Privacy policy

1. Who is responsible

Lazar Jankovic is the operator and data controller for personal information processed for the purposes described in this policy. Contact: hi@misuto.app. Public correspondence address: Gavrila Principa 18, 18000 Niš, Serbia. Apple and other providers may also act independently for their own services, as explained in their privacy information.

2. Data in the iOS app

Apple Health

Apple Health is optional. If you choose to connect it and grant permission, misuto writes completed breathing time as Mindful Minutes, including the session timestamps and protocol name in the Health entry’s metadata. It does not request permission to read your Health data. A local queue holds sessions awaiting export. You can disconnect in misuto and revoke authorization through Apple Health or iOS Settings; disconnecting clears pending exports. Existing Health entries remain until you delete them in Apple Health. The operator and RevenueCat do not receive those entries. Apple controls any further Health backup or sync under your Apple settings. Consent to optional Health processing can be withdrawn without affecting earlier lawful processing.

iCloud sync

When iCloud is available for the app, misuto uses your private CloudKit database to sync saved protocol IDs and selected playback preferences: duration, pace, sound, vibration mode and strength, and Reduce Motion. This happens automatically when the app can access your iCloud account; no separate misuto account is created. Session history, activity totals, reminders, onboarding answers, and the Health export queue are excluded from this sync payload. Apple provides the iCloud service. You can manage iCloud access and available storage controls in your Apple settings. Removing the app does not necessarily remove existing iCloud records or device backups.

3. Website information

The website and its hosting providers may receive IP addresses, browser and device information, requested URLs, and access times to deliver pages and protect the service. Browser-based challenges store results in local browser storage; clearing that storage removes those local results. Essential language or preference storage may be used to remember your choices. Sentry error tracking and session replay are not enabled for the current website. Any future optional analytics or recording that requires consent must be disclosed and enabled only after the required consent is obtained. The iPhone app’s local sessions and Apple Health entries are separate from website processing.

4. Purchases

Apple processes payments and provides purchase and subscription information needed to administer access. misuto uses RevenueCat to validate purchases, restore access, determine subscription status, and provide subscription reporting. The SDK creates a random app user identifier and processes it with transaction and subscription information and service-related technical information, such as app version, operating system, locale, and currency where provided. A random identifier is not a promise that all related data is anonymous. misuto does not supply your name, email address, local breathing history, or Apple Health entries to RevenueCat. RevenueCat is initialized when the app launches, including before a purchase, so purchase-service requests may occur for free users too. The operator does not receive full payment-card details.

5. Service providers

Recipients include Apple for App Store billing, optional Apple Health, and private iCloud services; RevenueCat for purchase validation, subscription access, and subscription reporting; website hosting providers for page delivery and security; and email providers for messages you send to hi@misuto.app. A provider receives information relevant to its service, not unrestricted access to everything in the app. Apple’s independent processing is described in Apple’s privacy policy. See also Health App & Privacy and RevenueCat’s privacy information. You can request more information about the providers relevant to your interaction by contacting the operator.

6. Purposes and legal bases

Where data protection law requires a legal basis, the basis depends on the specific purpose. Optional permissions do not authorize unrelated uses. The applicable Serbian data protection law applies to the operator’s activities; EU or UK data protection rights also apply where their territorial requirements are met.

• Providing the service: information necessary to deliver requested app features, sync saved preferences, validate purchases, restore Pro access, and administer subscriptions is processed to perform the contract with you or take steps you request before a contract.
• Optional Health features: the Health export you choose is based on your permission and consent, including explicit consent where applicable health-data law requires it. You can withdraw it through the controls described above. Notifications also depend on your device permission. No permission is used for advertising or the sale of Health data.
• Support and security: responding to general inquiries, keeping the website and purchase service secure, preventing misuse, and maintaining necessary technical records can rely on legitimate interests where permitted. Those interests are providing a reliable service and resolving issues. You may object to processing based on legitimate interests; your interests and rights must be considered.
• Legal duties and claims: information may be retained or disclosed when necessary to meet an applicable legal obligation or establish, exercise, or defend legal claims. The particular basis depends on the duty or claim. Information is not used for an unrelated purpose merely because it is available.

misuto does not sell personal information or use Apple Health data for advertising. It does not make decisions about you with legal or similarly significant effects based solely on automated processing.

7. International processing

The operator is based in Serbia. Apple, RevenueCat, and website or email providers may process relevant information in other countries, including the United States. Provider roles, locations, and safeguards depend on the service. RevenueCat publishes a data processing addendum that includes EU Standard Contractual Clauses and UK transfer provisions. Apple explains its international processing in its privacy information. Where applicable law requires a transfer safeguard, the relevant transfer must be covered by a permitted mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact hi@misuto.app for information about safeguards relevant to data the operator controls; the availability of a provider document does not mean every service has the same arrangements.

8. Retention and security

Retention depends on the data and purpose. Local app information remains on your device until removed with the app or through available device controls; copies may remain in backups. Saved protocols and preferences in private iCloud can persist separately. Apple Health entries remain until removed there. Apple and RevenueCat retain relevant transaction records for subscription administration, restores, fraud prevention, and applicable legal requirements. Support correspondence is retained for resolving the request and any necessary follow-up, dispute, or legal duty; website records are retained for delivery, security investigations, and applicable obligations. The criteria are whether the purpose remains active, whether a record is still needed for a dispute or legal duty, and whether it can be deleted or de-identified. Contact hi@misuto.app for the retention information relevant to your request. Access is limited to what is needed to operate the service; no system can guarantee absolute security.

9. Your choices and rights

Depending on the law that applies, you may request access, a copy, correction, deletion, restriction, portability of eligible data, or object to processing based on legitimate interests. These rights have conditions and exceptions. You may withdraw consent for optional processing without affecting processing that was lawful before withdrawal. Send requests to hi@misuto.app or the correspondence address above. For GDPR requests, the operator will respond without undue delay and normally within one calendar month; any lawful extension will be explained within that initial period. Requests are normally free, subject to exceptions allowed by law. Only information reasonably needed to verify and handle a request will be requested. The operator cannot remotely retrieve device-only session history and does not need you to send Health records to exercise a right. Removing the app does not cancel a subscription or automatically delete Apple Health entries, iCloud records, or provider-held purchase records.

You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection. Where EU GDPR applies, you may also complain to a competent supervisory authority, including in your place of habitual residence, work, or the alleged infringement. Where UK GDPR applies, you may contact the UK Information Commissioner’s Office. Contacting the operator first is optional and does not remove those rights.

10. Children

misuto is not directed to children under 13. The operator does not knowingly collect their personal information through support or the website. If you believe a child has provided personal information, contact hi@misuto.app so it can be reviewed and handled appropriately. A parent or guardian must be involved where local law requires their authorization for a minor’s use or consent.

11. Changes

This policy may change when features, providers, or legal obligations change. The date above identifies the version. Material changes will be communicated where required. If a new purpose requires consent, updating this policy does not replace the need to obtain it.

12. Contact

For privacy questions and requests, contact Lazar Jankovic at hi@misuto.app or Gavrila Principa 18, 18000 Niš, Serbia. Please describe the information and interaction involved so the request can be directed to the relevant service.