Privacy Policy for the SAYA App

Note: This English version is provided for convenience. The German version is legally binding.

This privacy policy covers the SAYA app (mobile application). The website saya-sleep.com and its waitlist are covered by the website privacy policy.

SAYA analyses your sleep and overnight recovery based on data from your Garmin smartwatch and your own entries. That means we process health data — the most sensitive category of personal data there is. We treat it accordingly: storage in Germany, no advertising, no sale of data, no tracking SDKs, and deletion available in the app at any time.

1. Controller

Lukas Bröll Bodmanstr. 23 87439 Kempten Germany

Email: l.broell@freenet.de

2. What data we process

a) Account data

  • Email address and sign-in method (email/password or Google Sign-In)
  • Internal user ID, registration time, app settings

b) Health and fitness data from your Garmin smartwatch

Only if you actively connect your Garmin account to SAYA, Garmin continuously transmits the following data to us based on your authorization:

  • Heart rate (daily curve) and resting heart rate
  • Heart rate variability (HRV)
  • Sleep data (sleep stages, duration, sleep score)
  • Stress levels
  • Activities/workouts (type, duration, intensity, calories)
  • Steps and movement data

c) Your manual entries

  • Meal log (timing, size, composition)
  • Evening habits (e.g. wind-down activities, screen time, caffeine, alcohol)
  • Sleep-environment details

d) Values computed from the above

  • Scores (e.g. Recovery Score, Evening Score, Readiness Score)
  • Sleep profile, chronotype, recommended personal timings
  • Statistical relationships between your habits and your recovery (correlations)

3. Purposes and legal bases

Purposes: providing the app's features — analysing sleep and recovery, computing your personal scores and recommendations, displaying your history — plus managing your account and ensuring secure, stable operation.

Legal bases:

  • Account data and app operation: Art. 6(1)(b) GDPR (performance of the user agreement).
  • Health and fitness data (Art. 9 GDPR, "special categories"): your explicit consent pursuant to Art. 9(2)(a) GDPR, which we obtain expressly when you connect your Garmin account. Without this consent, the app's core features cannot be provided.

Withdrawal: You can withdraw your consent at any time with effect for the future:

  • Disconnect your Garmin account (in the app settings or in your Garmin account): no new data will flow.
  • Delete your account (directly in the app): your account and stored data are deleted (see Section 6).

4. Recipients and processors

Google (Firebase)

The app uses Google's Firebase platform for sign-in (Firebase Authentication), data storage (Cloud Firestore) and data processing (Cloud Functions). Contracting party: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Storage and processing location: the database and processing functions run in the Google Cloud region europe-west3 (Frankfurt, Germany).

Third-country access: even with EU storage, access by US-based Google group companies (e.g. for support/maintenance) cannot be fully excluded. Appropriate safeguards apply: Google LLC's certification under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses as part of the Google Cloud Data Processing Addendum (a processing agreement pursuant to Art. 28 GDPR).

Garmin

The transfer of your data from Garmin to SAYA is based on the authorization you grant in your Garmin account (OAuth). For the processing of your data within Garmin's own services, Garmin is an independent controller — see Garmin's privacy policy. You can revoke the authorization in your Garmin account at any time.

No other recipients

We do not sell your data, do not share it for advertising purposes, and do not embed any advertising or tracking SDKs in the app.

5. Retention

Your data is stored for as long as your SAYA account exists. Historical measurements are core to the app's function (trends, personal baselines) and are therefore retained for the duration of your use.

6. Deleting your account

You can delete your account at any time directly in the app (Settings → Delete account). This deletes your account and the personal data stored in SAYA — including all health and fitness data. Alternatively, you can request deletion informally by emailing l.broell@freenet.de. Please note: data in your Garmin account is not affected; that data is managed by Garmin.

7. Data security

All data is transmitted encrypted (TLS). Access to your data is protected by authentication and server-side security rules, so that only your own account can access your data.

8. Minimum age

The app is intended for people aged 16 or older. There is no child-protection mechanism for younger users; please do not use the app if you are under 16.

9. Your privacy rights

You have the rights under Art. 15–21 GDPR: access, rectification, erasure, restriction of processing, data portability and objection, plus the right to withdraw consent at any time (Art. 7(3) GDPR) and to lodge a complaint with a supervisory authority (e.g. the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany). Contact: l.broell@freenet.de.

For users outside the EU (including the United States): the same protections apply to you, and we honor access and deletion requests regardless of where you live.

10. Not a medical device

SAYA is a wellness product, not a medical device. The app does not diagnose and is no substitute for professional medical advice or treatment. If you suspect a sleep disorder or other condition, please consult a medical professional.

11. Changes to this policy

We will update this privacy policy whenever the data processing in the app changes (e.g. new features). We will inform you of material changes within the app.

Last updated: July 2026