Privacy Policy — ResonanceGuide

1. Controller and scope

The controller is Amir Tairi, trading as Tremia, Götzstraße 5, 80809 München, Germany. Contact: support@tremia.app; telephone: +49 1590 2373878.

This policy covers the ResonanceGuide website pages, support communications, and ResonanceGuide builds for Android, iPhone and iPad, with Wear OS and Apple Watch companion features where provided. No data protection officer has been appointed; privacy requests can be sent directly to the controller.

2. Website access and language preference

When you visit tremia.app, Vercel, our hosting provider, processes technical request data such as your IP address, requested URL, time, browser and device information, referrer, and language headers. This enables page delivery, security, abuse prevention, and troubleshooting. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and reliable website.

Changing the website language stores the NEXT_LOCALE cookie for up to 12 months. It contains your language choice. This storage is necessary to remember the service you explicitly request, under § 25(2) no. 2 TDDDG; associated personal-data processing is based on Art. 6(1)(f) GDPR. You can remove the cookie in your browser.

This website does not embed advertising, analytics, or session-replay scripts. Fonts, icons, and other website images are served from this website. Following a link to a store or another external site brings you under that service’s privacy practices.

3. Email, support, and voluntary attachments

If you contact Tremia, we process your email address, name or alias, message, attachments, and communication times to answer you. Processing necessary for a contract or steps you request before a contract is based on Art. 6(1)(b) GDPR. Other enquiries are handled under Art. 6(1)(f) GDPR, in our legitimate interest in responding to users.

Do not send health readings, exported sessions, or diagnostic logs unless they are needed for your request. If a support enquiry requires health data, we will ask for your explicit consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR before using it for that purpose. Asking about the release does not subscribe you to a newsletter.

4. Data stored by the app

ResonanceGuide stores your settings, breathing-session records, notes, calibration results, and, when a suitable sensor is connected, heart rate samples, beat-to-beat intervals (RR intervals), and derived breathing-session metrics. The sources are your entries and the devices or health interfaces you choose to connect.

Session records, calibration results, and recorded RR intervals use encrypted local storage. The encryption key is kept in the device’s secure storage. Encryption does not extend to files you export or to diagnostic logs. Android app backup is disabled. Tremia does not provide account-based cloud backup or cloud synchronisation.

Processing ordinary settings necessary to supply requested features is based on Art. 6(1)(b) GDPR. Access to device storage that is strictly necessary for those features falls under § 25(2) no. 2 TDDDG.

5. Optional heart rate and breathing-session metrics

Heart rate readings, RR intervals, calibration results, and related metrics are health data. ResonanceGuide uses them for the breathing-session features you enable, such as live readings, session summaries, and resonance calibration. The legal basis for this optional health-data processing is explicit consent under Art. 9(2)(a), together with Art. 6(1)(a) GDPR.

A system permission is a technical permission and does not replace any additional consent required by law. You may disconnect a sensor, disable an optional integration, or revoke permissions in your device settings at any time. This stops the corresponding future processing; previously stored records remain until deleted. Withdrawal does not affect processing that was lawful before withdrawal.

Tremia does not receive these measurements on its servers or provide them to advertising services. Sensor-based functions require the relevant permissions and compatible hardware; using a watch for BPM readings does not provide the RR data required for calibration.

6. Bluetooth, watch companions, and background activity

ResonanceGuide uses Bluetooth to discover and connect to supported heart rate sensors. Android 11 and earlier may require location permission for Bluetooth scanning; ResonanceGuide uses that permission for device discovery, not to determine your location. Newer Android versions use nearby-device Bluetooth permissions.

The Wear OS and Apple Watch companions exchange breathing-session state, controls, and available heart rate readings with the paired phone through the platform’s device connectivity services. The watch companions require the phone. Apple Watch uses HealthKit to obtain heart rate during a breathing session; its temporary workout is discarded when the session ends.

On iPhone, an optional HealthKit source can read permitted heart rate samples. It does not supply the RR intervals needed for calibration. These readings are used for the requested session features and not for advertising.

On Android, a foreground service, notification, and wake lock support an ongoing session while the screen is off. The Android build also declares a phone-state permission; it does not read call contents, contacts, or phone numbers for breathing sessions. Permissions can be reviewed or revoked in system settings.

7. Optional health-platform export

Some pre-release builds contain an optional path for writing a completed breathing-session record to Health Connect on Android or Apple Health on iPhone. Availability depends on the build, device, and successful authorisation. This notice does not promise that health-platform export is available in every test build.

Where available and explicitly enabled with the required permissions, this path writes a guided-breathing session with its timing and duration. It does not export the app’s raw RR series through this path. Other apps may access records only under the permissions you grant in the health platform. Tremia does not receive a server copy.

Health-platform processing is based on Art. 9(2)(a) and Art. 6(1)(a) GDPR. Revoke access and manage any records already written in Health Connect or Apple Health; removing a record from ResonanceGuide does not necessarily remove a separate health-platform copy.

8. Advertising and privacy choices

The free app includes Google AdMob advertising, including optional rewarded ads where offered. Google’s advertising services may process IP addresses, device or advertising identifiers, approximate location inferred from IP, ad interactions, and diagnostic or performance data for advertising, measurement, fraud prevention, and service operation. Test builds may use test advertisements.

ResonanceGuide integrates Google’s User Messaging Platform (UMP) to request and manage advertising privacy choices. Where required, you can revisit Privacy Options in app settings. On iOS, App Tracking Transparency controls permission for cross-app tracking; it can also be changed in system settings. Declining tracking does not mean that an advertising SDK processes no technical data.

Non-essential storage or access on your device requires consent under § 25(1) TDDDG. Personal-data processing based on advertising consent relies on Art. 6(1)(a) GDPR. A choice of non-personalised advertising does not, by itself, remove a consent requirement. Your available choices and Google’s processing are explained in the consent interface and Google’s privacy information.

Tremia does not send breathing-session data, calibration results, heart rate readings, or RR intervals to Google AdMob. An optional Premium entitlement removes in-app ads; purchasing it does not erase data already processed by a store or advertising provider.

9. Store purchases and update checks

Where purchases are available, Google Play or the Apple App Store processes the purchase and payment under its own terms. ResonanceGuide uses purchase status and transaction information needed to recognise or restore your Premium entitlement. Tremia does not receive your payment-card details. The legal basis for providing the purchase you request is Art. 6(1)(b) GDPR; any legally required retention is based on Art. 6(1)(c) GDPR.

The iOS app can request public version information from Apple’s iTunes lookup service. The request contains the app identifier and storefront country, and Apple receives network information such as the requesting IP address. No breathing or heart rate data is included. The purpose is to inform you about app updates, based on Art. 6(1)(f) GDPR and our legitimate interest in keeping users informed of available updates.

10. Exports and diagnostics

When you choose to export a session, the app creates a file and opens the system sharing interface. The file can contain health data and is not protected by the app’s local database encryption. You choose the destination and any recipient. The recipient’s storage, retention, and privacy rules apply to the copy you share.

Debug builds can keep rotating diagnostic files on the device, limited to three files of approximately 5 MiB each. They can be cleared or shared manually. Tremia does not automatically upload these files and does not integrate its own analytics or crash-reporting service. Advertising SDK diagnostics and operating-system or store diagnostics remain separate.

11. Recipients and international processing

Recipients depend on the feature you use: Vercel for website hosting; our email service provider for correspondence; Google for advertising, consent management, Play purchases, and Wear OS services; Apple for App Store purchases, update checks, and Apple device services; and recipients you select when sharing an export. Apple and Google may act as independent controllers for their platform services.

These providers may process technical, advertising, purchase, or correspondence data outside the European Economic Area, including in the United States. Provider safeguards include applicable adequacy decisions, including the EU–US Data Privacy Framework for certified recipients, or the European Commission’s Standard Contractual Clauses where required. Vercel’s data processing terms and the providers’ privacy notices explain their transfer arrangements. You may contact us for information about safeguards relevant to your data.

The app’s local breathing and heart rate database is not uploaded to these providers by Tremia. A file you choose to share, or data you separately authorise in a health platform, is subject to that chosen route.

12. Retention and deletion

App session records, calibration results, and settings remain on your device until you delete them where controls are available or remove the app’s local data. Deleting a session also removes its stored RR samples. Removing all app data may require the operating system’s app-data controls or uninstalling the app. Separate exported files and health-platform copies must be removed separately.

Technical website records are retained for the period needed for delivery, troubleshooting, security investigations, and the hosting provider’s configured retention. The language cookie expires after up to 12 months. Diagnostic files rotate within the limits described above.

Support correspondence is retained until the request is resolved and longer only when necessary for follow-up, statutory retention, or the establishment or defence of legal claims. Where statutory retention applies, records are restricted to that purpose. Store operators and advertising providers determine retention for processing for which they are independently responsible.

13. Your choices and rights

Providing health data and contacting support are voluntary. Without a sensor or the relevant permissions, optional heart rate, calibration, or synchronisation features cannot work. Technical request data is necessary to deliver the website; transaction data is necessary to fulfil a purchase.

Subject to applicable conditions, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and portability (Art. 20). You may object under Art. 21 to processing based on legitimate interests, on grounds relating to your particular situation. You may withdraw consent at any time with future effect.

You may complain to a supervisory authority, including the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. Contact support@tremia.app to exercise rights concerning data held by Tremia. Tremia cannot remotely access or delete a database held only on your device.

Tremia does not use these records for automated decisions with legal or similarly significant effects under Art. 22 GDPR. Breathing-session metrics are informational feedback for general wellness, not a medical diagnosis.

14. Regional health-data rights and policy changes

Tremia does not sell your breathing-session or heart rate records or use them for targeted advertising. Where applicable local law gives additional rights over consumer health data, including access, deletion, withdrawal of consent, or an appeal of a privacy decision, you can make a request through the contact below. We assess requests under the law that applies to you and do not charge for ordinary rights requests where the law prohibits a fee.

If you believe that a child has sent personal data to Tremia without the required authorisation, contact us so that we can investigate and delete it where required. Consent and contractual-capacity requirements under applicable law continue to apply.

We will update this policy when the release, data processing, or legal requirements change. A revised policy does not itself supply consent for new processing that requires it.

Provider privacy information

• Vercel — Privacy Notice
• Vercel — Data Processing Addendum
• Google — Privacy Policy
• Apple — Privacy Policy