BedBearPrivacy Policy
This policy explains how Useful Apps ApS handles personal data when you use the BedBear app (listed in the stores as "Go To Bed: BedBear") and this website. We collect only what we need to run the app, and we never sell your data.
1. Who we are
The data controller is:
Useful Apps ApS
Staghøjvej 23A
8210 Aarhus V
Denmark
Email: hi@bedbear.app
2. Data we process
Account data
- Email address, if you sign in with a 6-digit code sent by email.
- Sign in with Apple (iOS): a unique user identifier from Apple and the email address Apple shares with us. If you choose "Hide My Email", we receive an Apple relay address instead of your real one.
- Google Sign-In (Android): a unique user identifier from Google and your email address.
Onboarding answers and sleep plan
- Your answers in onboarding, such as what keeps you up at night, your current habits and your personal reason for going to bed earlier, and the bedtime profile we derive from them.
- Your sleep plan: wake time for each weekday, sleep need, wind down steps and your timezone.
- Your settings, such as theme, language and reminder preferences.
Nightly logs
- When you tell the app you're going to bed, completed or snoozed wind down steps, late nights and, if you answer it, what you did instead the night before. We use these to show your streak and your progress.
BedBear does not use sensors to measure your sleep, does not read Apple Health or Google Health Connect, and does not collect your precise location.
Notifications and Live Activity
- Push notification tokens (Apple Push Notification service and Firebase Cloud Messaging) and Live Activity push tokens for your device.
- Pre-rendered Live Activity texts (for example "Step 2 of 3 · Phone on charger" and the time of your bedtime) that our server prepares in your language and sends to your lock screen at the right moment.
Purchase status
- Whether you have BedBear Pro, which plan, trial status, renewal and expiry dates, and an anonymous purchase identifier. Payments are handled by Apple or Google. We never receive your card details.
Product analytics
- Usage events (for example which onboarding step you reached, which screens you open, whether you started a trial), device type, operating system, app version, language and an approximate country derived from your IP address. We use this to understand what works and to improve the app.
Support
- If you email us, we process your email address and the content of your message.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating your account and signing you in | Account data | Contract, Art. 6(1)(b) |
| Calculating your bedtime, running your wind down, streaks and progress | Onboarding answers, sleep plan, nightly logs | Contract, Art. 6(1)(b) |
| Bedtime reminders, streak reminders and the Live Activity / ongoing notification | Push and Live Activity tokens, pre-rendered texts, sleep plan | Contract, Art. 6(1)(b), and your device permission, which you can withdraw in your phone's settings at any time |
| Providing BedBear Pro and restoring purchases | Purchase status | Contract, Art. 6(1)(b) |
| Product analytics and improving the app, including testing different versions of screens | Analytics data | Legitimate interest, Art. 6(1)(f): understanding how the app is used so we can make it better. You can object at any time (see section 7) |
| Answering support requests | Email and message | Legitimate interest, Art. 6(1)(f), or contract |
| Bookkeeping and legal obligations | Purchase records | Legal obligation, Art. 6(1)(c) |
| Security and preventing abuse | Account data, technical logs | Legitimate interest, Art. 6(1)(f) |
Your answers about your evening habits are about your routines, not your health. We do not ask for medical information and we ask you not to enter any.
We do not use your data for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Service providers
We use these providers to run BedBear. They process data on our behalf under data processing agreements, or, where noted, as independent controllers under their own terms.
| Provider | What they do | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and server functions | EU (Frankfurt, Germany) |
| RevenueCat Inc. | Subscription and purchase status | USA |
| PostHog Inc. | Product analytics | EU hosting |
| Resend (Plus Five Five Inc.) | Sending sign-in code emails | USA |
| Apple Inc. / Apple Distribution International | Sign in with Apple, push notifications and Live Activities (APNs), App Store payments* | USA / Ireland |
| Google LLC / Google Ireland Ltd. | Google Sign-In, push notifications (Firebase Cloud Messaging), Google Play payments* | USA / Ireland |
| Expo (650 Industries Inc.) | Building the app and delivering app updates | USA |
* Apple and Google process payments as independent controllers under their own privacy policies.
5. International transfers
Our main database is in the EU. Some providers above are based in the USA. Where personal data is transferred outside the EU/EEA, we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
- Account, sleep plan, onboarding answers and nightly logs: for as long as you have an account. When you delete your account, we delete this data within 30 days, and from backups within a further 30 days.
- Push and Live Activity tokens: until they expire, you sign out, or you delete your account. Pre-rendered Live Activity texts are kept only until the night they are for has passed.
- Sign-in codes: valid for a short time and deleted after use or expiry.
- Analytics data: up to 24 months, then deleted or anonymised.
- Purchase records: as long as Danish bookkeeping law requires (currently 5 years from the end of the financial year).
- Support emails: up to 24 months after the conversation ends.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy.
- Rectification of data that is wrong. You can change most of it directly in the app.
- Erasure ("right to be forgotten").
- Restriction of processing.
- Data portability: receive the data you gave us in a machine-readable format.
- Object to processing based on legitimate interest, including analytics.
- Withdraw consent where we rely on it, for example notification permissions, at any time in your phone's settings.
To use any of these rights, email hi@bedbear.app from the email address linked to your account. We answer within one month.
8. Deleting your account
You can ask us to delete your account and all data linked to it at any time by emailing hi@bedbear.app. Deleting your account does not cancel a subscription. Please cancel BedBear Pro in your App Store or Google Play settings first, since Apple and Google handle billing.
9. Security
Data is encrypted in transit (TLS) and at rest with our database provider. Access is limited by row-level security so each account can only read its own data, and only a small number of people at Useful Apps ApS can access production systems.
10. Children
BedBear is made for adults. It is not intended for anyone under 16, and we do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will delete it.
11. This website
bedbear.app is a static site hosted on GitHub Pages. It sets no cookies and runs no analytics or tracking. GitHub may log your IP address for security purposes as described in GitHub's privacy statement. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.
12. Changes
We may update this policy when the app or the law changes. We will change the effective date at the top, and if the changes are significant, we will tell you in the app before they take effect.
13. Contact and complaints
Questions about privacy: hi@bedbear.app.
You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to the data protection authority where you live.