder's text in order to deliver it.

A token is deleted when you turn reminders off, sign out in the app, delete your account, when Apple or Google tells us it is no longer valid, or after 12 months without use.

Home-screen widget

The widget shows the next step of your current plan. To do that the app keeps an access token in your phone's secure storage; the token can only read that next step. You can revoke it in Account → Disconnect devices, and it stops working when you delete your account.

Sign in with Apple or Google

If you sign in with Apple or Google, we receive your email address (with Apple's “Hide My Email”, a private relay address), your name the first time, and an identifier of your Apple or Google account. We never see your password there. For Apple we also keep an encrypted token whose only use is to revoke Owlback's access when you delete your account.

No advertising, no tracking

Owlback shows no ads. We don't use advertising identifiers, we don't sell or share your data for advertising, and we don't track you across other companies' apps or websites.

How long we keep it

Plans: 12 months. Emails for plans or the waitlist: until you unsubscribe or ask us to delete them. Accounts: until you delete them. Server logs: up to 30 days. Usage events: up to 24 months, then only aggregated totals.

Your rights

You can ask to access, correct, delete, restrict or export your data, object to processing based on legitimate interests, and withdraw consent at any time — every email has an unsubscribe link. Write to privacy@owlback.app. You can also complain to your data protection authority (in Romania, ANSPDCP).

Children

Owlback is not intended for children under 16, and we don't knowingly collect their data.

Changes

If we change this policy in a meaningful way, we'll update the date above and, where appropriate, let you know by email.