Privacy Policy
Last updated: July 2026
Calmgraph ("the app") is designed with your privacy first. The app runs fully offline and requires no account.
1. Information we collect
The app collects and transmits no information that identifies you. Your check-ins, scores, cause tags, and settings are stored only on your device. Neither the developer nor any third party can access this data.
2. Health data (HealthKit)
Only with your permission, the app reads heart rate variability (HRV/SDNN), resting heart rate, and sleep from HealthKit on a read-only basis to compute your stress score. It also reads step count and respiratory rate, read-only, solely for the “automatic tags” section of the correlation report; they are not used to compute the score. The app writes no data to HealthKit.
- HealthKit data is processed only on your device, and only the computed score is stored (the raw data is not duplicated).
- HealthKit data is never stored or synced to iCloud or any other cloud.
- HealthKit data is never provided to or shared with third parties.
- HealthKit data is never used for advertising or marketing.
You can change Health permissions anytime in iOS under Settings > Privacy & Security > Health. Even without permission, you can use every feature of the app via subjective check-ins.
3. Tracking & advertising
The app does not perform tracking (ATT) and uses no third-party analytics or advertising SDKs.
4. Deleting your data
Deleting the app from your device deletes all data it stored.
5. Contact
Questions about this policy: support@freetokyolabs.com
How the Android version handles your data
The following describes the Android version (Android 9.0 and later). Everything above applies to iOS; only the points below differ on Android.
Your records are stored in a local database (Room) on your device. They are never sent to the developer's servers.
Both cloud backup and device-to-device transfer are disabled (allowBackup="false" plus data_extraction_rules.xml). To move to a new device, export a backup yourself from inside the app.
With your permission, Calmgraph uses Health Connect on your device. It reads heart rate variability, respiratory rate, resting heart rate, sleep and steps. Access is read-only; nothing is ever written back.
Health data handled through Health Connect is used solely to calculate and display results inside the app. It is never used for advertising, shared with data brokers, or disclosed to third parties. You can revoke Health Connect permission at any time in your device settings.
The only external services used are Google Play Billing (purchases), Google Play In-app Review (rating prompt) and the Wear OS Data Layer (syncing with your watch). Google processes all payments; card details never reach the developer.
The only device permission the phone app requests is showing notifications. It is asked for only when you use the matching feature, and declining leaves the rest of the app usable.
The Android version also runs on Wear OS watches. Data moving between the watch and the phone is carried by the Wear OS Data Layer in Google Play services and never passes through the developer's servers. When the watch and the phone are not connected over Bluetooth, it may be relayed through Google's servers (end-to-end encrypted on that route).
The watch app asks for no permissions. It declares only permissions that Android grants without asking: vibration.
The watch app has Google cloud backup disabled, but direct device-to-device transfer when you change watches follows the Android default.
Uninstalling the app deletes the data on your device.
Controller, contact and your rights
This app is provided by Freetokyo Labs, which acts as the data controller. For any question about this policy or about personal data, contact support@freetokyolabs.com. We normally reply within five business days.
If you are in the EU, the EEA or the UK, the GDPR gives you the right to access, rectify, erase, restrict and port your personal data, to withdraw consent and to object to processing. You may also lodge a complaint with your national supervisory authority.
If you are a California resident, the CCPA/CPRA gives you the right to know, delete and correct the personal information collected about you, and to opt out of its sale or sharing. We do not sell or share personal information.
Where this app stores data only on your device, we have no access to it, so most of these rights are exercised directly on the device: delete or export inside the app, or delete the app. We will still answer any request you send us.
Retention: on-device data is kept until you delete it or remove the app. Support emails are deleted 24 months after the request is closed.