Privacy Policy

01

Introduction

This Privacy Policy describes the practices of Rhythm Innovations, Inc. (“we,” “us,” or “our”) in connection with the Rhythm Light mobile application (the “App”). The App measures how much daylight you actually get — from your Apple Watch, or from your iPhone’s camera used as a light meter — and turns it into a daily Light Score. This policy explains what personal information we collect, why, how long we keep it, and the rights you have over it.

02

Notice at Collection: Personal Information We Collect

Categories of personal information the Rhythm app collects, with examples and the source of each category.
Category	Examples	Source
Personal identifiers	Your mobile phone number, which is how you sign in, and the name you enter during setup — a single free-text field, so if you enter your full name, that’s what we store. We do not ask for your email address, and there is no password.	You, directly
Health data from Apple Health	Apple Watch “Time in Daylight” readings (the start, end and length of each period of daylight) and your sleep schedule (the times you fell asleep and woke). Access is read-only: the App never writes to Apple Health.	Your device, via Apple’s HealthKit framework, with your permission
Light measurements from the camera	The minutes you record on the light meter screen. The camera is read as a light sensor — exposure settings, not pixels — to measure the light level in the moment, but that light-level reading stays on your device; only the minutes recorded are sent to our servers. Photos and video are not saved or transmitted. While the App is open, camera exposure readings also set its background; the camera stops when you leave the App.	Your device, with your permission
Approximate location	A latitude and longitude, rounded to two decimal places (about 1.1 km) before it is stored, and a city-and-region name such as “San Francisco, CA”. Used only to calculate your local sunrise, solar noon and sunset.	Your device, with your permission
Score, goals and settings	Your Light Score and its history, your morning and afternoon goal minutes, your streak, your time zone, and whether you have connected Apple Health.	Generated by the App and our server from your own readings
Push notification data	A per-installation device identifier, a Firebase installation ID, your notification permission status, whether daily reminders are switched on, your time zone, the App version and build number, and the text of any reminder we have queued for you.	Your device, with your permission
App usage and diagnostics	Which features of the App you use and when — for example, finishing a step of setup, turning your light on, or sharing your score — together with the App version, your device model and operating system, and crash reports. These records are linked to a random account identifier, not your phone number or name, and never include Apple Health readings, light measurements, your location or the names of your Wi-Fi networks. They are processed for us by PostHog.	Automatically, when you use the App
Sign-in and security data	A hashed session token, a device name, sign-in and last-seen timestamps, and a hashed form of your IP address used to rate-limit sign-in attempts.	Automatically, when you use the App

Personal identifiers

Examples: Your mobile phone number, which is how you sign in, and the name you enter during setup — a single free-text field, so if you enter your full name, that’s what we store. We do not ask for your email address, and there is no password.
Source: You, directly

Health data from Apple Health

Examples: Apple Watch “Time in Daylight” readings (the start, end and length of each period of daylight) and your sleep schedule (the times you fell asleep and woke). Access is read-only: the App never writes to Apple Health.
Source: Your device, via Apple’s HealthKit framework, with your permission

Light measurements from the camera

Examples: The minutes you record on the light meter screen. The camera is read as a light sensor — exposure settings, not pixels — to measure the light level in the moment, but that light-level reading stays on your device; only the minutes recorded are sent to our servers. Photos and video are not saved or transmitted. While the App is open, camera exposure readings also set its background; the camera stops when you leave the App.
Source: Your device, with your permission

Approximate location

Examples: A latitude and longitude, rounded to two decimal places (about 1.1 km) before it is stored, and a city-and-region name such as “San Francisco, CA”. Used only to calculate your local sunrise, solar noon and sunset.
Source: Your device, with your permission

Score, goals and settings

Examples: Your Light Score and its history, your morning and afternoon goal minutes, your streak, your time zone, and whether you have connected Apple Health.
Source: Generated by the App and our server from your own readings

Push notification data

Examples: A per-installation device identifier, a Firebase installation ID, your notification permission status, whether daily reminders are switched on, your time zone, the App version and build number, and the text of any reminder we have queued for you.
Source: Your device, with your permission

App usage and diagnostics

Examples: Which features of the App you use and when — for example, finishing a step of setup, turning your light on, or sharing your score — together with the App version, your device model and operating system, and crash reports. These records are linked to a random account identifier, not your phone number or name, and never include Apple Health readings, light measurements, your location or the names of your Wi-Fi networks. They are processed for us by PostHog.
Source: Automatically, when you use the App

Sign-in and security data

Examples: A hashed session token, a device name, sign-in and last-seen timestamps, and a hashed form of your IP address used to rate-limit sign-in attempts.
Source: Automatically, when you use the App

What we do not collect

Local network data. This version does not discover, pair with or control a Rhythm Light Machine.
Screen Time or app-usage data. The App does not use Apple’s FamilyControls or DeviceActivity frameworks, and we receive no information about which apps you use or for how long.
An advertising identifier. There is no advertising SDK in the App and no App Tracking Transparency prompt, because there is nothing to track you with.
Health data, location or Wi-Fi names in usage records. The App usage and diagnostics described above never include Apple Health readings, light measurements, your location or the names of your Wi-Fi networks, and we have configured PostHog not to use your IP address to determine where you are.
Your email address, your contacts, your photo library, or a precise stored location.

03

Notice at Collection: Purposes for Collection

We collect the categories above to:

Calculate and display your Light Score, your daily light and your history;
Anchor your day to your own local sunrise, solar noon and sunset;
Send you a daily reminder, if you turn notifications on;
Sign you in and keep your account secure, including limiting the rate of sign-in attempts;
Operate, maintain, secure and improve the App;
Understand which features of the App are used and diagnose crashes, so that we can improve it;
Respond to support requests and other communications;
Tell you about the Rhythm Light Machine;
Comply with legal obligations and enforce our terms.

Health data is used only to produce your own score and history, and to show it back to you. We do not use health data for advertising or marketing, and we do not sell it or disclose it to third parties for their own purposes.

04

Notice at Collection: Retention Periods

We retain each category of personal information described in Section 2 for as long as necessary to provide the App, operate and secure our systems, and meet our legal and legitimate business needs — and no longer. Where we are not able to state an exact period for a category, we determine how long to keep it using criteria such as: how long your account stays active, how long a record is needed to keep the App and its users secure, and how long we are required to keep it by law.

When you delete your account — from the account sheet inside the App — we delete the personal information tied to your account, other than information we are permitted or required to retain for security, fraud-prevention, or legal purposes.

Account deletion includes the Firebase Authentication sign-in record associated with your account, including its phone number. If deletion cannot be completed, the App shows an error so you can retry. If you sign up again with the same number after deletion, you will receive a new, empty account. Deleting your Rhythm account does not delete the original readings in Apple Health.

Account deletion also asks PostHog to delete the App usage and diagnostics records linked to your account. If PostHog cannot be reached at that moment, we retry until the deletion is accepted.

05

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.

06

Sources From Which We Collect Personal Information

We collect personal information directly from you (your phone number, the name you enter during setup, and anything you tell us when you contact support), and from your device with your permission (Apple Health readings, camera light measurements, approximate location, and notification registration), and automatically as you use the App (the App usage and diagnostics described in Section 2). We do not buy personal information about you from data brokers, and we do not receive it from advertising networks.

07

Health Data and Apple Health

The App reads two things from Apple Health: Time in Daylight, which your Apple Watch records with its own light sensor, and your sleep schedule, which tells us when your day began. Access is read-only.

These readings are sent to our server and stored with your account, so that your history survives a lost or replaced phone and so that our scoring can be corrected without shipping a new version of the App. This is a real trade, and we would rather state it plainly than imply that everything stays on your phone.

In line with Apple’s requirements, health data is never used for advertising or marketing, is never sold, and is never disclosed to third parties for their own purposes. You can review or revoke the App’s access to Apple Health at any time in the Health app under Sharing, or in your device’s Settings under Privacy and Security.

08

The Camera as a Light Meter

If you do not wear an Apple Watch, the App can use your iPhone’s front camera to measure the light around you. It reads the camera’s exposure settings and converts them into an estimated light level. It does not save or transmit photos or video. Exposure readings also set the App’s background while it is open on screen; the moment you leave, the camera stops. The light level itself stays on your phone — what is saved to your account is the measurement of how many minutes you recorded.

You can revoke camera access at any time in your device’s Settings, which will leave you able to use every other part of the App.

09

Location

Your score is anchored to the sun rather than to the clock, which requires knowing roughly where you are. The App asks for your location while you are using it, then rounds the coordinate to two decimal places — about 1.1 km, enough to place sunrise within seconds of the truth and not enough to identify a building — before storing it alongside a city-and-region name.

Location is never used for advertising, is not collected in the background, and can be revoked at any time in Settings. Without it we do not guess: the App will tell you it cannot score your day.

10

The Rhythm Light Machine is sold by Rhythm Innovations, Inc., the same company that operates the App — so telling you about it is our own internal use of your information, described in Section 3, not a disclosure to a third party.

Beyond that internal use, we share personal information only:

With service providers who host our infrastructure and databases, verify your phone number, and deliver push notifications (Google Cloud and Firebase, and Apple’s Push Notification service), and who measure how the App is used and diagnose crashes (PostHog), under contracts limiting their use of your data to providing services to us;
For legal and safety reasons, if required by law, subpoena, or legal process, or to protect the rights, property, or safety of Rhythm, our users, or others;
In a business transfer, such as a merger, acquisition, or asset sale, subject to this policy or a successor policy you are notified of.

11

Push Notifications

With your permission, we send a reminder timed to your own solar day. To do that we register your device with Apple’s Push Notification service through Firebase Cloud Messaging, which requires the identifiers listed in Section 2. You can turn notifications off at any time in your device’s Settings; if you do, the App stops registering for them.

12

The App can render your Light Score as a card that you may copy, save to your photo library, or hand to another app through the iOS share sheet. That image is created on your device and is sent nowhere by us — where it goes next is entirely your choice, and is then governed by whichever app you send it to. Saving a card is the only reason the App ever asks for photo access, and that permission can only add an image; it cannot read your library.

13

Third-Party Links and Services

The App links to the Rhythm Light Machine’s website. That site has its own privacy policy, which we encourage you to review; this Privacy Policy does not apply to it.

14

Securing Your Personal Data

We implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information we collect, use, retain, transfer, or otherwise process. However, there is no perfect security, and reasonable security is a process of managing risk rather than eliminating it.

15

Personal Information of Minors

Rhythm is intended for use by adults. You must be at least 18 years old to create an account or use the App, and by using the App you represent that you are 18 or older. We do not knowingly allow anyone under 18 to use the App or knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will terminate the account and delete the associated personal information.

The App is designed for you to measure and view your own light. It is not a monitoring tool, and it is not intended to be used to view another person’s readings.

16

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by other means before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

17

Accessibility

If you use an assistive technology and have trouble accessing this Privacy Policy, contact us at team@withrhythm.xyz and we will provide the information in an alternative format.

18

U.S. State Data Privacy Rights

If you are a resident of a U.S. state with a comprehensive consumer privacy law — California, Colorado, Connecticut, Montana, Oregon, Texas and Virginia among them — you have the right to:

Know what personal information we collect, use, and disclose about you;
Access or obtain a copy of your personal information;
Delete your personal information;
Correct inaccurate personal information;
Know the categories of third parties with whom we share personal information;
Opt out of the sale or sharing of personal information (we do not engage in either).

You can delete your account and everything in it at any time from inside the App. To exercise any of these rights, you may also contact us at team@withrhythm.xyz. We will verify your request before acting on it and will not discriminate against you for exercising these rights.

19

Contact Us

Rhythm Innovations, Inc.

team@withrhythm.xyz