Privacy Policy

Last updated: 2026-08-25

RhythmicFlow ("we", "the app") is a breathing and meditation app developed by Satyam Technologies Private Limited. This policy explains what data the app collects, why, and what choices you have.

TL;DR

Everything is local by default. Your rhythms, practice history, uploaded backgrounds, and reminder settings live in your phone's private app storage. We never receive them. The only copies that ever leave the app are your device's own Google backup (Android Auto Backup) and any backup file you choose to export from Settings — both stay in your own Google account or storage, which we can't see.
No ads are shown in the app. We do collect basic first-party usage analytics — anonymous app-usage events (like app opens and breathing-session counts) sent only to our own backend to understand how the app is used. See §1.4. We also use Meta's (Facebook's) App Events SDK to measure how our own ad campaigns perform — it sends app-install/open events and your device's advertising ID to Meta. See §1.5.
Account data (if you choose to create an account): username, email, password hash, optional phone number, and optional profile picture, sent only to our own backend and only to enable preset sync and mobile-OTP login.
You can delete your data at any time — remove individual sessions, rhythms, and uploads in the app, or clear the app's storage to wipe everything. See the account & data deletion page.

1. What we collect

1.1 Data that stays on your device

The following data is created, stored, and used only on your device. We never see it or transmit it to our servers. (Android's own Auto Backup may copy it to your personal Google account, and Premium members can export a backup file themselves — see §3 — but neither is ever visible to us.)

Your custom breathing rhythms (name, inhale/hold/exhale/hold durations, animation style, color overrides, appearance settings).
Your practice-session history (start time, end time, duration, cycles completed, rhythm name).
Uploaded background images, background music, breathing sounds, and hold sounds.
App preferences (dark/light theme choice, preset visibility, reminder schedules, hidden preset list).
Playback state for the lock-screen notification.

1.2 Data sent to our servers (only when you choose to sign in)

If you tap Register or Log in, the app sends the following to our own backend (api.rhythmicflow.app):

Username
Email address
Password, hashed on-device with bcrypt before transmission.
Mobile phone number (optional, used only if you enable mobile-OTP login).
Profile picture (optional).
Social sign-in identifiers (Google, Facebook, or X) if you sign in with one of those providers — stored only to match you to your account on subsequent sign-ins.
Preset edits you publish (only if you are an admin user editing a built-in preset via the admin UI).

This data lives in our database and is used solely to:

Authenticate you on subsequent logins.
Send password-reset codes to your email.
Send OTP codes to your mobile number via ClickSend's SMS gateway.
Sync admin-authored preset edits to every other user on their next login.

We do not sell this data, share it with advertisers, or use it for any purpose other than what is listed above.

1.3 Data we never collect

Location data
Contacts
Microphone recordings
Camera photos (beyond the one you explicitly pick as a background image, which stays on your device)
Calendar or SMS contents
Device identifiers, beyond the advertising ID described in §1.5

1.4 Anonymous usage analytics

To understand how the app is used — which features people reach and where they drop off — the app sends a small set of first-party usage events to our own backend (api.rhythmicflow.app). This is not a third-party analytics service: no Google Analytics, Firebase, or similar SDK is involved, and the data is never shared with advertisers or anyone else.

What each event contains:

An anonymous install id — a random identifier generated by the app on first launch. It is not your device id, advertising id, or any hardware identifier, and it resets if you reinstall or clear the app's storage.
The event type: app opened, a breathing session started or completed, the Premium screen was viewed, or a purchase was started/finished.
For a completed session, the preset name (e.g. “Box Breathing”) and the session length.
The app version.
If you are signed in, your account id is attached so we can see aggregate per-account usage. Events sent while you are signed out carry only the anonymous install id.

We use this only to improve the app and understand usage. We do not use it for advertising, and we do not sell or share it.

1.5 Ad attribution (Meta / Facebook App Events)

We run ads for RhythmicFlow on Meta's platforms (Facebook and Instagram). To measure whether those ads lead to installs, the app includes Meta's App Events SDK, which automatically sends Meta the following when the app is opened:

Your device's advertising ID (Android's GAID) — a resettable identifier used industry-wide for ad measurement. You can reset or limit it in your device's Google settings (Google Settings → Ads).
Basic app-activation events: that the app was installed and opened, and the app version.
Standard device/network metadata Meta's SDK collects for this purpose (e.g. device model, OS version, locale, carrier), per Meta's own privacy policy.

This is separate from the first-party analytics in §1.4 and from the optional “Sign in with Facebook” feature in §1.2/§2 — it runs regardless of whether you ever use Facebook sign-in, as long as you were served one of our ads and opened the app. We do not control what Meta does with this data beyond our own ad-measurement use; see Meta's privacy policy for how they handle it.

2. Third parties

RhythmicFlow uses the following third-party services. Each only receives the minimum data necessary to do its job:

Service	What it sees	Why
Google Play Billing	Purchase receipts for Premium subscriptions	Process purchases; restore entitlements
ClickSend SMS	Your mobile number and a generated OTP code	Deliver mobile-OTP login codes
Google, Facebook, X (if you use social sign-in)	The identifier and profile info returned by the provider (name, email where available, profile picture URL)	Authenticate you via your chosen provider
Meta (Facebook) App Events	Your device's advertising ID, app-install/open events, and standard device metadata — see §1.5	Measure the performance of our own Meta/Instagram ad campaigns
Our own backend	Everything listed in §1.2, plus the anonymous usage events in §1.4	Authenticate, sync preset edits, and record first-party usage analytics

No other third parties receive data from the app. We do not use Google Analytics, Firebase Analytics, Crashlytics, AppsFlyer, Adjust, Amplitude, Mixpanel, or any similar general-purpose analytics SDK — the usage analytics in §1.4 are recorded on our own backend, not by a third party. The one third-party SDK the app does include is Meta's App Events SDK, described in §1.5, used solely for ad-campaign measurement.

3. Your choices

Use the app without an account. Every breathing feature works offline without signing in. Sign-up is optional.
Export your own backup (Premium/admin). Settings → Backup & restore → “Back up my data” writes a .zip you save wherever you like (including your own Google Drive). It stays in your storage — we never receive it.
Delete your on-device data. Remove individual practice sessions from the Activity tab, custom rhythms from Home, and uploads from the media pickers — or clear the app's storage (Settings → Apps → RhythmicFlow → Storage → Clear storage) or uninstall to wipe everything at once.
Delete your account. Email support@rhythmicflow.app with your username; we delete the server-side record within 7 days and reply when done. Full steps on the account & data deletion page.

4. Children

RhythmicFlow is suitable for users of any age, but we do not knowingly collect data from children under 13. If you are under 13, ask a parent or guardian before creating an account.

5. Security

Passwords are hashed on the device before being sent to the backend.
All backend communication uses TLS 1.2 or higher.
The backend database is encrypted at rest.

6. Changes to this policy

We'll update the "Last updated" date at the top of this document whenever the policy changes. Material changes (e.g. adding a new third-party SDK) will be highlighted in the app's release notes.

7. Contact

Email: support@rhythmicflow.app
Mail: Satyam Technologies Private Limited, Patna, India