1. Introduction
Sabah ("we", "our", or "the app") is a wellness application built around a ten-minute daily morning ritual. We take your privacy seriously. This Privacy Policy explains what personal data we collect, how we use it, and your rights in relation to it.
This policy applies to Sabah on both iPhone (through the Apple App Store) and Android (through Google Play). By using Sabah, you agree to the practices described here. If you do not agree, please do not use the app.
2. Information We Collect
2.1 Account Information
Sabah uses Firebase Authentication (a Google service) to create and manage your account. Depending on your device and the sign-in method you choose, we may receive:
- A unique account identifier
- Your name, if you choose to share it
- Your email address, or a private relay address if your sign-in provider offers one and you choose to use it
On iPhone, Sign in with Apple is available and lets you hide your real email address using Apple's private relay service. We never receive your password from any sign-in provider.
2.2 Usage Data
We collect information about how you use the app, including:
- Sessions completed (dates and sequences)
- Breathwork protocols used
- Streak and consistency data
- Subscription status and tier (free, monthly premium, or annual premium)
2.3 Device Information
We may collect basic device information such as device type, operating system version, and app version, for the purpose of diagnosing technical issues.
2.4 Information We Do Not Collect
We do not collect your location, contacts, camera access, microphone data, health data, or any information beyond what is described above.
3. How We Use Your Information
We use the information we collect to:
- Create and maintain your Sabah account
- Personalise your in-app experience (streaks, progress, preferences)
- Process and manage your subscription
- Send you optional push notifications (daily reminders, milestone acknowledgements)
- Improve the app and diagnose technical issues
- Comply with applicable legal obligations
4. Third-Party Services
4.1 Firebase (Google)
We use Firebase Authentication and Cloud Firestore, both provided by Google, to store your account credentials, session history, and streak data. Firebase processes data in accordance with Google's privacy practices. More information: firebase.google.com/support/privacy
4.2 Apple — App Store Purchases
On iPhone, subscriptions are processed entirely through Apple's in-app purchase system. Apple confirms your subscription status to the app. Payment card details are handled by Apple and are never shared with us. More information: apple.com/legal/privacy
4.3 Google Play — Play Store Purchases
On Android, subscriptions are processed entirely through Google Play Billing. Google confirms your subscription status to the app. Payment card details are handled by Google and are never shared with us. More information: policies.google.com/privacy
4.4 Email
We use Resend to send account and lifecycle emails, such as your welcome email and optional onboarding messages. Resend receives your email address for the sole purpose of delivering those messages.
4.5 Video Delivery
Movement sessions are streamed through Vimeo. Vimeo may receive standard technical request data, such as IP address and device type, in order to deliver video playback.
4.6 What We Do Not Use
We do not use third-party advertising networks, and we do not sell or share your personal data with advertisers.
5. Data Retention
We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data from our systems within 30 days, except where we are required to retain it for legal or compliance purposes.
6. Your Rights
Depending on your location, you may have the following rights in relation to your personal data:
- Right to access: request a copy of the data we hold about you
- Right to rectification: request that we correct inaccurate data
- Right to erasure: request that we delete your data ("right to be forgotten")
- Right to data portability: request your data in a machine-readable format
- Right to object: object to our processing of your data in certain circumstances
To exercise any of these rights, contact us at hello@sabahapp.com. You can also delete your account from within the app at any time.
7. GDPR (European Users)
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation. Our lawful bases for processing your data are:
- Performance of a contract: to provide you with the Sabah service
- Legitimate interests: to improve the app and ensure its security
- Your consent: for optional notifications and communications
You have the right to lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection law.
8. CCPA (California Users)
If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell your personal information.
9. Children's Privacy
Sabah is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected data from a child under 13, we will delete it promptly.
10. Push Notifications
With your permission, we may send push notifications including daily morning reminders, streak milestones, and re-engagement messages. You can turn notifications off at any time in your device settings or within Sabah's own settings.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. All data is transmitted over encrypted connections (HTTPS/TLS). However, no method of transmission over the internet is entirely secure, and we cannot guarantee absolute security.
12. International Data Transfers
Your data may be transferred to and processed in countries outside your country of residence, including the United States, where our service providers (Google, Apple, Resend, and Vimeo) operate. These transfers are subject to appropriate safeguards in accordance with applicable data protection law.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via an in-app notification or by updating the effective date at the top of this document. Continued use of Sabah after changes constitutes acceptance of the updated policy.
14. Contact Us
If you have questions, concerns, or requests relating to this Privacy Policy, please contact us: