Privacy Policy for Rhythm

Last updated: 26 September 2026

This Privacy Policy explains how Rhythm ("Rhythm," "the App," "we," "us," or "our"), operated by Bakir Šuvalija, collects, uses, shares, stores, and protects information when you use the Rhythm iOS application and related services.

Rhythm is a general-audience alarm application. It is not directed to children under 13.

If you have questions about this Privacy Policy or want to exercise a privacy right, contact us at hello@rhythmlabs.app.

1. Scope

This Privacy Policy applies to information processed through the Rhythm iOS application and the services used to operate it.

It does not govern the independent privacy practices of Apple, Google, or other third parties when you interact directly with their products or services, such as the App Store, Sign in with Apple, Google Sign-In, or system-level iOS features. Those services are governed by their own terms and privacy policies.

2. Information We Process

Rhythm is designed so that core alarm information remains on your device rather than being uploaded to a Rhythm-operated alarm database.

Depending on the features you use, the following categories of information may be processed.

2.1 Account and authentication information

Rhythm uses Supabase to provide account authentication.

If you use email authentication, we process your email address and the information necessary to create, authenticate, maintain, and secure your account. One-time authentication codes are delivered through our authentication infrastructure, with Resend used as the email delivery provider.

Rhythm also supports Sign in with Apple and Google Sign-In. If you choose one of those methods, the applicable identity provider may make account information and identifiers available as necessary to authenticate you. Rhythm uses that information for authentication and account operation rather than to create a public profile.

Authentication sessions and related credentials may be stored securely on your device, including through the iOS Keychain.

2.2 Alarm and challenge information stored locally

Rhythm stores information needed to operate your alarms and wake challenges locally on your device. This may include:

Rhythm does not operate a backend database that uploads or synchronizes your alarm schedules, alarm labels, or challenge sessions.

Apple's system alarm frameworks process information necessary to schedule and deliver alarms on your device.

2.3 Analytics information

Rhythm uses PostHog for limited product analytics. We use analytics to understand whether important parts of the App work, how features are used in aggregate, and how we can improve Rhythm.

Rhythm's analytics implementation is intentionally limited to specific product events and bounded properties. These may include events relating to:

We do not intentionally include your email address, account UUID, alarm UUID, alarm label, exact alarm time, one-time authentication code, challenge answer, payment receipt, transaction ID, or other free-text alarm content in these product analytics events.

PostHog assigns or processes pseudonymous identifiers needed to operate analytics. Network requests also necessarily involve network information such as an IP address. Our PostHog configuration discards client IP data, but PostHog may derive approximate geographic information from the network connection before the IP address is discarded. Observed derived information can include approximate city, country, subdivision, latitude/longitude, and timezone. Rhythm does not use iOS Core Location or GPS to obtain this analytics location information, and this information should not be understood as precise device location.

Session Replay is not used by Rhythm.

2.4 Advertising information

The free version of Rhythm displays advertising through Google AdMob. Rhythm uses Google's User Messaging Platform ("UMP") to manage applicable advertising privacy choices and consent messages.

When advertising is enabled, Google and participating advertising partners may process information associated with ad delivery, measurement, security, fraud prevention, and advertising. Depending on your device, region, privacy choices, and the ad-serving mode that applies, this can include information such as:

The exact information processed by Google or an advertising partner can depend on your consent choices, applicable law, device settings, and Google's advertising configuration.

Where required, Rhythm presents privacy choices before requesting ads and relies on UMP to determine whether ads may be requested. Where available, you can reopen the privacy options interface in Rhythm to review or change applicable advertising choices.

Rhythm does not itself access precise GPS location for advertising.

Purchasing Rhythm's Ad-Free subscription suppresses advertising in the App. Privacy or consent processing needed to remember or manage your advertising privacy choices may still occur.

2.5 Subscription and purchase information

Rhythm offers an optional auto-renewable Ad-Free subscription through Apple's StoreKit and the App Store.

Apple processes your payment information and purchase transaction. Rhythm does not collect or store your payment-card details.

Rhythm receives or reads the StoreKit information necessary to determine whether you have an active entitlement, process a purchase or restore request, and suppress advertisements for entitled users. Rhythm does not operate its own payment database or upload your App Store receipt to a Rhythm backend.

2.6 Support communications

If you contact us by email, we receive the information you choose to include in your message, such as your email address, message content, and attachments.

Support messages are sent through your chosen mail application and processed by the relevant email providers. Please do not send sensitive information that is unnecessary for us to address your request.

2.7 Technical and network information

When Rhythm communicates with online services such as Supabase, PostHog, Google, Resend, Apple, or an identity provider, those services may necessarily receive technical information associated with the connection, such as IP address, request metadata, device or app information, and security or diagnostic information.

The exact provider-side processing is governed in part by each provider's systems and privacy terms.

3. Information Rhythm Does Not Intentionally Collect Through App Features

Rhythm's current App features do not request or provide app-authored access to:

Rhythm also does not provide a public social profile.

System services or third-party SDKs may process their own technical information as described elsewhere in this Policy.

4. How We Use Information

We process information for the following purposes:

We do not use your locally stored alarm label or exact alarm time for targeted advertising.

5. Legal Bases for Processing

Where laws such as the GDPR or UK GDPR require us to identify a legal basis, the basis depends on the information and purpose involved.

We may process information:

Advertising partners may rely on their own applicable legal bases for processing they perform. Where required, the consent interface provides information and choices relating to participating advertising vendors and purposes.

You may withdraw consent where processing is based on consent. Withdrawal does not affect processing that was lawful before withdrawal.

6. How We Share Information

We do not sell your personal information for money.

We disclose or make information available to service providers and platforms only as reasonably necessary to operate Rhythm and the features you choose to use. These include:

Supabase

Supabase provides account authentication and related backend infrastructure. It processes information needed to create and authenticate accounts and operate account deletion.

Resend

Resend is used through our authentication infrastructure to deliver authentication emails and one-time codes.

PostHog

PostHog provides limited product analytics as described in Section 2.3.

Google

Google provides Google Sign-In, Google AdMob advertising, and the User Messaging Platform. Advertising-related processing may involve Google and advertising partners disclosed through the applicable consent interface.

Apple

Apple provides the App Store, StoreKit subscription and payment infrastructure, Sign in with Apple, and iOS system functionality used by Rhythm, including system alarm functionality.

Support and infrastructure providers

If you contact us, the providers involved in transmitting and receiving that communication process the information necessary to deliver it.

We may also disclose information if reasonably necessary to comply with law, legal process, enforceable governmental requests, protect rights or safety, investigate fraud or abuse, or in connection with a reorganization, acquisition, sale, or transfer of the service, subject to applicable law.

We require service providers to handle information consistently with their applicable contractual and legal obligations and use providers that maintain privacy and security protections appropriate to their role.

7. Advertising, Consent, and Tracking Choices

Advertising privacy requirements differ by country and region.

Where required, Rhythm uses Google's User Messaging Platform to present a consent or privacy message and determine whether advertising requests may be made. Available choices can vary by jurisdiction and may include consenting, declining consent, or managing purposes and advertising partners.

You can use the privacy-options control made available in Rhythm, where required and available, to revisit applicable advertising choices.

Your iOS privacy settings may provide additional controls over identifiers or tracking. Rhythm will respect applicable system-level permissions and will not treat a denial of an optional tracking permission as consent.

The availability of personalized, non-personalized, limited, or other ad-serving modes is determined by applicable law, your choices, device settings, and Google's advertising systems.

8. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including providing the service, maintaining security, complying with legal obligations, resolving disputes, and enforcing agreements.

Retention varies by category:

We do not claim that account deletion causes immediate deletion from every provider backup, security log, analytics record, advertising system, or Apple system.

9. Account Deletion

You can request deletion of your Rhythm account through the account-deletion functionality provided in the App.

A successful account deletion removes the applicable Rhythm authentication account and associated Rhythm profile data from our active Supabase account system. Rhythm also performs local cleanup associated with the deleted account, including cancellation of applicable Rhythm alarm registrations and removal of Rhythm's local alarm/wake records and pending-wake data.

Account deletion does not automatically:

If you have an active Ad-Free subscription, manage or cancel it through Apple's subscription-management controls.

For a privacy request extending beyond the in-app account-deletion process, contact hello@rhythmlabs.app.

10. Your Privacy Rights

Depending on where you live, applicable law may give you rights concerning your personal information. These may include the right to:

These rights are not absolute and may be subject to legal exceptions.

To exercise a right, email hello@rhythmlabs.app. We may need to verify that the request relates to you before acting on it. We will respond in accordance with applicable law.

You may also manage certain information directly through Rhythm, iOS settings, your Apple or Google account, Apple's subscription controls, or Rhythm's advertising privacy options.

11. International Processing

Rhythm is made available internationally, except where we choose not to distribute it.

Our service providers operate infrastructure in multiple countries. As a result, information may be processed in a country other than the one where you live. Those countries may have privacy laws that differ from those in your jurisdiction.

Where required by applicable law, international transfers are handled using recognized legal safeguards or other lawful transfer mechanisms made available by the relevant service provider.

12. Security

We use reasonable technical and organizational measures designed to protect information processed through Rhythm.

Examples include relying on established service providers for authentication and payments, using secure transport for network communications, storing authentication session material using secure device storage where applicable, limiting the analytics events Rhythm intentionally sends, and keeping core alarm data local rather than operating a cloud alarm database.

No method of storage or transmission is completely secure. We therefore cannot guarantee absolute security.

If you believe your Rhythm account or information has been compromised, contact hello@rhythmlabs.app.

13. Children

Rhythm is intended for a general audience and is not directed to children under 13.

You must be at least 13 years old to create or use a Rhythm account. We do not knowingly collect personal information through Rhythm from children under 13.

Advertising and privacy-consent requirements for minors can differ between jurisdictions. Rhythm and its advertising providers may apply additional restrictions where required by applicable law.

If you believe a child under 13 has provided personal information to Rhythm, contact hello@rhythmlabs.app so that we can review the situation and take appropriate action.

14. Automated Decision-Making

Rhythm does not use the personal information described in this Policy to make legal or similarly significant decisions about you through solely automated decision-making.

Advertising providers may use automated systems to determine which advertisements are eligible to be shown, subject to applicable privacy choices and their own policies.

15. Do Not Track and Device Privacy Controls

Mobile platforms and browsers may provide privacy signals or settings that affect advertising or tracking. Rhythm respects applicable iOS permission requirements and the privacy choices made available through its advertising consent system.

Because there is no single universally accepted technical standard for all "Do Not Track" signals, we do not separately respond to every browser-style Do Not Track signal within the iOS App.

16. Changes to This Privacy Policy

We may update this Privacy Policy when Rhythm's features, service providers, data practices, or legal obligations change.

When we make changes, we will update the "Last updated" date above. Where required by law, we will provide additional notice or obtain consent before a material change takes effect.

You should review this Policy periodically, particularly after installing an App update.

17. Contact

Rhythm is operated by:

Bakir Šuvalija\ Email: hello@rhythmlabs.app

For privacy questions, requests, account-deletion issues, or concerns about this Policy, contact us at hello@rhythmlabs.app.