Privacy Policy for SoulSpace – Sleep & Meditation

Our privacy policy was last updated on November 3rd, 2026. 
See previous versions here.

This Privacy Policy explains how personal data is processed when you use SoulSpace – Sleep & Meditation (the “App”) on iPhone and iPad. It is written specifically for SoulSpace and supplements the general Appvestor Privacy Policy at legal.appvestor.com/privacy-policy/. Where the two differ, this policy applies to SoulSpace.

1. Who we are

The data controller is:

Appvestor ApS
Gladsaxevej 342
2860 Søborg
Denmark

Privacy questions and requests:privacy@appvestor.com
Data Protection Officer: John Lisek, dpo@appvestor.com

2. Summary

• You do not create an account, and we do not ask for your name, email address or phone number.
• The App signs you in with an anonymous ID so your chat history and purchases work across launches.
• Messages you write to the SoulSpace AI chat are sent to OpenAI to generate a reply, and stored in our database so you can see your history.
• The App shows ads from Google AdMob to users without a subscription. Personalised ads and cross-app tracking only happen if you allow them in the consent screens and the iOS tracking prompt.
• We do not sell your personal data. We do not access your contacts, photos, microphone, camera or precise location.

3. What data we process, and why

3.1 Anonymous user ID

When you first open the App, Google Firebase Authentication creates a random, anonymous user ID for your installation.

• Purpose: to keep your chat history and your purchase status tied to your installation.
• Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• Linked to you: yes, to your installation. It is not linked to your name or email.

3.2 AI chat messages

When you use the SoulSpace AI chat, the text you type, and the replies, are processed as follows:

• Your message and recent conversation history are sent to OpenAI (OpenAI, L.L.C., USA) through its API to generate the reply. According to OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models by default, and may be retained by OpenAI for up to 30 days for abuse monitoring.
• Your conversations are stored in Google Firebase Realtime Database (servers in the EU, region europe-west1) under your anonymous user ID, so you can return to them.
• Purpose: to provide the chat feature.
• Legal basis: performance of our contract with you (Art. 6(1)(b)).

Please do not share sensitive information in the chat, such as health conditions, religious beliefs or details about other people. The chat offers general mindfulness and relaxation guidance; it is not medical, psychological or crisis support. If you do choose to share sensitive information, it is processed only to answer you, on the basis of your explicit choice to share it (Art. 9(2)(a)).

3.3 Purchases and subscriptions

Payments are handled entirely by Apple. We never see your card details. We receive information about which subscription or purchase you have, its status and dates, through:

• Apphud (Apphud Inc.), which tells the App whether you have premium access and lets you restore purchases.
• Appvestor Billing SDK (our own), which records purchase events for revenue reporting.
• Purpose: to unlock premium features, restore purchases, process refund requests and understand revenue.
• Legal basis: performance of contract (Art. 6(1)(b)) and our legitimate interest in revenue reporting (Art. 6(1)(f)).

3.4 Advertising

Users without a subscription see banner ads from Google AdMob (Google Ireland Limited). AdMob may process:

• your device’s advertising identifier (IDFA), only if you allow tracking in the iOS App Tracking Transparency prompt;
• an approximate (coarse) location derived from your IP address;
• information about the ads you see and interact with, and basic device and performance data.

Purpose: to show, measure and, where you have consented, personalise ads, which fund the free version of the App.

Legal basis: your consent (Art. 6(1)(a)), collected through Google’s consent form in the EEA, UK and Switzerland, and the iOS tracking prompt. Where you do not consent, AdMob shows non-personalised ads.

Ad performance events (for example “an ad was shown”) are also recorded by the Appvestor Stats SDK for our own reporting. These events do not contain your chat content.

3.5 Analytics and app stability

• Google Firebase Analytics records how the App is used (for example which screens are opened), to help us improve it.
• Google Firebase Crashlytics collects crash reports and diagnostic data, to fix bugs.
• Google Firebase Remote Config delivers settings to the App (for example which paywall to show).
• Google Firebase App Check verifies, using Apple’s App Attest, that requests come from a genuine copy of the App, to protect our services from abuse.

Legal basis: consent where required for analytics (Art. 6(1)(a)); otherwise our legitimate interest in a secure, working app (Art. 6(1)(f)). Crash and diagnostic data is not linked to your identity.

3.6 Consent records

The App stores your consent choices on your device: Google’s consent string (IAB TCF) for EEA/UK users, and, for US users, your state of residence and your “do not sell or share” choice.

3.7 Notifications

The App asks for permission to show notifications. We do not currently send marketing push notifications, and the permission does not give us access to any of your data.

3.8 Support requests

If you email us, we process your email address and the content of your message to answer you (Art. 6(1)(b) or (f)).

4. Who we share data with

We do not sell personal data. For California and other US state privacy laws, sharing the advertising ID with AdMob for personalised ads may count as “sharing” or “targeted advertising”; you can opt out as described in section 7.

5. International transfers

Our database is hosted in the EU. Some providers (OpenAI, Google, Apphud) may process data in the United States or other countries. Such transfers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, with Transfer Impact Assessments where required.

6. How long we keep data

• Chat history: until you ask us to delete it, or 24 months after your last use of the chat, whichever comes first.
• Purchase records: as long as needed for your subscription and as required by accounting law.
• Analytics data: up to 14 months (Google Analytics default); crash reports up to 90 days.
• Ad data: according to Google’s retention policies.
• Anonymised, aggregated statistics may be kept longer.

Deleting the App removes data stored on your device, but not data stored on our servers. To delete that, see section 7.

7. Your rights and choices

Depending on where you live, you have the right to access, correct, delete, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time.

• Delete your data: email privacy@appvestor.com with your Firebase ID. You can find it in the App under Settings → List Identifiers. We will delete your chat history and anonymous account.
• Ad consent (EEA, UK, Switzerland): open Settings → Manage Consent to change your choices at any time.
• US residents (“Do not sell or share my data”): open Settings → Manage Consent, choose your state and turn on the opt-out. This enables restricted data processing for ads and switches off ad personalisation.
• Tracking: you can change the tracking permission at any time in iOS Settings → Privacy & Security → Tracking.
• Complaints: you can complain to the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk) or your local authority.

We respond to requests within one month (GDPR) or 45 days (US state laws). We will not discriminate against you for exercising your rights.

8. Children

SoulSpace is not intended for children. It is not directed at anyone under the age of 13, and we do not knowingly collect data from children. If you believe a child has used the App, contact us and we will delete the data.

9. Security

Data is encrypted in transit. Access to our database is restricted so that each anonymous user can only read and write their own chat history. App Check limits access to our backend to genuine copies of the App.

10. Changes to this policy

We may update this policy when the App changes. The “Last updated” date shows the latest version. Material changes will be highlighted in the App or on the App Store page.

11. Contact

Appvestor ApS, Gladsaxevej 342, 2860 Søborg, Denmark
privacy@appvestor.com · DPO: dpo@appvestor.com