Privacy Policy
Last updated 30 October 2026
The short version. You can use Alpha State without an account, and then everything stays on your device. If you create an account, we store your email and your breathing sessions so you can see your progress on any device. We don't sell your data, show ads, use analytics or track you. You can download or delete everything at any time from Settings.
1. Who is responsible
The Alpha State app ("Alpha State", "we", "us") is run by Ricardo Guerreiro, Portugal, the data controller under the EU General Data Protection Regulation (GDPR).
Contact for anything about privacy: [email protected]
2. What we collect and why
Without an account
Your sessions, settings and the date you accepted our Terms are saved only in your browser's storage on your device. They are never sent to us. Deleting the app or clearing your browser data removes them.
With an account
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | To create your account and send your sign-in codes | Contract (Art. 6(1)(b)) |
| Breathing sessions: date and time, technique, duration, rounds, breath-hold times, cycles | To save your progress and show it on any device | Your explicit consent (Art. 9(2)(a)), because breathing data may say something about your health |
| Consent records: which Terms version you accepted and when you gave consent | To prove we asked properly | Legal obligation (Art. 6(1)(c)) |
| Technical data: IP address, device and browser type, sign-in times | To keep accounts secure and stop abuse | Legitimate interest (Art. 6(1)(f)) |
We do not collect your name, location, contacts, photos or payment details. The app has no advertising, no analytics and no tracking, and it sets no cookies. It only uses your device's storage for things it needs to work (your settings, your sessions and keeping you signed in).
3. Who processes your data for us
We use a small number of providers who process data only on our instructions, under data processing agreements:
- Supabase: account sign-in and database. Data is stored in the European Union (Frankfurt, Germany).
- Cloudflare: hosting and delivering the app, and protecting it from attacks.
- Our email delivery provider (Resend): sends your sign-in codes.
Some of these companies are based in the United States. Where data leaves the EU, it is protected by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
We never sell or rent your data, and we never share it with advertisers. We only disclose it if the law requires us to.
4. How long we keep it
- Your account and sessions: until you delete them or your account.
- When you delete your account, everything in it is erased immediately from our live database. Copies in our provider's encrypted backups expire within 30 days.
- Security logs: for a limited period (up to 90 days) by our providers.
- Accounts with no sign-in for 3 years may be deleted after we email you a warning.
5. Your rights
Under the GDPR you can:
- Access and take your data: Settings → Your data → Download my data.
- Delete it: Settings → Delete all my sessions, or Settings → Account → Delete account.
- Withdraw your consent to storing your sessions at any time by deleting them or your account. This doesn't affect anything done before you withdrew it.
- Correct, restrict or object to how we use your data, by emailing us.
- Complain to the Portuguese data protection authority, CNPD, or the authority where you live.
We reply to requests within one month.
How to delete your account
- In the app: open Settings → Account → Delete account, and confirm. Your account, consent records and every saved session are deleted at once, on all devices.
- Without the app: email [email protected] from the address you signed up with and ask us to delete your account. We'll do it within 30 days and confirm by email.
6. Security
Everything is sent over encrypted connections (HTTPS). There are no passwords to leak: you sign in with a one-time code sent to your email. Database rules make sure each account can only ever read and change its own data.
7. Age
Alpha State is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think a minor has created an account, email us and we will delete it.
8. Changes
If we change this policy in a way that matters, we'll update the date above and ask you to review it in the app before you continue.