Privacy Policy

1. Who We Are

Salūs Sleep is operated by Salus Studios Ltd, registered in England and Wales (company number 17268621). Salus Studios Ltd is the data controller for your personal data. For any data protection enquiry, contact salus@salus-rooms.com.

2. What We Collect & Why

We collect only what we need to run the service:

• Account & payment: Name, email, and password to manage your account; payments are handled securely by Stripe, Apple, or Google Play (we never store full card details).
• Usage & analytics: Website and in-app activity (pages viewed, playback, sign-ups, purchases) to understand traffic and improve the service.
• Earlier app set-up answers: Until 6 September 2026 the app asked new users about their wellbeing goals, their interests and how they heard about us. The app no longer asks these questions. If you answered them before then, your answers remain stored against your account and are deleted with it.
• TikTok connection and posting: If you choose to connect TikTok, we process your TikTok account identifier, display name, avatar, encrypted access and refresh tokens, token expiry, and internal account-link timestamps. We use these only to connect the account you chose, show which TikTok profile will receive a post, read its current posting options, and carry out posts you expressly request. You can disconnect at any time, using Disconnect TikTok in your account dashboard or Disconnect in the posting panel. Disconnecting calls TikTok's own revoke service, so TikTok cancels our access to your account immediately, and it deletes the stored TikTok identifier, display name, avatar and encrypted tokens from our database at the same time. Deleting your Salūs account does the same before the account is removed. Videos already posted to TikTok are unaffected, and you remove those in TikTok itself.
• Your TikTok video: When you press Post, the video you selected and its caption are sent to TikTok. Video chunks pass through our authenticated Supabase function in memory and are forwarded unchanged to TikTok. We do not store the video, caption, TikTok upload URL, or completed post.
• Advertising measurement (website, only if you accept cookies): Advertising tags from X (Twitter), Pinterest and TikTok record that a page was viewed and whether a sign-up or subscription followed, so we can tell which of our adverts actually work. They receive your IP address, browser and device details, and the address of the page you are on. They are strictly opt-in, they do not load at all until you accept cookies, and they never load on our sign-up, log-in or subscribe pages.
• Embedded video: Our About page embeds one video from YouTube. When that page loads, your browser requests the player from Google, so Google receives your IP address and browser details and can place storage on your device if you play the video. We use the privacy-enhanced youtube-nocookie.com player, which limits what YouTube stores unless you press play.
• Health (sleep) data, mobile apps only: With your explicit permission, sleep data read from Apple Health or Health Connect, processed on your device only (see Section 5).
• Sleep Recorder audio, mobile apps only: If you choose to use the Sleep Recorder, the app records the sound of your room through your phone's microphone and keeps the recordings on your phone. We never receive them (see Section 5).
• Optional promotional app notifications: If you separately opt in, we process an app installation identifier, your notification permission and consent records, an encrypted-at-rest Firebase Cloud Messaging token, mobile platform, coarse locale territory and time zone. We use those details, plus whether the relevant subscription offer or conversion already occurred, to deliver and limit optional subscription-offer notifications if you have opted in. We may also use how you use the app to decide who is shown an offer and which offer it is: which sessions and sounds you open, how far you listen, whether you have opened the subscribe screen, whether you have been shown a discount before, and whether you opened an offer we sent before. We do not use sleep, health, mood, audio, Rooms or chat content, or other sensitive data to choose which subscription offers you are shown or sent. You can object to us using your activity this way at any time by emailing salus@salus-rooms.com, and we will stop using it for that. Promotional notifications can be withdrawn in the app's Notifications screen or blocked in your phone settings. Opening a notification is recorded only after the app validates its opaque delivery token; a purchase is attributed only after Apple or Google verifies the store transaction. Seeing or receiving a notification is never counted as a purchase. Turning off Personalised offers in the app's Settings also stops your activity being used to choose offers.
• Communications: Anything you send us when you get in touch. The contact form on this website is run for us by Formspree, so the name, email address, subject and message you type there are sent to Formspree, which passes them to us by email and keeps a copy in our Formspree account so we can reply to you.
• Emails we send you, and what we can see about them: Our emails are delivered for us by Resend, and two things are measured. First, each email carries a small invisible image, so when your email program loads it we are told that the message was opened, together with the message, the subject line, your email address and the time. Second, every link in the email is rewritten so that a click passes through Resend before it takes you to the page you asked for: Resend records which link you clicked, the time, your IP address and your browser or email program's identifying text, then sends you straight on. Some of our own offer emails also use a second link of our own, on this website, which records the campaign, your email address, which link you followed, your IP address, your browser identifying text and the page you came from, and then sends you on in the same way. We use this only to see whether our emails are arriving and being read and to decide what to send next; we do not use it to build a profile of you, and we never sell it. Our lawful basis is legitimate interests, and you can object at any time by emailing salus@salus-rooms.com. If you would rather not be counted at all, most email programs let you stop images loading automatically, which stops the opening measurement, and unsubscribing stops the emails and the measurement together.

Our lawful bases under the UK GDPR are: contract (to provide the service, process payments, and carry out a TikTok connection or post that you request), legitimate interests (to run, secure, and improve the service via website and app analytics, and to use in-app activity to decide whether and which subscription offers to show or send you), consent (marketing emails, promotional app notifications, and cookies set by Google Analytics/AdSense), and explicit consent for health data (Article 9(2)(a)).

We do not sell, rent, or trade your personal data, and we never use health data for advertising.

3. Third-Party Services

We rely on a small set of providers to run Salūs, each processing data under its own privacy policy: Supabase (EU, accounts, promotional-notification consent and delivery records, encrypted TikTok connection data, and the non-storing video relay), Cloudflare (CDN & media), GitHub Pages (website hosting), Resend (email delivery, plus the opening and link-click measurement described in section 2), Stripe Payments Europe / Apple / Google Play (payments), PayPal (historic payments processor, earlier web subscriptions only), ipbase.com (city-level geolocation), Google Fonts (fonts), Formspree (the website contact form), YouTube, part of Google (the video player embedded on our About page), X Corp. and Pinterest (advertising measurement tags, loaded only after you accept cookies), Sentry (error monitoring), Plausible (cookie-free analytics), Google Firebase (app analytics and, only after the separate opt-in, notification delivery), Google Analytics (analytics), TikTok (Login Kit, creator-selected Direct Posts, install attribution, and a website advertising measurement tag that loads only after you accept cookies; see TikTok's Privacy Policy), and Google AdSense (advertising). Third-party AI services are used for audio narration only and receive no user data.

So you can see exactly who your browser talks to, these are the outside web addresses this website contacts, and what each one is for. cdn.jsdelivr.net is a public code library service that hands your browser two pieces of open-source software we use: the Supabase sign-in library, and the video player on our room pages. It receives your IP address and browser details, it sets no cookie, and it receives no account data. static.ads-twitter.com (X Corp.) and s.pinimg.com (Pinterest) are our advertising measurement tags, and neither loads at all unless you accept cookies. www.youtube-nocookie.com (Google) serves the privacy-enhanced player for the one video embedded on our About page. formspree.io delivers our contact form to us, so it receives whatever you type into that form, including your email address. play.google.com (Google) is the store listing our download buttons point at, and your browser only contacts it if you click one. To stop these: refuse cookies on our banner to keep the advertising tags off the page entirely, and use your browser's own content blocker for the rest.

Some providers are based in the US; where data leaves the UK we rely on the UK-US Data Bridge, Standard Contractual Clauses, or equivalent safeguards. Health (sleep) data and Sleep Recorder audio are never sent to us, and we never share them with any third party (see Section 5).

4. Cookies & Local Storage

Plausible analytics is cookie-free. Cookies from Google Analytics and AdSense are set only after consent. The X (Twitter), Pinterest and TikTok advertising tags are stricter still: they are not loaded onto the page at all until you accept cookies on our banner, and they are never loaded on the sign-up, log-in or subscribe pages. Playing the YouTube video embedded on our About page lets Google set its own storage on your device, under Google's privacy policy rather than ours. We use your browser's local/session storage for an anonymous visitor ID, your login token, your analytics opt-out preference, and short-lived TikTok sign-in security and return-page values. You can clear this any time via your browser, and opt out of analytics by appending ?salus_notrack to any page URL.

5. Health Data (Mobile Apps Only)

This section applies only to the mobile apps; the website accesses no health data.

With your explicit permission, the app reads only sleep data (sleep periods and stages) from Apple Health (iOS) or Health Connect (Android), no other health data type. It is read-only, processed on your device only, and is never uploaded to our servers, stored in our database, sold, or shared. It is used solely to show you your own recent nights and sleep trends.

The optional Sleep Recorder (iPhone and Android) records overnight audio only after you tap Start recording, and can analyse it on your device (on iPhone with Apple's on-device sound recognition, on Android with a sound model built into the app). We never receive or share your recordings or their analysis, and you can delete recordings at any time. On iPhone, if you use iCloud Backup, recordings are included in your own iCloud backup. Deleting a recording in Salus does not remove it from an iCloud backup that was already made. If other people sleep in the room, let them know before you record.

You can review or withdraw health permission at any time in Apple Health → Sharing → Apps or Health Connect → App permissions; the rest of the app works normally without it. Sleep data is special category data processed on the basis of your explicit consent (Article 9(2)(a)).

6. Storage, Security & Retention

Your data is encrypted in transit (TLS) and at rest, held on secure servers with access limited to those who need it. We will report any qualifying personal data breach to the ICO within 72 hours.

We keep data only as long as needed: account data is deleted within 30 days of account deletion, and a linked TikTok identity with its encrypted tokens is revoked at TikTok and deleted from our database as soon as you disconnect, or as part of deleting your account; payment records are kept for 7 years (HMRC); anonymous analytics for up to 24 months; newsletter sign-ups until you unsubscribe. Promotional-notification consent and delivery ledgers are kept for up to 24 months for compliance and dispute handling. A notification delivery token expires after no more than 30 days, attribution is accepted for no more than 7 days, and withdrawn, stale or invalid Firebase tokens are no longer used. TikTok video bytes and captions are not retained by us. Health (sleep) data is never stored by us, it stays in Apple Health or Health Connect. Sleep Recorder audio is never stored by us: it is kept on your phone until you delete it, and on iPhone it is also included in your own iCloud backup if you use iCloud Backup.

7. Your Rights

Under the UK GDPR you have the right to access, correct, delete, restrict, port, or object to the use of your personal data, and to withdraw consent at any time. If you connected TikTok, you can withdraw that connection yourself at any time with Disconnect TikTok in your account dashboard, or Disconnect in the posting panel: we ask TikTok to revoke our access straight away and delete the linked identity and its encrypted tokens from our records. Promotional notifications can be withdrawn in the app's Notifications screen or blocked in your phone settings; withdrawal stops further promotional sends and invalidates the registered token for our service. To exercise any other right, email salus@salus-rooms.com and we will respond within one month.

If you are unhappy with our response you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or call 0303 123 1113.

8. Changes & Contact

We may update this policy from time to time; the "last updated" date above shows the latest revision, and we will give notice of significant changes. Questions? Email salus@salus-rooms.com or get in touch.