Privacy Policy
SaunaFlow
© 2026 SaunaFlow / Developer: Freetokyo Labs
1. Information handled by the app
Based on the app description and support content, the app handles the following data: Presets (phase structure, duration, set count, name) — stored on-device.
Session history (date, completion, score, notes) — stored on-device.
Purchase status (premium unlock state) — stored on-device.
Heart rate via HealthKit (recorded on Apple Watch during a session; used only to display your curve and score) — stored on-device.
No personal data transmission to external servers is described.
2. Data storage
Presets, history, and notes are stored on-device. The practical privacy advantage is reduced dependence on external servers. Cross-device web sync is not part of the current feature set.
3. Health data (HealthKit)
From v1.
1, SaunaFlow reads your heart rate from HealthKit during a session that uses Apple Watch.
This heart-rate data is used only to visualize your totonoi curve and to factor heart-rate recovery into the Session Score.
Heart-rate data is stored only on-device (and in your own private iCloud if enabled).
It is never transmitted to the developer or any third party.
It is never used for advertising or analytics.
HealthKit access is requested on first use and can be revoked anytime in Settings > Privacy & Security > Health.
Exported backups (JSON) include each session's heart-rate timeline, so choose carefully where you save or share that file.
4. In-app purchases
Premium purchases are processed through Apple App Store billing. The developer does not directly store payment details. See Apple's privacy information at apple.com/legal/privacy for Apple's handling of that data.
5. Third-party SDKs and advertising
The current app does not use third-party ad SDKs, analytics SDKs, or crash-reporting SDKs. If that changes, this page and App Store privacy disclosures will be updated together.
6. Contact
For privacy-related questions, contact us by email: support@freetokyolabs.com
How the Android version handles your data
The following describes the Android version (Android 9.0 and later). Everything above applies to iOS; only the points below differ on Android.
Your records are stored in a local database (Room) on your device. They are never sent to the developer's servers.
Both cloud backup and device-to-device transfer are disabled (allowBackup="false" plus data_extraction_rules.xml). To move to a new device, export a backup yourself from inside the app.
With your permission, SaunaFlow uses Health Connect on your device. It writes exercise and heart rate.
Health data handled through Health Connect is used solely to calculate and display results inside the app. It is never used for advertising, shared with data brokers, or disclosed to third parties. You can revoke Health Connect permission at any time in your device settings.
The only external services used are Google Play Billing (purchases), Google Play In-app Review (rating prompt) and the Wear OS Data Layer (syncing with your watch). Google processes all payments; card details never reach the developer.
The only device permission the phone app requests is showing notifications. It is asked for only when you use the matching feature, and declining leaves the rest of the app usable.
The Android version also runs on Wear OS watches. Data moving between the watch and the phone is carried by the Wear OS Data Layer in Google Play services and never passes through the developer's servers. When the watch and the phone are not connected over Bluetooth, it may be relayed through Google's servers (end-to-end encrypted on that route).
With your permission, heart rate is measured by the watch's heart-rate sensor (Health Services).
The only permissions the watch app asks for are the heart-rate sensor and showing notifications; it asks when you open the watch app.
It also declares permissions that Android grants without asking: keeping a session running in the foreground while the screen is off (a foreground service) and vibration.
Cloud backup and device-to-device transfer are disabled in the watch app too.
Uninstalling the app deletes the data on your device. With backup and transfer disabled, no copy remains outside it.
Controller, contact and your rights
This app is provided by Freetokyo Labs, which acts as the data controller. For any question about this policy or about personal data, contact support@freetokyolabs.com. We normally reply within five business days.
If you are in the EU, the EEA or the UK, the GDPR gives you the right to access, rectify, erase, restrict and port your personal data, to withdraw consent and to object to processing. You may also lodge a complaint with your national supervisory authority.
If you are a California resident, the CCPA/CPRA gives you the right to know, delete and correct the personal information collected about you, and to opt out of its sale or sharing. We do not sell or share personal information.
Where this app stores data only on your device, we have no access to it, so most of these rights are exercised directly on the device: delete or export inside the app, or delete the app. We will still answer any request you send us.
Retention: on-device data is kept until you delete it or remove the app. Support emails are deleted 24 months after the request is closed.