Privacy

Last updated 26 September 2026.

Wind Down Daily is operated by CARDIGITAL - FZCO, Dubai, United Arab Emirates (“we”). This page says what we collect, why, where it sits, and how to get rid of it. It is written to be read, not to be skipped.

What we collect

Your email address, only if you give us one. The app works without it. When you start, the account is made on your phone and carries no address, no name and no password. You can add an address later, in Settings, and the only thing it buys you is getting the same account back on a new phone. We sign you in with a code sent to that address. We never store a password because there is not one.
Four numbers an evening, if you turn them on. How tense you are, how busy your head is, how much energy you have and how you slept last night, each on a scale of one to five. This is what picks that same evening’s practice. Nothing else about your day is collected, and if you leave them off we do not store them at all.
Last night’s sleep from your phone, if you switch that on. Offered only to someone who already turned the evening numbers on, and only on a phone that has Apple Health or Health Connect. We read sleep and nothing else: not steps, not heart rate, not workouts, not anything a watch records besides the night. What we keep is the one to five score we work out from it. The minutes themselves stay on your phone. The score is used for the same single purpose as the taps, which is choosing tonight’s practice. We never write anything back to Health, we never put this data in iCloud, and it is never used for advertising, never sold and never shared. You can switch it off in Settings and go back to tapping, and you can revoke the permission in the phone’s own health settings at any time.
Your first name, if you give one, your time zone, and whether you chose the male or the female voice.
Which practices you started and finished, and when.
A push notification token, if you turn reminders on, and the reminder time you chose.
A short record of how the app is used, with no answers in it. What it holds and what it never holds is in the next section.
Crash and performance data, through the stores. We do not put any crash reporting into the app ourselves. Apple and Google collect this from your device under their own rules and show it to us in aggregate: app version, operating system version, device model, approximate region, and what the app was doing when it stopped.
Whether you have an active subscription. Apple and Google handle the payment. We never see your card. We only receive a yes or no on whether the purchase is active, through RevenueCat.

How the app is used

To learn which of our ads bring people who find Wind Down Daily useful, the app sends our own server a short record of how it is used:

which screens were opened, and steps such as picking a voice, finishing the evening questions, starting or finishing a practice, opening the plans, starting a trial or buying,
rough counts, such as which day of your run it is and how far into a practice you got, in quarters,
a random ID created when the app is first opened, your account’s random ID once you have one (the one RevenueCat uses, so a purchase can be matched to the record), the app version, the phone model, the operating system version, the language and the time zone.

The record never includes your answers to the evening or the night questions, your sleep, how you feel, which practice was picked for you, anything you type, your name or your email address. We do not sell it or share it with advertisers. It sits apart from your account, and we keep it only as long as we need it to compare our ads.

On an iPhone the app also tells Apple how far it got, for example that a trial started or that a practice was finished, through Apple’s SKAdNetwork. Apple passes this on to the ad network that showed our ad, without saying who you are or which device it came from.

If you installed the app after tapping one of our ads in the App Store, the app passes Apple’s attribution token to RevenueCat and to our server, which ask Apple which ad campaign led to the install. Apple’s answer names the campaign, not you, and we use it only to see which ads work. The app does not use Apple’s or Google’s advertising identifier, and it does not track you across other companies’ apps or websites.

What we do not collect

No diagnosis, no medication, no medical history, no free-text notes, no voice recordings, no contacts, no precise location, no advertising identifier used to build a profile of you. We do not ask, and there is nowhere in the app to enter it.

Sensitive data and your consent

The three daily numbers are about how you feel. Under European and UK data protection law that can count as data concerning health, which needs your explicit consent. So the app asks for it plainly, in its own step, before you log anything. Saying no is a real option on that screen. The app still works, you get the same practices in a fixed order instead of one picked for your evening, and nothing about how you feel is stored. You can turn it on later, or withdraw it later, in Settings. Withdrawing deletes the numbers you have logged and leaves your account alone.

Why we are allowed to hold it

To run the thing you signed up for (performance of a contract): your email if you added one, your subscription status, which practices you did.
Your explicit consent: the four numbers an evening, if you turned them on.
Your consent, separately: push notifications.
Our legitimate interest in the app not crashing: the aggregate crash and performance data the stores show us.
Our legitimate interest in knowing which of our ads work: the usage record and Apple’s answer about the ad.

Where it is stored and who else touches it

Supabase (database, sign-in, the email carrying your sign-in code, and, in a separate database, the usage record), on servers in the European Union, Frankfurt region.
RevenueCat (subscription status only).
Apple and Google (the payment itself, and push delivery, and on an iPhone the ad attribution described above). We never receive your payment details from them.

That is the whole list. We do not sell data, we do not share it with advertisers, and we do not run third-party advertising inside the app.

How long we keep it

While your account exists. When you delete it from Settings, your three numbers and your practice history are deleted straight away, in that moment, not queued for later. The account itself is deleted in the same moment, and it clears from backups within ninety days. Anonymous, aggregate counts that cannot be traced back to you may be kept.

The usage record sits apart from your account, so deleting the account does not reach it. It holds no answers, no name and no email. If you want it gone as well, write to us before you delete the account, while we can still find it, and we remove it too.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, withdraw consent, or object to what we are doing with it. Write to privacy@winddowndaily.com and we will answer within thirty days. The fastest route to deletion is this page or Settings inside the app, which does it without waiting for us.

If you are in the European Union or the United Kingdom and you think we have handled your data badly, you can complain to your national data protection authority.

Children

Wind Down Daily is for adults. It is not intended for anyone under 16, we do not knowingly collect data from anyone under 16, and if we learn that we have, we delete it.

Changes

If we change this page in a way that matters, we will say so in the app before the change takes effect, and the date at the top will move.