Privacy Policy

This Privacy Policy explains how Breathmaxx (“Breathmaxx,” “we,” “us”) collects, uses, shares, and retains information when you visit https://www.breathmaxx.com, use the Breathmaxx application, create an account, connect Google, or subscribe through Stripe (the “Service”). It should be read with our Terms of Service.

We built this policy around the same topics a consumer would expect from a modern breath-training product: who we are, what we collect, why, who sees it, how long we keep it, and how you can ask us to delete it. We do not sell your personal information.

1. Who is responsible

Breathmaxx is the controller of personal information processed through the Service. Privacy requests: privacy@breathmaxx.com.

2. Information we collect

You provide

• Account details: Google name, email, profile image, and Google account identifier if you sign in.
• Billing details: email and customer identifiers created at Stripe checkout. We do not receive or store full card numbers. Stripe processes payment credentials.
• Hold log: the duration of a hold in seconds and the time it was saved, tied to your account, when Pro is active.
• Communications you send us (support, legal, or privacy emails).

We collect automatically

• A persistent device cookie named bmx_owner so the same browser can keep a guest identity, hold history, and Pro status.
• A short-lived cookie during Google sign-in to protect the OAuth state.
• Basic server logs that hosting may generate (IP address, user agent, timestamps, requested URL) to operate and secure the Service.
• Subscription and plan status returned by Stripe webhooks (active, trialing, past due, canceled, current period end).

We do not currently collect

• Heart rate, blood oxygen, or other biometric sensor streams.
• Precise GPS, contacts, photos from your camera roll, or microphone audio.
• Advertising identifiers for cross-site ads. We do not run a third-party ad network on the Service today.

If we add analytics or marketing tools later, we will update this Policy and, where required, obtain consent.

3. How we use information

• Provide timers, save and display your hold log, and restore Pro.
• Authenticate you with Google and keep your session on a device.
• Process subscriptions, invoices, taxes, and cancellations.
• Prevent abuse, debug outages, and allow designated admins to see aggregate signups, plan status, hold counts, and leaderboards.
• Comply with law and enforce the Terms, including safety rules.
• Respond to your requests.

Hold times are wellness and training records, not a medical file. Do not use the log to store diagnoses or other sensitive health notes. We do not use hold data to make automated decisions that produce legal effects about you.

4. Legal bases (EEA/UK and similar)

Where those laws apply, we process information because:

• It is necessary to perform the contract (run the Service, take payment, keep your log).
• We have a legitimate interest in securing the Service, understanding product usage at an aggregate level, and preventing fraud — balanced against your rights.
• You consent, where we ask for it (for example Google sign-in).
• We must comply with a legal obligation.

5. Who we share information with

We share information with service providers that process it on our instructions:

• Stripe, Inc. — payments and billing portal.
• Google LLC — if you choose Google sign-in.
• Vercel Inc. — application hosting.
• Neon, Inc. — database hosting for accounts and holds.
• Email or operations tools we may use to answer privacy@breathmaxx.com.

We may disclose information if required by law, to protect a person from serious harm, or in a merger, financing, or sale of assets, with continuing protection at least as described here.

Authorized Breathmaxx admins can view account emails, plan status, and hold leaderboards in an internal portal. That access is limited to people we designate. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

6. Cookies

Essential cookies keep you logged in as a guest and complete Google sign-in. The Service will not work correctly if you block them. We do not currently set advertising cookies. Browser controls can delete cookies; deleting bmx_owner may detach this device from your log until you sign in with Google again.

7. Retention

We keep account and hold records while your account exists and for a reasonable period afterward so you can resubscribe and recover history, unless you ask us to delete them or law requires a shorter or longer period. Server logs are kept for a short operational window. Stripe retains payment records under its own policy and legal duties.

8. Security

We use HTTPS, hosted infrastructure with access controls, and restricted admin emails. No method of transmission or storage is perfectly secure. You are responsible for the device you practice on and for keeping your Google account locked down.

9. International transfers

We and our processors may store and process information in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses used by those processors.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object or restrict certain processing, and to withdraw consent. You may also appeal a denial of a privacy request, and California residents may designate an authorized agent.

Email privacy@breathmaxx.com from the address on your account. We may need to verify you. You may also delete Google access by disconnecting the app in your Google account, and cancel Pro in the billing portal. We will not discriminate against you for exercising privacy rights.

California / US state privacy notice: in the last 12 months we have collected identifiers (email, cookie ID, Google ID), commercial information (plan and payment status), and wellness activity data (hold durations and timestamps). We use them for the purposes in Section 3. We do not sell or share personal information as those terms are used in the CCPA/CPRA. We do not use or disclose sensitive personal information for purposes other than those permitted by statute. We do not have actual knowledge that we sell or share the personal information of consumers under 16.

11. Children

The Service is for adults 18 and over. We do not knowingly collect personal information from children. Breath holding and breathwork are not appropriate unsupervised activities for minors. If we learn we have collected information from someone under 18, we will delete it. Contact privacy@breathmaxx.com.

12. Do Not Track

The Service does not respond to Do Not Track signals because there is no consistent industry standard for them. We do not track you across third-party websites for advertising.

13. Changes

We may update this Policy. The “Last updated” date will change. Material changes will be posted on this page or noticed in the Service. Continued use after the effective date means you acknowledge the updated Policy.

14. Contact

Privacy: privacy@breathmaxx.com. If you are in the EEA or UK and we appoint an EU/UK representative or DPO, we will list them here.