Privacy Policy

Effective date: 2 November 2026
Who we are: Kymo is published by Justin Gibbs (“Kymo”, “we”, “us”). We are the controller of the little personal data described here.
Contact: kymobreathwork@gmail.com, or the support page at kymo-breathwork.pages.dev/support/.

The short version

• Kymo has no accounts, no ads and no tracking. We don’t sell or share your personal data.
• Your practice stays on your phone. Sessions, heart readings, check-ins, your plan, your patterns and your settings are stored on the device only. We can’t see them.
• The camera is used only during a heart reading. The video is processed on your phone, frame by frame, and is never recorded, saved or sent.
• If you subscribe, Apple or Google handles the payment, and our subscription provider, RevenueCat, keeps a record of the purchase under an anonymous ID so your subscription works. That’s the only data the app sends anywhere.
• Reminders are local notifications scheduled on your phone. No server knows when you practice.
• Apple Health is optional, and Kymo only writes to it (Mindful Minutes). It never reads your health data.
• You can delete everything in the app with Settings › Erase all data, or by deleting the app.

What stays on your phone

Kymo stores the following in the app’s private storage on your device. None of it is sent to us or to anyone else:

Your phone’s own backups (iCloud Backup, or Google’s Android backup, if you use them) may include this storage, as they do for most apps; that’s between you and Apple or Google. Kymo doesn’t sync it to any cloud service of its own.

The camera and heart readings

A heart reading uses the back camera and the flash while your fingertip rests over them. Kymo measures the tiny changes in color as your pulse moves blood through your fingertip and turns them into an estimated heart rate and heart-rate variability.

• The video is processed on your phone in memory and is never recorded, saved or sent. Only the resulting numbers are stored, on your device. Live heart readings during a session aren’t stored at all.
• The camera is on only while a reading runs, and you can stop or skip any reading. Kymo asks for camera access only when you start your first reading.
• Heart readings are wellness estimates. Kymo is not a medical device and isn’t for diagnosing or monitoring any condition. How the estimate works, and how accurate it is, is described in How Kymo’s heart reading works.

Kymo never uses the microphone. iOS may list a microphone description for Kymo because the camera component we use includes microphone support; Kymo never asks for microphone access.

Apple Health

If you turn on Settings › Apple Health, Kymo saves each completed session of a minute or more to Apple Health as Mindful Minutes (when it started and ended). Kymo asks only to write that one type. It doesn’t read any of your health data, and it doesn’t write heart rate or heart-rate variability. What’s in Apple Health is managed by Apple and your Health app settings; turning the setting off in Kymo stops new entries. Health data is never used for advertising, never shared and never leaves your device through Kymo.

Subscriptions and purchases

Kymo Premium is sold through the App Store or Google Play. Apple or Google processes your payment; we never see your card or payment details.

We use RevenueCat (RevenueCat, Inc., USA) to manage subscriptions. When you open the app, see the plans, buy, restore or renew, the app and RevenueCat exchange:

• an anonymous app user ID that RevenueCat generates (it isn’t linked to your name, email or your Apple or Google account, and we don’t set an ID of our own);
• your purchase history and subscription status from the store: product, dates, renewal and trial status, storefront country and currency;
• the technical details any connection needs: app version, device and operating system type, and your IP address.

We use this only to unlock Premium, restore it on a new phone, show your membership status, remind you before a free trial ends if you asked us to, and see overall subscription numbers (for example, how many trials become subscriptions). RevenueCat processes it on our behalf under its own privacy policy and doesn’t use it for advertising. Apple’s and Google’s handling of your purchase is covered by their own privacy policies.

Notifications

Daily reminders, and the optional reminder two days before a free trial ends, are scheduled locally on your phone at the times you choose. They don’t use push notifications, and no server knows when or whether you practice. Kymo asks for notification permission only when you choose a reminder. Turn them off in the app or in your phone’s settings at any time.

Sharing

When you share your trace, a week or your month card, or a breathe-with-me link, your phone’s share sheet sends exactly what you see to the app or person you choose; it doesn’t pass through us. If you choose Save Image, your phone asks once for permission to add to Photos; Kymo can then add that one image but can’t see or read your library.

A breathe-with-me link contains only the breathing pattern (its timing), the visual and the name you gave it, never your readings or history. When someone opens it in a browser, our website plays the pattern; like any website, the server that hosts it (Cloudflare, Inc.) briefly logs standard request data (IP address, browser type, the page requested) for security and reliability. We don’t use those logs to identify anyone.

Our website

Our website (kymo-breathwork.pages.dev) hosts this policy, our terms, support and how heart readings work. It sets no cookies, runs no analytics or advertising, and asks you for nothing. Like any website, its host (Cloudflare, Inc.) briefly logs standard request data (IP address, browser type, the page requested) for security and reliability.

Analytics

Kymo 1.0 contains no analytics, advertising or crash-reporting service. If we add one, we’ll update this policy and the store privacy details first, and say so in the release notes. It would measure how the app is used (for example, which screens are opened), never your heart readings, check-in tags, pattern names or anything you type.

What we don’t do

• No accounts, sign-in or profiles.
• No advertising, and no advertising or tracking SDKs. We don’t use Apple’s or Google’s advertising identifiers, and we don’t track you across other companies’ apps or websites.
• No selling, renting or “sharing” of personal data (as California law uses that word), and no data brokers.
• No location, contacts or microphone access. Kymo never reads your photos; it only adds an image when you choose Save Image.
• Your heart readings and check-ins are consumer health data under some US state laws (for example Washington’s My Health My Data Act). Kymo doesn’t collect them: they never leave your phone.

Children

Kymo isn’t directed at children under 13 (or the minimum digital age where you live), and we don’t knowingly collect personal data from them. Kymo keeps your practice on your device and has no accounts, so we hold no profile of anyone. If you believe a child has sent us personal data, for example in an email, contact us and we’ll delete it.

Keeping and deleting your data

• On your phone: everything Kymo stores stays until you delete it. Settings › Erase all data removes your practice, plan, history and settings from the phone at once (your subscription itself isn’t affected; restore it any time). Deleting the app removes it too.
• Apple Health: entries Kymo wrote stay in Apple Health until you delete them there (Health app › your profile › Apps › Kymo).
• Purchases: your subscription record stays with Apple or Google and with RevenueCat for as long as it’s needed to provide and restore your subscription and to meet tax and accounting law. To ask us to delete the RevenueCat record, email kymobreathwork@gmail.com; we’ll delete it in RevenueCat within 30 days (open Settings › Kymo Premium first and send us a screenshot, or tell us the approximate purchase date, so we can find it). Cancel the subscription itself in your App Store or Google Play account; deleting the record doesn’t cancel it.
• Emails to us: kept only as long as we need them to help you, then deleted.

Your rights

Depending on where you live (for example under the GDPR in the EU, the UK GDPR, or US state privacy laws such as California’s), you may have the right to know what personal data we hold, to access, correct, delete or export it, and to object to or restrict how it’s used. Almost everything Kymo knows about you is on your own phone, where you already control it. For anything else, email kymobreathwork@gmail.com; we’ll reply within 30 days and won’t treat you differently for asking. You can also complain to your local data protection authority.

Our legal bases (EU and UK): for purchase records, performing our contract with you (providing the subscription) and meeting legal obligations (tax records); for overall subscription numbers, our legitimate interest in understanding how Kymo is doing, using anonymous data only; for emails you send us, our legitimate interest in answering them.

Security

Data on your phone is protected by your device’s own security (its passcode and encryption). Data exchanged with RevenueCat, the stores and our website travels over encrypted connections (HTTPS).

International transfers

RevenueCat, the app stores and our hosting providers may process data in the United States and other countries. Where the law requires it, those transfers are covered by the EU Standard Contractual Clauses, the UK addendum, or an equivalent safeguard such as the EU-US Data Privacy Framework.

Changes

If we change what Kymo collects, we’ll update this policy and its effective date before the change ships, and say so in the app’s release notes. Material changes (for example, adding analytics or accounts) will be explained in the app before they take effect.

Contact

Justin Gibbs · kymobreathwork@gmail.com