Privacy Policy
Last updated: February 11, 2026
ApneaStatic ("we", "us", or "our") operates the ApneaStatic mobile application and web application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Ley Orgánica de Protección de Datos y garantía de los derechos digitales (LOPDGDD), and other applicable data protection laws.
By using ApneaStatic, you agree to the collection and use of information in accordance with this policy.
1. Data Controller
The data controller responsible for your personal data is:
- Entity: ApneaStatic
- Contact Email: info@apneastatic.com
- Country: Spain (European Union)
You may contact us at any time regarding your personal data by emailing info@apneastatic.com.
2. Information We Collect
2.1 Information You Provide Voluntarily
| Data Category | Specific Data | Legal Basis (Art. 6 GDPR) | Purpose |
|---|---|---|---|
| User Profile | Name, experience level, personal goals, personal best records | Consent (Art. 6(1)(a)) | Personalise your training experience |
| Training Data | Training history, custom tables, session ratings | Contract (Art. 6(1)(b)) | Provide the core Service functionality |
| App Settings | Language, voice, layout, music preferences | Contract (Art. 6(1)(b)) | Configure the Service to your preferences |
| Google Account | Name, email, profile picture (via Google Sign-In) | Consent (Art. 6(1)(a)) | Enable authentication and cloud backup |
2.2 Information Collected Automatically via Third Parties
| Data Category | Specific Data | Legal Basis (Art. 6 GDPR) | Purpose |
|---|---|---|---|
| Advertising Data | Device identifiers, ad interaction data | Consent (Art. 6(1)(a)) | Display ads in the free version (Google AdMob) |
| Purchase Data | Subscription status, anonymous user ID | Contract (Art. 6(1)(b)) | Manage premium subscription (RevenueCat) |
| Technical Data | Device type, OS version, app version | Legitimate Interest (Art. 6(1)(f)) | Ensure compatibility and debug issues |
2.3 Information We Do NOT Collect
- We do not collect your location data.
- We do not access your camera or microphone.
- We do not access your contacts, SMS, or phone call data.
- We do not track you across other apps or websites.
- We do not process special categories of personal data (Art. 9 GDPR) such as health data. Breath-hold training times are considered performance data, not medical data.
3. How Your Data Is Stored
3.1 Local Storage (Primary)
All your training data, settings, and profile information are stored locally on your device using Capacitor Preferences (key-value storage). This data never leaves your device unless you explicitly choose to back it up to Google Drive. We operate a local-first architecture with no backend servers.
3.2 Cloud Backup (Optional, Consent-Based)
If you sign in with Google and enable cloud backup, your data is uploaded to your own Google Drive account in a private application data folder. We do not have access to your Google Drive. The backup includes:
- Training history
- Custom training tables
- App settings
- User profile data
You can disable auto-backup at any time in the Profile section. You can withdraw consent and delete your backup data by removing the ApneaStatic file from your Google Drive.
3.3 Web App Storage
When using the web version, all data is stored in your browser's local storage. No data is sent to our servers.
4. Third-Party Data Processors
We use the following third-party services (data processors under Art. 28 GDPR) that may process data on our behalf:
| Processor | Purpose | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (AdMob) | Advertising (free version) | Device identifiers, ad interactions | USA | EU-US Data Privacy Framework; Privacy Policy |
| Google LLC (Sign-In/Drive) | Authentication & backup | Name, email, profile photo, app data | USA | EU-US Data Privacy Framework; Privacy Policy |
| RevenueCat Inc. | Subscription management | Purchase status, anonymous user ID | USA | Standard Contractual Clauses; Privacy Policy |
| Google LLC (Firebase) | App hosting infrastructure | Anonymous usage data | USA | EU-US Data Privacy Framework; Privacy Policy |
5. International Data Transfers
Some of our third-party processors are located in the United States. These transfers are protected by:
- EU-US Data Privacy Framework (DPF): Google LLC is certified under the DPF.
- Standard Contractual Clauses (SCCs): Where the DPF does not apply, we rely on European Commission-approved SCCs (Art. 46(2)(c) GDPR).
We ensure that any international transfer of personal data complies with Chapter V of the GDPR.
6. Data Retention
| Data | Retention Period | Deletion Method |
|---|---|---|
| Local app data | Until you delete it or uninstall the app | Clear app data or uninstall |
| Cloud backup (Google Drive) | Until you delete it from your Drive | Delete from Google Drive |
| Google Sign-In token | Until you sign out | Sign out in Profile section |
| AdMob data | Per Google's retention policy | Reset advertising ID on your device |
| RevenueCat subscription | Per RevenueCat's retention policy | Contact RevenueCat or us |
We do not maintain copies of your data on any servers we control. We apply the principle of data minimisation (Art. 5(1)(c) GDPR) — we only process data that is strictly necessary for the Service.
7. Your Rights Under GDPR (Articles 15-22)
As a data subject, you have the following rights. You may exercise them at any time by contacting info@apneastatic.com:
| Right | Description | How to Exercise |
|---|---|---|
| Access (Art. 15) | Obtain a copy of all personal data we process | View data in-app; request full export via email |
| Rectification (Art. 16) | Correct inaccurate personal data | Edit your profile and settings in the app |
| Erasure (Art. 17) | Request deletion of your personal data | Clear app data, uninstall, delete Drive backup, or email us |
| Restriction (Art. 18) | Restrict processing of your data | Contact us via email |
| Data Portability (Art. 20) | Receive your data in a structured, machine-readable format (JSON) | Use the Data Manager export in the app |
| Object (Art. 21) | Object to processing based on legitimate interest | Contact us via email |
| Withdraw Consent (Art. 7(3)) | Withdraw consent for optional processing at any time | Sign out of Google, disable auto-backup, change ad preferences |
| Automated Decisions (Art. 22) | Not be subject to solely automated decision-making | We do not perform automated profiling or decision-making |
We will respond to your request within 30 days (Art. 12(3) GDPR). If we cannot fulfil your request, we will explain why.
Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority:
- Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es
- EU: You may also contact the supervisory authority in your EU member state of residence.
8. Consent for Advertising (EU/EEA)
If you are located in the European Economic Area (EEA), the UK, or Switzerland:
- You will be presented with a consent dialog (compliant with the IAB Transparency and Consent Framework) before any personalised advertising.
- You may choose to see non-personalised ads or withdraw your consent at any time.
- Without your consent, we will only display contextual, non-personalised advertisements.
- Ad consent preferences can be changed within the app settings.
9. Children's Privacy
ApneaStatic is not intended for use by children under the age of 16 (or the minimum age specified by the applicable legislation in your jurisdiction). We do not knowingly collect personal data from children. If we discover that we have collected personal data from a child without appropriate parental consent, we will promptly delete it. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@apneastatic.com.
10. Cookies and Tracking Technologies
The ApneaStatic mobile app does not use cookies. The web application uses browser local storage (not cookies) to persist your training data and settings. This local storage is essential for the Service to function and is not used for tracking.
Third-party services (Google AdMob) may use their own tracking technologies in the mobile app, subject to your consent as described in Section 8.
11. Data Protection by Design and Default
In accordance with Article 25 GDPR, we implement data protection principles by design:
- Local-first storage: Data stays on your device by default.
- Minimal data collection: We only process what is necessary for the Service.
- No tracking: No analytics, no cross-app tracking, no behavioural profiling.
- Opt-in only: Cloud backup and Google Sign-In are strictly optional.
- Encryption in transit: All third-party communications use TLS encryption.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or for legal, regulatory, or operational reasons. We will:
- Update the "Last updated" date at the top.
- Notify users of material changes through the app or via email (if available).
- Where required by law, seek renewed consent for material changes to data processing.
13. Contact Us
For any questions, requests, or concerns regarding this Privacy Policy or your personal data, please contact us:
Email: info@apneastatic.com
We aim to respond to all data protection inquiries within 30 days.