Privacy policy

1. Introduction

This privacy policy describes how Vision Publishing LLC (“we”, “our” or “us”) collects, uses and protects the personal data of users of the Respire app (the “App”).

We are committed to protecting our users' privacy and to processing their personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

2. Data controller

3. Data collected

The App collects the minimum data needed to work. Here is the detail of the data processed:

3.1. Data stored locally on the device

The following data is stored only on the user's device and is not sent to our servers:

• First name : used to personalize the experience in the App
• Onboarding answers : the answers to the initial questions (type of breathing discomfort, sensations, triggers, relief goal, preferences) used to generate the personalized mini-plan
• Session history : tracking of the protocols completed, durations, progress and relief feedback after a session
• App preferences : reminder settings, choice of audio session voice, display preferences
• Journal and wellbeing check-ins : the optional daily journal notes, the breath, stress and rumination check-ins, the tension recorded before and after a practice, and SOS episodes
• Crisis kit : the reassuring phrases, the helpful actions and, if the user enters them, the first name and number of a trusted person. That number is used only to start a call at the user's request

3.2. Dynamic audio catalog

To keep a limited stock of new audio sessions and avoid generating unnecessary content, the App sends our server a random installation identifier, the number of the audio day required and the App version. The identifier is immediately turned into a pseudonymous hash on the server. This request contains no first name, no onboarding answer, no journal content and no detail of the sessions listened to. Inactive installations are automatically removed from this technical state after 365 days.

3.3. Support requests

When the user chooses to contact us from the App, the email address and message entered are sent to our support inbox. This information is used only to handle the request and reply to it. It is not used for advertising or usage measurement and is kept only for as long as needed to follow up the request and meet our legal obligations. The user can ask for it to be deleted by writing to contact@hello-respire.com.

3.4. Data sent to third parties

3.4.1. Text generation provider

The mini-plan and protocol recommendations are personalized directly on the device. Onboarding answers, the first name and journal content are never sent to our text generation provider.

To produce certain short supportive messages, our server may send this provider only a limited technical context: the name of the proposed or completed protocol, its duration when it has just been completed, and the current day streak. This data is used only to generate the requested message. It contains no direct identifier, no onboarding answer, no journal content, no email address, no payment data and no detail about the audio sessions listened to. If this service is unavailable, a local message is used.

3.4.2. Apple and Google stores

Purchase transactions are handled by Apple on the App Store or by Google on Google Play, depending on the store used. We have no access to card numbers or other payment information. Each store applies its own privacy policy: Apple and Google.

To check that a subscription is active, the App sends our server the random installation identifier and the purchase proof signed by Apple or the Google Play purchase token. The server queries the relevant store and keeps only the elements needed for verification: product, state, expiry, order identifier and store country. The Google token is encrypted at rest. No Apple or Google account identifier, no store account email address and no card data are sent to us.

3.4.3. Transcription of voice messages

When feedback sent from the App (point 3.5) contains a voice message, our server sends only that recording to an automatic transcription provider, to obtain the text the team can read. No first name, no email address and no screenshot are sent to it. The provider processes the recording on our behalf, for the sole purpose of producing the transcription.

3.4.4. No other third-party processors

Respire uses no advertising SDK, no attribution SDK and no third-party analytics tool. Usage measurement is handled by our own infrastructure. Purchases go through the native system of the relevant store; our server verifies the purchase and the subscription state with that store.

3.4.5. First-party usage measurement

Usage measurement is carried out by our own server, with no intermediary and no advertising tracking. The data processed is limited to:

• A random installation identifier, generated on the device, not linked to an identity and resettable from the App
• A closed list of technical events: app opened, screen viewed, paywall shown, technical outcome of a purchase or restore, end of a protocol, an audio session, a wind-down pause or an SOS sequence (with its duration and the outcome chosen by the user, with no text entered), lesson read, journal updated (only the number of check-ins filled in), generation limit reached and technical change in subscription state
• Technical information about the App and the device: App version, build number, iOS or Android version and language

The server accepts only the properties explicitly allowed for each event; any other value is discarded before recording. Never sent: the first name, the health or wellbeing answers entered during onboarding, journal content, the audio sessions listened to and any free-form error message. These events are not used for advertising and are not shared with any third party. They are kept for a maximum of 400 days.

From September 5, 2026, only the last approximate connection country is kept with the installation identifier, to measure the distribution of the audience. That country is supplied by our delivery infrastructure; no GPS coordinates, city, precise address or travel history is kept. A VPN can change the estimated country. This information is erased with the app data. The store country and the amounts of signed transactions are used separately for subscription statistics.

The IP address is never recorded as such: it is turned into a pseudonymous hash using a secret key, only to limit abuse, and that hash is deleted after two days.

3.5. Feedback sent from the App

When the user chooses to give us feedback from the App (“Give feedback”), we receive the chosen topic, their message, an optional voice message, up to five optional screenshots and an optional email address, as well as the App and system version, device model, the random installation identifier and the App account token that links the feedback to the subscription. Screenshots are reduced and stripped of their metadata (including location) on the device before any sending. Nothing is sent without an explicit action by the user, and a voice message is recorded only after their consent.

This feedback is used only to understand and fix the reported problems and to improve the App. It is used neither for advertising nor for usage measurement. The IP address of the sending is not kept.

4. Data storage

The vast majority of the App's data is stored locally on the user's device. Our server, hosted in the European Union, keeps only the pseudonymous, limited technical state needed for the dynamic audio catalog, the usage measurement events described in point 3.4.5 and subscription verification. Voluntary support requests are kept in our support inbox as described in point 3.3. Feedback sent from the App (point 3.5) is kept on our server for at most twelve months, then deleted. Apart from those requests, our infrastructure stores no first name, no onboarding answer, no journal content and no detailed history of the sessions listened to.

This means that:

• If the App is uninstalled, the local data is deleted from the device
• The data is not synced between devices. On iPhone, it is included in device backups (iCloud or computer) when the user has enabled them, and can therefore be restored on a new device; on Android, the App excludes its data from backups
• Our server's technical backups are kept for a maximum of 35 days: data erased from the server may remain there until they expire
• We have no access to the data stored on the user's device

5. User rights

In accordance with the GDPR and applicable laws, the user has the following rights:

• Right of access : to obtain confirmation that data concerning them is processed and to obtain a copy
• Right to rectification : to request correction of inaccurate data
• Right to erasure : to request deletion of their data
• Right to portability : to receive their data in a structured, readable format
• Right to object : to object to the processing of their data
• Right to restriction of processing : to request restriction of the processing of their data

To exercise these rights, the user can contact us at: contact@hello-respire.com.

6. Data deletion

The user can delete all of their data at any time directly in the App:

This action permanently deletes all data stored locally on the device (first name, answers, session history, journal, crisis kit, preferences), including the App's internal backup copies.

The action also deletes, on our server, the usage measurement events, generation requests, audio catalog demand state and access tokens linked to that installation, then generates a new installation identifier. Links between the erased installation and Google purchases are removed. Purchase proofs still needed to recognize and honor a subscription are kept for the required period. The action does not automatically delete feedback and support messages sent voluntarily: their deletion can be requested by email. It does not cancel the subscription, which remains managed from the subscriptions of the Apple account or Google Play account used for the purchase. For data kept by a store, the user can contact that store.

7. Cookies

The App is a native mobile app and uses no cookies. The website hello-respire.com uses no tracking cookie, no third-party cookie and no audience measurement tool; it loads no resource from an external service and keeps no visit log. Only rare critical technical server errors may contain an IP address; those logs are deleted after at most 14 days.

The site is published in French; the help and legal pages linked from the app are also available in English and Spanish. There is no language selector and no cookie is set to remember a language preference.

8. Security

We implement appropriate technical and organizational measures to protect users' data:

• Data is stored locally on the device, benefiting from iOS or Android security mechanisms (device encryption, sandboxing)
• Communications with third-party services are encrypted via HTTPS/TLS
• Data shared with third-party providers is limited to what is necessary for the App's stated operation

9. Data transfers outside the EU

Some technical or personalization data may be transferred outside the European Union when necessary for our technical or payment providers. These transfers are carried out in compliance with the GDPR and with appropriate safeguards where required.

10. Minors

The App is not intended for children under 16. We do not knowingly collect data about minors under 16. If a parent or guardian believes their child has provided us with personal data, they can contact us to request its deletion.

11. Changes

We may update this privacy policy at any time. The user will be informed of any significant change by a notification in the App. The last update date is shown at the top of this page.

12. Contact

For any question about this privacy policy or the processing of your personal data, contact us:

• By email: contact@hello-respire.com
• By post: Vision Publishing LLC, 2105 Vista Oeste NW Suite E #3990, Albuquerque, NM 87120, USA
• By phone: +1 (505) 278-9455