Slowfall
Effective 21 August 2026 Version 1.0 Applies to the Slowfall app for iPhone and iPad
Slowfall is a sleep app. People use it at two in the morning, and they write things in it they would not say out loud. That is the whole reason it was built the way it was: there is no account to make, and the things you write are never sent anywhere. This policy explains that in full, including the few places where data does leave your device, and why.
This summary is here to be read. The sections below are the binding version, and they say the same thing at greater length.
Slowfall is made and published by the holder of the Slowfall developer account on the Apple App Store, an individual developer, referred to in this policy as “we” or “us”. The seller of record is named on the app’s App Store listing. For the purposes of the General Data Protection Regulation (GDPR), we are the data controller for the limited processing described below.
You can reach us about anything in this document at mohammedezrouil@gmail.com. Write in English, French or Arabic. We aim to answer privacy questions within 30 days, which is the deadline the GDPR sets and a reasonable one to hold us to regardless of where you live.
Almost everything Slowfall knows about you is stored in the app’s own private storage on your iPhone or iPad — in the app sandbox that iOS gives every app and that no other app can read. It is not uploaded, not mirrored to a server, and not visible to us.
| What | Why it exists |
|---|---|
| Onboarding answers | Which of four sleep struggles you picked, roughly how long you take to fall asleep, and the bedtime you set. These shape the plan the app builds for you. |
| Morning check-ins | One row per night: the date, roughly how many minutes you took to fall asleep, and how rested you felt. This is the only place an outcome is recorded, and it is what the Progress screen draws its trend from. |
| Night pages | Whatever you type or dictate onto a page, and when you wrote it. This is the most personal thing in the app and it is treated accordingly: it is written to a local database and it is never read by us, never backed up by us, and never sent over the network. |
| Progress counters | Nights recorded, wind-downs completed, pages written, longest run. Plain numbers, kept so the Progress screen has something to show. |
| Preferences | Your chosen session length, whether you allowed notifications, and a cached copy of the sound library so the app opens without waiting for the network. |
| Product-usage events | A rolling buffer of the most recent 200 events — “paywall viewed”, “wind-down finished”, and similar. They record what happened in the app, never what you wrote. As of this version they are not sent anywhere; they sit on the device and are overwritten as new ones arrive. If that ever changes, this policy changes first. |
One honest caveat: if you have iCloud Backup or encrypted device backups switched on, iOS may include Slowfall’s local data in your backup, the same as it does for your other apps. That backup belongs to you and is governed by Apple’s privacy policy, not ours. We never see it, and you can exclude it in the iOS Settings app under your name → iCloud → Manage Account Storage.
Four things reach the outside world. Here is every one of them.
Every purchase in Slowfall is made through Apple’s In-App Purchase system. Apple handles the payment, holds your billing details, and tells the app whether you have an active subscription. We never see your card, your name, or your Apple Account email. Apple’s handling of that data is governed by the Apple Privacy Policy.
We use RevenueCat, a subscription-management service, so that a subscription bought on your iPhone is recognised on your iPad and survives reinstalling the app. RevenueCat receives:
We flag that last item explicitly because it is the one thing in Slowfall that would otherwise surprise you. If you would rather it were not sent, tell us and we will delete the attribute for your identifier. RevenueCat’s own handling is governed by the RevenueCat Privacy Policy.
Slowfall’s sound library and the list describing it are hosted on Cloudinary, a content delivery network, and fetched over HTTPS when you open the app or pull to refresh. Like any web server, it necessarily sees your IP address, the file you asked for, and your device’s user agent. It receives no identifier from us, no account, and nothing about what you do inside the app.
If you use the microphone button on a night page, Apple’s speech recognition converts what you say into text. Where your device and language support it, this happens entirely on the device. Where they do not, iOS sends the audio to Apple’s servers to transcribe, which is Apple’s standard behaviour for this feature and is described in Apple’s privacy policy. In both cases Slowfall itself keeps only the finished text, on the device. We do not record audio, we do not store audio, and we never upload audio ourselves.
Not present in this app
Slowfall contains no advertising network, no analytics vendor, no crash-reporting service, no social login, no tracking pixel, and no Identifier for Advertisers (IDFA). We do not ask for App Tracking Transparency permission because we have nothing to track you with. We do not sell personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.
Slowfall asks for three permissions, all optional, each at the moment it is first needed rather than at launch. Declining any of them leaves the rest of the app working.
| Permission | What it is for, and what happens if you refuse |
|---|---|
| Microphone | Used only while you are actively dictating a night page. Audio becomes text as you speak and is never recorded or stored. Refuse it and you can still write pages by typing. |
| Speech Recognition | Lets iOS turn that audio into text, as described in section 3. Refuse it and dictation is unavailable; nothing else changes. |
| Notifications | Two scheduled daily reminders — one before your chosen bedtime, one in the morning for the check-in. They are generated on your device by iOS. There is no push server, so no notification content ever travels over a network, and we cannot send you anything you did not schedule. Refuse it and the app simply does not remind you. |
For the avoidance of doubt, Slowfall does not collect or ask for your name, email address, phone number, postal address, date of birth, contacts, photos, calendar, location, or any data from Apple Health or HealthKit. The app requests none of those permissions, and the code to use them does not exist.
Slowfall is intended for people aged 16 and over and is not directed at children. We do not knowingly collect personal information from children under 13 (or under 16 in the European Economic Area and the United Kingdom). Because the app has no account system, we have no practical way to identify a user’s age. If you believe a child has been using Slowfall and you would like the app’s data removed, deleting the app removes all of it immediately; you are also welcome to write to us.
Depending on where you live, you have rights over your personal data — to know what is held, to correct it, to have it erased, to receive a copy, to object to or restrict processing, and to withdraw consent. These are guaranteed under the GDPR in the European Economic Area and the United Kingdom, and under the California Consumer Privacy Act as amended by the CPRA, among other laws.
Slowfall’s design means most of these rights are exercised without asking anyone’s permission:
For the small amount of data held by RevenueCat — the anonymous identifier, the purchase record, and the onboarding attribute described in section 3 — write to us at mohammedezrouil@gmail.com and we will action an access or deletion request. Please include the approximate date of purchase so we can locate the right record; we hold no other way to identify you. Note that Apple requires purchase records to be retained for tax, accounting and refund purposes, so a deletion request may not be able to remove the transaction itself.
If you are in the EEA or the UK and you are not satisfied with how we have handled a request, you have the right to complain to your national data protection supervisory authority.
Where the GDPR applies, we rely on the following legal bases:
Data on your device is kept until you delete the entry, delete the app, or reset the app’s data — there is no expiry we impose and no copy we retain afterwards. The product-usage buffer described in section 2 keeps only the most recent 200 events and discards older ones automatically. Purchase records held by Apple and RevenueCat are retained for as long as those companies require for billing, tax and audit purposes, under their own policies.
Apple, RevenueCat and Cloudinary are established in the United States and may process the limited data described in section 3 there or in other countries. Where data is transferred out of the European Economic Area or the United Kingdom, those transfers rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision, as set out in each provider’s own data processing terms.
Your data sits inside the iOS application sandbox and inherits the device encryption that iOS applies when you have a passcode set — which is the strongest protection available to any app on the platform, and a good reason to set one. Every network request Slowfall makes uses HTTPS; the app is configured to refuse insecure connections outright. No system is perfectly secure, but the surface here is deliberately small: the most sensitive thing in the app, what you write, never travels.
If we change what data leaves your device, we will update this policy and change the version and effective date at the top before the change ships. Material changes will also be flagged inside the app. Continuing to use Slowfall after an update means you accept the revised policy; if you do not, deleting the app removes your data.
The developer of Slowfall
mohammedezrouil@gmail.com
Questions, deletion requests, and complaints all go to the same place, and a real person reads them.
Slowfall Privacy Policy · Version 1.0 · Effective 21 August 2026