← Back to site

Privacy Policy

Effective date: 21 March 2026  ·  Last updated: 18 April 2026  ·  Version 2.1

Short version: Your personal sleep and recovery data stays encrypted on your device. We cannot read it, sell it, or lose it in a breach — because personal sleep logs are not readable by us. The only data on our servers is the minimum needed to run your account.

1. Introduction

Dozepeak is a sleep and performance recovery app designed for athletes and high performers. We understand that recovery data is sensitive. That has shaped every architectural decision in how Dozepeak is built.

This Privacy Policy explains what data is collected, where it lives, and your rights under Australian law. Dozepeak is a brand of Sleep Portfolio, Queensland, Australia.

2. Zero-Knowledge Architecture

Your personal sleep and recovery data stays encrypted on your device.

3. Data We Collect and Store

3.1 On-Device Data (Never Transmitted to Our Servers)

This data is never transmitted to Dozepeak servers. We have no access to it.

3.2 Data Transmitted to Our Servers

DataWhenWhyStored?
Anonymous AI Coach request (no PII — e.g. "athlete, recovery focus, Day 5 streak")When you use AI CoachTo generate a responseNo — discarded after response
Anonymous analytics event (e.g. "sleep_logged")During app useTo understand feature usageYes — no PII attached
Push notification device tokenWhen you enable push notificationsTo send remindersYes — token only
Account email addressAt account creation (optional)For account recoveryYes — encrypted at rest
Website waitlist: email, first name, last name, country, and city or regionWhen you submit the join-waitlist form on dozepeak.comTo send launch and beta updates and for light-touch regional planningYes — in our secure database (encrypted at rest). Not used for AI Coach prompts and not sold to third parties
Subscription statusVia RevenueCat/Apple/GoogleTo unlock premium featuresNo — RevenueCat is source of truth

3.3 Analytics

Analytics events contain: a random session identifier (not linked to your identity), event type, timestamp, device type and app version. They do not contain your name, email, sleep data, or any personally identifiable information.

4. On-Device Storage and Encryption

Your data is stored in an encrypted SQLite database using AES-256 encryption. The encryption key is held in your device's secure enclave (iOS) or Android Keystore (Android) and is never transmitted anywhere. Deleting the app permanently deletes all on-device data. We hold no copy.

5. Optional Encrypted Backup

6. AI Recovery Coach

The AI Recovery Coach is powered by the Anthropic API (Claude). When you interact with the Coach:

Anthropic's privacy policy: anthropic.com/privacy

7. Push Notifications

If you enable push notifications, we store your device push token to send reminders. Push tokens are not linked to your personal identity. You can disable them at any time — disabling notifications triggers deletion of your push token from our servers.

8. Payments

Consumer subscriptions are processed entirely through Apple App Store or Google Play, managed by RevenueCat. Dozepeak never sees or stores your payment card details.

9. Third-Party Services

ServicePurposeData Shared
Anthropic (Claude API)AI Coach responsesAnonymised, non-identifying request text
Apple APNsPush notifications (iOS)Device push token
Google FCMPush notifications (Android)Device push token
RevenueCatSubscription managementAnonymous user ID, subscription events
Apple App Store / Google PlayIn-app purchasesGoverned by Apple/Google policies
ResendTransactional email (e.g. waitlist confirmation)Your email address; standard template content only
SentryError reportingAnonymous error logs, stack traces (no PII)

10. Your Rights

Because your personal data is stored exclusively on your device, you already have complete control. You can view, export, and delete all your data directly within the app.

Australian Privacy Act 2024

Dozepeak acknowledges the Privacy Act 2024 statutory tort for serious invasions of privacy and is committed to compliance with the Australian Privacy Principles (APPs).

GDPR (EU and UK users)

You have rights under GDPR/UK GDPR including access, rectification, erasure, data portability, restriction, and objection. Contact sleepportfolio@gmail.com — we respond within 30 days.

11. Right to Erasure — Account Deletion

To request deletion of your account and all server-side data:

We will process deletion requests within 30 days.

12. Data Retention

Data TypeRetention Period
On-device sleep and recovery dataIndefinite — you control this; deleted when you delete the app
Account emailUntil account deletion request
Website waitlist (email, name, country, city)Until you request removal or unsubscribe from waitlist email; contact sleepportfolio@gmail.com
Push notification tokenUntil you disable notifications or delete your account
Anonymous analytics events24 months (rolling), then automatically deleted
AI Coach message hashes12 months, then automatically deleted

13. Children

Dozepeak is designed for users aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you believe a person under 18 has created an account, please contact sleepportfolio@gmail.com

14. Security

15. Changes to This Policy

We will notify you of material changes via in-app notification at least 30 days before the change takes effect.

16. Contact

Privacy enquiries and rights requests:
sleepportfolio@gmail.com

Postal address:
Dozepeak Privacy Officer (Sleep Portfolio)
Queensland, Australia

OAIC: oaic.gov.au  ·  1300 363 992