Privacy policy

1. Who is responsible for your information

Rest+Rise is operated by Tom Murton in the United Kingdom. Tom Murton is the controller of personal information described in this policy. Questions and privacy requests can be sent to support@restrise.health.

2. Information we collect

Account information

When you create or access an account, we may process your email address, display name, authentication-provider identifier, user identifier and sign-in records.

Routine and wellbeing information

We process the goals, routines, ritual choices, completion history, session duration and optional pre- or post-session mood, energy and calm ratings you enter. This is general wellness information. Please do not enter medical records or other information you do not want processed by the service.

Subscription information

We receive information needed to recognise and manage Insights access, such as product, entitlement, renewal and purchase-history status. Apple and Google process your payment-card details; Rest+Rise does not receive your complete card details.

Device, usage and diagnostic information

We may collect app interactions, installation and attribution information, device and operating-system details, app version, approximate location derived from IP address, advertising or device identifiers where permitted, crash reports and technical logs.

Website information

Our hosting provider may process IP address, browser and device details, requested pages, timestamps and security logs when you use this website. The website does not currently use non-essential advertising cookies. We count page requests and store-link redirects using registered campaign labels and send these limited events to PostHog in the EU. We do not send your IP address, full URL or browser details, and do not use cookies, browser storage or a persistent visitor identifier for this measurement. Counts describe requests rather than unique people. We honour Global Privacy Control and Do Not Track signals for these events.

Messages to us

If you contact support, we process your contact details, message and any information you choose to include.

3. How we use information

• Provide sign-in, syncing, routines and session history.
• Operate Insights, including Sunday Briefs, ritual patterns and suggestions.
• Confirm purchases and maintain subscription access.
• Diagnose crashes, protect accounts, prevent abuse and maintain the service.
• Understand product use, measure app acquisition and improve Rest+Rise.
• Respond to requests and meet legal obligations.

4. Insights and Google Gemini

For Insights subscribers with enough completed sessions, Rest+Rise creates a structured summary from recent session context, goals, completion patterns, ritual titles and optional ratings. That derived summary is sent to Google's Gemini service to generate Sunday Brief wording. We do not intentionally include your name, email address or direct account identifier in that prompt.

The generated result and underlying signals may be stored with your Rest+Rise account. AI output can be inaccurate and is provided as a general wellness reflection, not medical advice.

5. Our legal bases

Under UK data-protection law, we rely on the following bases as applicable:

• Contract: to provide the app, account, purchased features and support you request.
• Legitimate interests: to secure, maintain, diagnose and improve Rest+Rise, measure broad product performance and prevent misuse, balanced against your rights.
• Consent: where required for device tracking, attribution or similar technologies. You can withdraw consent through device settings where available.
• Legal obligation: where we must keep or disclose information to comply with law.

6. Service providers and sharing

We do not sell your personal information. We use service providers that process information for the purposes described above:

• Supabase — authentication, database, storage and backend functions.
• PostHog EU Cloud — bounded product-event analytics, including random installation and account identifiers, app version, platform, campaign attribution and interactions with product journeys. We do not send names, email addresses, user-entered text or screen recordings to PostHog.
• Google Firebase — crash reporting.
• AppsFlyer — app-install attribution and campaign measurement, subject to platform permissions.
• RevenueCat — subscription status, entitlements and purchase-history processing.
• Google Gemini — generation of Insights wording from derived session information.
• Apple and Google Play — app distribution, purchases, refunds and subscription management.
• Cloudflare — website hosting, delivery and security logs.

We may also disclose information if required by law, to protect rights or safety, or as part of a genuine business reorganisation.

7. International transfers

Some providers process information outside the United Kingdom. Where UK data-protection law requires it, we rely on adequacy regulations, approved contractual safeguards or another lawful transfer mechanism. Provider privacy notices explain their processing locations in more detail.

8. Retention

Account and routine information is generally retained while your account is active. When you delete your account, Rest+Rise deletes the account and associated app data from its active database. Limited backups, security logs, store transaction records and processor records may remain for their normal retention periods or where required by law. Support messages are kept only as long as reasonably needed to resolve the request and maintain appropriate records.

9. Security

We use reasonable technical and organisational safeguards, including encrypted network connections and access controls. No internet service is completely secure, so we cannot guarantee absolute security.

10. Your rights

Depending on the circumstances, UK law may give you rights to access, correct, erase, restrict or object to processing of your personal information, and to receive certain information in a portable form. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Send a request to support@restrise.health. We may need to verify your identity. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

11. Children

Rest+Rise is not intended to collect personal information from children without the permission required by applicable law. If you believe a child has provided information inappropriately, contact us so we can investigate and delete it where required.

12. Changes to this policy

We may update this policy as the product or law changes. We will post the revised version here and change the date above. We will provide additional notice where a change materially affects your rights.