Melatonin Privacy Policy

Last updated: November 7, 2026

Melatonin (“the app”) is an iPhone app that reads your sleep data from Apple Health to calculate a sleep score, and helps you block apps before bed. This policy explains what information the app handles and why.

The short version

Everything is calculated on your device.
If you don’t sign in, your sleep data never leaves your iPhone.
If you sign in, we store your account ID and the sleep sessions measured by your iPhone alone on our server, so your history survives a new phone.
We send a few anonymous usage events (like “finished onboarding” or “saw the paywall”) so we can improve the app. No sleep data, no screen content. See Usage analytics.
No ads. No tracking across other apps or websites. We never sell your data.

What the app reads

Sleep data — Sleep stages and times from Apple Health, only after you allow it. You can turn this off anytime in the Health app. The raw Health data is never sent to our server.
Step count — Steps from Apple Health, used to estimate past sleep (“hours with no steps overnight”) if you don’t have sleep records yet. Stays on your device.
Motion — If you allow it, the app reads your iPhone’s motion sensor history to measure sleep without a watch. Raw sensor values are not stored; only the resulting sleep sessions (when each stage started and ended) are kept.
Camera — checked on your device, never saved
When you use Sunlight Lock, the back camera looks for a few seconds at how bright it is and whether it sees sky or indoors, with a live preview so you can see where you’re pointing. No photos or video are saved or sent anywhere. Each frame is turned into a few numbers on your iPhone (brightness, color temperature, sky / outdoor / indoor scores) and immediately discarded. Scene detection uses Apple’s on-device frameworks. To tell a real sky from a window, the app also uses the motion sensor (orientation) to check that you turned around; this is not stored either. Sunlight Lock needs the camera — without it, you can’t turn it on, because we never set a lock you can’t unlock.
Location — accuracy and weather only, never stored
During the same check, the app looks at how accurate your GPS fix is. Under open sky it’s within a few meters; indoors it spreads to tens of meters. Your coordinates are used once to get local cloud cover from Apple Weather (WeatherKit), then discarded. Location is not stored, not sent to our server or analytics, and not read when you aren’t using the app (“While Using” only). Sunrise and sunset times come from the city you choose in Settings, not your location.
Blocked apps — When you pick apps to block, Apple’s Screen Time (Family Controls) gives the app opaque tokens. We can’t see which apps you picked. The tokens stay on your device.
Blocking history — When blocks started and ended, and when you tried to open a blocked app, are recorded on your device to show things like “3 attempts last night.”
Your onboarding answers — Your name, age, goals, and phone time before bed. Used only for in-app copy and math (like how many years you’d spend on your phone) and stored only on your device. Never sent to our server or analytics.

Sign in (optional)

You can use every feature without an account. If you choose Sign in with Apple:

We receive Apple’s user identifier and, the first time only, your name and email. If you choose “Hide My Email,” we only get Apple’s relay address.
These are stored in your device’s Keychain and on our server, only to recognize your account and restore your history on a new device.
Delete Account in the app erases everything on our server and on your device right away.
To disconnect on Apple’s side: Settings → your name → Sign-In & Security → Sign in with Apple.

What we store on our server

Only if you sign in. Our server runs on Amazon Web Services in the Seoul, South Korea region, so your data is transferred to and stored in South Korea. If you don’t sign in, nothing is stored on our server except the one install note below.

On first install (signed in or not): once you finish the intro, the app sends a random install ID it generated, plus device model, app version, language, country and time zone. We use it only to count new users. No name, sleep data or location.

Account ID and name / email (if provided)
Sleep sessions measured by your iPhone — iOS deletes motion history after 3 days. Without a backup those nights would be lost for good, so we keep them.
Blocking settings (bedtime, days, strength)

We never send: Apple Health data, step count, blocking history, your list of blocked apps, raw sensor values, or morning sunlight.

Usage analytics (PostHog)

To see where people get stuck, the app sends the fact that a few things happened to our analytics provider, PostHog.

What we send — onboarding started / finished, paywall shown / closed (and which screen opened it), purchase attempted / completed (and which plan), whether you use an Apple Watch, wake-up time, turning Sunlight Lock on or off, and whether a sky check passed, was postponed, or skipped, with how many seconds it took. Device model, iOS version, app version, and language are attached.
How you’re identified — a random ID created when you install the app. If you sign in, it’s linked to a one-way hash (SHA-256) of your account ID. Your Apple identifier, name, and email are never sent.
What we don’t send — sleep data or scores, steps, sunlight amounts, blocked apps, screen content, camera readings, photos, or location. Session replay and autocapture are off. IP addresses are not stored and location is not inferred.
Star stats (our server) — When you unlock a star in the star gallery, we send only which star it was, with nothing that identifies you (no account, device, or random ID). It’s used only to show “Owned by X%.”
Total sleep counter (our website) — The total hours of phone-measured nights backed up by signed-in users is added into one number shown on our website. It never reveals whose nights or when.
PostHog, Inc. is based in the United States (privacy@posthog.com). Events are kept for 1 year. To opt out or have your events deleted, email us below — every feature keeps working.

What the app doesn’t do

Send raw Apple Health data to any server.
Show ads or use the advertising identifier.
Track you across other apps or websites. PostHog (above) is our only analytics.
Sell or share your personal information, or use Health data for advertising. Our only third-party processor is PostHog for the analytics above.

Keeping and deleting your data

Data the app creates (sleep scores, blocking history, settings) lives on your device and is removed when you delete the app. Your original sleep data stays in Apple Health, where you can manage or delete it.

Server data is kept while your account exists, so your history is still there on a new phone. Deleting the app alone does not delete server data — delete your account first if you want it gone.

Delete your account

In the app: Profile → Account → Delete Account. Deleted immediately.
Without the app: email contact@romancephysical.com with the email of the Apple account you signed in with. We’ll verify it’s you, delete everything within 7 days, and reply.

What gets deleted: account ID, name, email, stored sleep sessions, blocking settings, and subscription records. Nothing is kept. (Payment records are held by Apple, not us.)

Your rights

Wherever you live — including California (CCPA/CPRA) and the EU/UK (GDPR) — you can ask us to access, correct, export, or delete your personal information, or object to analytics. Email us below and we’ll respond within 30 days. We won’t treat you differently for asking.

Subscriptions

In-app purchases are processed by Apple. We never receive your card number or other payment details.

If you request a refund (only with your consent)

After you buy Pro on iPhone, the app asks once: "If you ask for a refund, can we tell Apple?" Only if you choose "That's OK", when you request a refund from Apple our server answers the five things Apple asks: that you consented, whether Pro worked after purchase, whether you could try the app for free before buying, (for gifts) the share of the gift period used, and our preference for a prorated refund. We never send your name, sleep data, or how you use the app. To do this we store the Apple transaction ID of that purchase and your choice. Apple uses this only for refund decisions and doesn't share it with third parties for their marketing. You can turn it off anytime in Profile > "Share usage for refund reviews". To access or delete what Apple holds, visit privacy.apple.com.

Children

The app is not intended for children under 13, and we don’t knowingly collect personal information from them. If you believe a child has given us information, email us and we’ll delete it.

Changes

If this policy changes, we’ll update this page and the date at the top.

Contact

Melatonin (developer: 낭만피지컬 / Nangman Physical)
contact@romancephysical.com