Privacy Policy

01

Introduction

This Privacy Policy describes the practices of Rhythm Innovations, Inc. (“we,” “us,” or “our”) in connection with the Rhythm Light mobile application (the “App”). The App measures how much daylight you actually get — from your Apple Watch, or from your iPhone’s camera used as a light meter — and turns it into a daily Light Score. It can also control a Rhythm Light Machine over your Wi-Fi network. This policy explains what personal information we collect, why, how long we keep it, and the rights you have over it.

02

Notice at Collection: Personal Information We Collect

What we do not collect

• Your light’s routines or your Wi-Fi password. The App controls a Rhythm Light Machine directly over your own network. The times of its routines and alarms, and the Wi-Fi password you give it during setup, are not sent to us, as described in Section 10.
• Your phone use from Screen Time. If you connect Screen Time, your phone use is shown in a report that iOS keeps to itself. The App cannot read it, and we receive no information about which apps you use or for how long, as described in Section 11.
• An advertising identifier. There is no advertising SDK in the App and no App Tracking Transparency prompt, because there is nothing to track you with.
• Health data, location, Wi-Fi names, phone use or photos in usage records. The App usage and diagnostics described above never include Apple Health readings, light measurements, your location, the names or passwords of your Wi-Fi networks, your phone use from Screen Time, or your photos, and we have configured PostHog not to use your IP address to determine where you are.
• Your email address, your contacts, your photo library, or a precise stored location. The App can look at photos on your device to suggest a sunset, as described in Section 12, but none are sent to us.

03

Notice at Collection: Purposes for Collection

We collect the categories above to:

• Calculate and display your Light Score, your daily light and your history;
• Anchor your day to your own local sunrise, solar noon and sunset;
• Show the weather where you are;
• Send you a daily reminder, if you turn notifications on;
• Sign you in and keep your account secure, including limiting the rate of sign-in attempts;
• Operate, maintain, secure and improve the App;
• Understand which features of the App are used and diagnose crashes, so that we can improve it;
• Respond to support requests and other communications;
• Tell you about the Rhythm Light Machine;
• Comply with legal obligations and enforce our terms.

Health data is used only to produce your own score and history, and to show it back to you. We do not use health data for advertising or marketing, and we do not sell it or disclose it to third parties for their own purposes.

04

Notice at Collection: Retention Periods

We retain each category of personal information described in Section 2 for as long as necessary to provide the App, operate and secure our systems, and meet our legal and legitimate business needs — and no longer. Where we are not able to state an exact period for a category, we determine how long to keep it using criteria such as: how long your account stays active, how long a record is needed to keep the App and its users secure, and how long we are required to keep it by law.

When you delete your account — from the account sheet inside the App — we delete the personal information tied to your account, other than information we are permitted or required to retain for security, fraud-prevention, or legal purposes.

Account deletion includes the Firebase Authentication sign-in record associated with your account, including its phone number. If deletion cannot be completed, the App shows an error so you can retry. If you sign up again with the same number after deletion, you will receive a new, empty account. Deleting your Rhythm account does not delete the original readings in Apple Health.

Account deletion also asks PostHog to delete the App usage and diagnostics records linked to your account. If PostHog cannot be reached at that moment, we retry until the deletion is accepted.

05

Notice at Collection: Categories of Personal Information We Sell or Share

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.

06

Sources From Which We Collect Personal Information

We collect personal information directly from you (your phone number, the name you enter during setup, any feedback you send from the App, and anything you tell us when you contact support), and from your device with your permission (Apple Health readings, camera light measurements, approximate location, and notification registration), and automatically as you use the App (the App usage and diagnostics described in Section 2). We do not buy personal information about you from data brokers, and we do not receive it from advertising networks.

07

Health Data and Apple Health

The App reads two things from Apple Health: Time in Daylight, which your Apple Watch records with its own light sensor, and your sleep schedule, which tells us when your day began. Access is read-only.

These readings are sent to our server and stored with your account, so that your history survives a lost or replaced phone and so that our scoring can be corrected without shipping a new version of the App. This is a real trade, and we would rather state it plainly than imply that everything stays on your phone.

In line with Apple’s requirements, health data is never used for advertising or marketing, is never sold, and is never disclosed to third parties for their own purposes. You can review or revoke the App’s access to Apple Health at any time in the Health app under Sharing, or in your device’s Settings under Privacy and Security.

08

The Camera as a Light Meter

If you do not wear an Apple Watch, the App can use your iPhone’s front camera to measure the light around you. It reads the camera’s exposure settings and converts them into an estimated light level. Measuring light does not record photos or video. Exposure readings also set the App’s background while it is open on screen; the moment you leave, the camera stops. The light level itself stays on your phone — what is saved to your account is the measurement of how many minutes you recorded.

Separately, if you choose Take a photo in your sunset log, the App uses the camera to capture that photo and saves it on your device. It is not sent to us, as described in Section 12.

You can revoke camera access at any time in your device’s Settings, which will leave you able to use every other part of the App.

09

Location

Your score is anchored to the sun rather than to the clock, which requires knowing roughly where you are. The App asks for your location while you are using it, then rounds the coordinate to two decimal places — about 1.1 km, enough to place sunrise within seconds of the truth and not enough to identify a building — before storing it alongside a city-and-region name.

We also use the same rounded coordinate to show the weather where you are. To get it, our server sends that coordinate to the weather service of the Norwegian Meteorological Institute (MET Norway). Nothing else about you is sent with it: not your account, your name or your readings.

Location is never used for advertising, is not collected in the background, and can be revoked at any time in Settings. When the App uploads your Apple Health readings in the background, the upload may carry the last approximate location it obtained while you were using it. Without location we do not guess: the App will tell you it cannot score your day.

10

Your Rhythm Light Machine and Local Network

If you have a Rhythm Light Machine, the App finds it on your Wi-Fi network and controls it directly, without going through the internet. That is why it asks for access to your local network. Your commands, and your light’s routines and schedules, travel between your phone and your light on your own network, not through our servers.

To set up a light, the App joins the light’s own temporary Wi-Fi network and passes it the name and password of the Wi-Fi network you choose, so that the light can join it. That name and password go only to your light. The App keeps the credential it needs to control your light in your device’s keychain.

If you turn on a routine’s wake alarm, the App schedules it on your device with Apple’s AlarmKit. The alarm stays on your phone.

The App usage records described in Section 2 note which controls you use — for example, that you turned your light on, the brightness you set, or that you edited a routine — but never the names or passwords of your Wi-Fi networks.

11

Screen Time

If you connect Screen Time, the App asks for Apple’s Screen Time permission for you as an individual. It uses it to show how much you used this phone in the hour before bed, and the Dark Time part of your Light Score that comes from it. The App does not block apps, set limits, or learn which apps or websites you used.

That report is drawn by iOS in a protected extension. Your phone use, and the score that includes it, stay inside it: the App cannot read them, and they are never sent to us or to anyone else. To draw the report, the App gives the extension your daytime score, the evening hours to measure and how to display them, through storage on your device.

Our App usage records note when you turn Screen Time on or off and whether access was granted, never your phone use. You can turn Screen Time off in the App, and remove its access in your device’s Settings under Screen Time.

12

Your Sunset Log and Photos

The App can keep a log of sunsets. To add one, you can take a photo with the App or pick one from your photo library. If you allow access to your photo library, the App looks at the photos taken around that day’s sunset — on your device, using Apple’s built-in image analysis — to suggest the ones that look like a sunset. Only the photo you choose is copied into the App.

Your sunset photos are stored on your device and are not sent to us. They leave the App only if you share them, for example as an image of your week’s skies. Our App usage records note that you added or removed a sunset, not the photo itself. You can limit or remove photo access at any time in your device’s Settings.

13

How We Share Your Information

The Rhythm Light Machine is sold by Rhythm Innovations, Inc., the same company that operates the App — so telling you about it is our own internal use of your information, described in Section 3, not a disclosure to a third party.

Beyond that internal use, we share personal information only:

• With service providers who host our infrastructure and databases, verify your phone number, and deliver push notifications (Google Cloud and Firebase, and Apple’s Push Notification service), and who measure how the App is used and diagnose crashes (PostHog), under contracts limiting their use of your data to providing services to us;
• With MET Norway, whose weather service receives only the rounded coordinate described in Section 9, so that we can show you the local weather;
• For legal and safety reasons, if required by law, subpoena, or legal process, or to protect the rights, property, or safety of Rhythm, our users, or others;
• In a business transfer, such as a merger, acquisition, or asset sale, subject to this policy or a successor policy you are notified of.

14

Push Notifications

With your permission, we send a reminder timed to your own solar day. To do that we register your device with Apple’s Push Notification service through Firebase Cloud Messaging, which requires the identifiers listed in Section 2. You can turn notifications off at any time in your device’s Settings; if you do, the App stops registering for them.

The App can also schedule reminders on your device itself, such as a check-in or bedtime reminder. These are created on your phone and are not sent to us.

15

Sharing Your Score

The App can render your Light Score as a card, or your week of sunset photos as a single image, that you may copy, save to your photo library, or hand to another app through the iOS share sheet. That image is created on your device and is sent nowhere by us — where it goes next is entirely your choice, and is then governed by whichever app you send it to. Saving an image uses a permission that can only add to your library. Reading your photos to suggest a sunset is a separate permission, described in Section 12.

16

Third-Party Links and Services

The App links to the Rhythm Light Machine’s website. That site has its own privacy policy, which we encourage you to review; this Privacy Policy does not apply to it.

17

Securing Your Personal Data

We implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information we collect, use, retain, transfer, or otherwise process. However, there is no perfect security, and reasonable security is a process of managing risk rather than eliminating it.

18

Personal Information of Minors

Rhythm is intended for use by adults. You must be at least 18 years old to create an account or use the App, and by using the App you represent that you are 18 or older. We do not knowingly allow anyone under 18 to use the App or knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will terminate the account and delete the associated personal information.

The App is designed for you to measure and view your own light. It is not a monitoring tool, and it is not intended to be used to view another person’s readings.

19

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by other means before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

20

Accessibility

If you use an assistive technology and have trouble accessing this Privacy Policy, contact us at team@withrhythm.xyz and we will provide the information in an alternative format.

21

U.S. State Data Privacy Rights

If you are a resident of a U.S. state with a comprehensive consumer privacy law — California, Colorado, Connecticut, Montana, Oregon, Texas and Virginia among them — you have the right to:

• Know what personal information we collect, use, and disclose about you;
• Access or obtain a copy of your personal information;
• Delete your personal information;
• Correct inaccurate personal information;
• Know the categories of third parties with whom we share personal information;
• Opt out of the sale or sharing of personal information (we do not engage in either).

You can delete your account and everything in it at any time from inside the App. To exercise any of these rights, you may also contact us at team@withrhythm.xyz. We will verify your request before acting on it and will not discriminate against you for exercising these rights.

22

Contact Us