Suya

Privacy Policy

for the app “Suya: Audio Sleep Tracker” and this website · Last updated: 8 November 2026. The German version is authoritative.

1. Controller

There is no data protection officer, as none is required. For any privacy question, write to the address above.

2. What happens on your iPhone

Microphone

During a night recording, Suya records sounds through the microphone (breathing, snoring, movement, surroundings). On the device it derives sleep stages, sound events and a sleep score. Recordings are stored only on your iPhone. You can delete them at any time – one by one, all at once, or keeping only the short clips of detected sounds.

Motion sensor

When the iPhone lies in bed, Suya measures coarse movement with the accelerometer. These values also stay on the device.

Apple Health

If you allow it, Suya reads your Apple Watch sleep stages as well as heart rate, heart rate variability, respiratory rate and blood oxygen from Apple Health to compare them with its own estimate. Suya also writes its estimated sleep stages (In Bed, Awake, Core, Deep, REM) to Health, marked as entries from Suya. If your Apple Watch recorded the same night, its data takes precedence and Suya removes its own entries for that night. Health data is never used for advertising or marketing and never shared with third parties. You can change permissions at any time in the Health app.

Alarms, Live Activity, sounds

Alarms (via Apple’s AlarmKit), the lock-screen display and the sleep sounds run entirely on the device. The sleep sounds ship with the app.

Sharing

With “Share” you can export a night as a file, optionally including audio. You decide where it goes via the iOS share sheet; Suya does not send anything to us.

Legal basis for on-device processing is providing the features you use (Art. 6(1)(b) GDPR) and, for health data, your consent through the iOS permission prompts (Art. 9(2)(a) GDPR). As this data does not leave your device, we have no access to it.

3. Voluntary data donation

Suya can only improve its sleep stage detection with real nights. You can therefore donate nights – voluntarily, revocable at any time. Nothing is sent without your explicit consent in the app. Suya works exactly the same without donating. Donating requires you to be 18 or older.

What is sent

• A coarse sound picture of the night (spectrogram with 64 frequency bands, 10 times per second) and the loudness per second. It reveals breathing, snoring and movement, but speech cannot be understood and no recording can be restored. No audio is sent.
• Your Apple Watch sleep stages for the same period and when Suya’s sleep sounds were playing – without date or time of day, only counted from the start of the recording.
• iPhone model, app version and a random donor number with its key. No name, no Apple ID, no device identifier, no location.

Only nights recorded after your consent, with at least 5 hours of recording and Apple Watch sleep stages, are donated.

Purpose

Solely to train and evaluate the model Suya uses to estimate sleep stages. No advertising, no sale, no sharing, no profiles of individuals.

Legal basis

Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). The time and version of the consent text are stored on your device.

Where and how long

Donated nights are sent encrypted (HTTPS) and only over Wi-Fi to the controller’s own server (network storage) in Hamburg, Germany, and stored there. There are no processors, no cloud services and no transfers to third countries.

Donated nights are deleted automatically 6 months after receipt, and immediately upon withdrawal or a deletion request. An already trained model contains only learned weights from which individual nights cannot be restored; it is not withdrawn upon deletion, but later training no longer uses deleted nights. A log records only when a night was received or deleted for which donor number.

So that only the genuine Suya app can donate, the app uses Apple’s “App Attest” service: your iPhone has Apple confirm that the request comes from an unmodified Suya app. Apple receives none of the content of your donation.

Withdrawal and deletion

Under “More” in the app you can withdraw your donation at any time and have all donated nights deleted with “Request deletion of my data”. Alternatively, email your donor number to the address above. Withdrawal applies to the future and does not affect processing carried out before (Art. 7(3) GDPR).

4. This website

This website sets no cookies, embeds no third-party content (fonts, maps, videos) and uses no tracking. Visits are not logged. Your IP address is necessarily processed to deliver the page and, for rate limiting of the donation interface, kept in memory for at most one hour, never stored (Art. 6(1)(f) GDPR; legitimate interest in secure operation). Only on technical errors may the server’s web server write an error message including an IP address. These error logs are used solely for troubleshooting and are rotated and overwritten automatically by the server’s operating system.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time (Art. 7(3)). Because we store no names, requests about donated nights need your donor number.

You may also lodge a complaint with a supervisory authority, for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

6. Not a medical device

Suya estimates sleep stages from sounds. Results are not a medical measurement and do not replace a medical examination.

7. Changes

If what Suya does with data changes, we update this policy. If the content of the data donation changes, the app asks for your consent again.