CalmCarry App Privacy Policy
Version: 1.0
Last updated: 9 August 2026
Applies to: the CalmCarry mobile app and the CalmCarry API.
Who we are
CalmCarry is operated by GLOWCO INTERNATIONAL LLC (“we”, “us”), which is the data controller for the information described in this policy. GLOWCO INTERNATIONAL LLC is the entity that publishes CalmCarry on the App Store and operates the CalmCarry API; “The Glow Company” is a brand it trades under.
Contact us about anything in this policy:
- Email: Admin@glowco.co
- Post: 607 Gazetta Way, West Palm Beach, Florida 33413, United States of America
The short version
- We ask for as little as we can, and we do not sell it. Ever.
- There are no advertising or cross-app tracking SDKs in this app.
- We do not listen to your room, record your sleep, or score your nights.
- A child profile is different: nothing about your child is sent to us at all. See the separate Children’s Privacy Notice.
- You can export everything we hold about you, or delete your account, from inside the app in a couple of taps.
What we collect, and why
If you create an account
| What | Why |
|---|---|
| Email address | To identify your account, sign you in, and send password resets and verification codes |
| Your name | To greet you in the app |
| A one-way hash of your password | So we can check your password without ever storing it |
| Whether your email is verified | So your account stays recoverable |
| Your app preferences (for example your chosen bedtime reminder time, saved favourites) | So your settings follow you to a new phone |
If you sign in with Apple or Google, we receive the email address and name that provider releases to us. If you use Sign in with Apple’s Hide My Email, we only ever see the relay address. For Sign in with Apple we also store a token that exists for one purpose only: so that if you delete your account, we can tell Apple to revoke it.
If you subscribe
Your subscription tier, status, plan and renewal date, plus the store’s own reference for the purchase. Your card details never reach us. Payment is handled entirely by Apple or Google.
If you register a Glow Orb
The device serial number, an optional nickname, the model, and warranty status. If you make a warranty claim, we store the details of that claim.
While you use the app
| What | Why | How long |
|---|---|---|
| Which sessions you played and when (tied to your account) | So your progress, recents and streaks work | Deleted after 400 days |
| Anonymous app-usage events | To understand which parts of the app help, keyed to a random per-install identifier and never to your name, email or account | Deleted after 400 days |
| Saved sound mixes | So you can reload a mix you built | Until you delete it or your account |
| A push token, if you turn on reminders | To deliver the reminders you asked for | Until you turn them off or delete your account |
You can turn off the account-linked session records and the anonymous usage events at any time: Settings, then “Share anonymous usage data”. Turning it off stops the sending immediately and discards anything still queued on your device.
What we do NOT collect
No microphone access and no audio recording. No sleep tracking, snore detection or sleep score. No location. No contacts, calendar or photos. No advertising identifier. No health-app data. No biometric data: Face ID is used only to unlock the parent gate, and that check happens on your phone, so we never receive your face or fingerprint.
No crash or diagnostic reports. Crash reporting is built into the app but ships switched off, with no destination configured, so no crash or error data leaves your phone in this release.
Children
Nothing about a child is sent to us. When a parent creates a child profile, the first name they type is stored on the phone and is never uploaded, so we cannot see it, search it, or produce it. While a child profile is active the app records no usage analytics and sends no crash reports, shows no advertising, and offers nothing social.
See the CalmCarry Children’s Privacy Notice for the full explanation.
Who we share it with
We do not sell your personal information, and we do not share it for advertising.
We use a small number of service providers to run the app. They process data on our instructions only:
| Provider | What it handles | Where |
|---|---|---|
| Railway Corp. | Runs the CalmCarry API | United States |
| Neon Inc. | The database storing everything described above | AWS US East (N. Virginia), United States |
| Apple, Google | Sign-in and subscription payments, under their own privacy policies | Global |
| Resend (resend.com) | Sends password reset and verification codes | United States |
We may also disclose information if the law requires it, or to protect the rights and safety of users.
None of these providers ever receives a child’s personal information. A child’s data is never transmitted from the device at all, so it never reaches Railway, Neon, Resend, Apple or Google. No disclosure of children’s personal information, as defined by 16 CFR 312.2, takes place.
How long we keep it
We keep personal information only as long as we need it.
- Session records and anonymous usage events: 400 days, then deleted automatically by a daily job. We keep them that long so month-to-month and seasonal patterns remain meaningful, and no longer than that.
- Account information: kept while your account exists, and erased when you delete it.
- Purchases: recorded by Apple or Google, not by us, and kept under their own policies. This server holds no invoice, receipt or payment ledger of its own.
- A child’s first name: never sent to us, so never retained by us. It is removed from the device when the profile or the app is deleted.
Your rights
Wherever you live, you can:
- Get a copy of your data. Settings, then “Export my data” hands you everything tied to your account, ready to save or send on.
- Delete your account and data. Settings, then “Delete account”. This is permanent and immediate. Note it does not cancel a subscription: cancel that in your Apple or Google account settings.
- Turn off usage measurement. Settings, then “Share anonymous usage data”.
- Correct your details by editing them in the app, or by emailing us.
Depending on your country you may also have the right to object to or restrict processing, to data portability, and to complain to your data protection authority (in the UK, the ICO; in the EU, your national authority; in the UAE, the UAE Data Office; in Australia, the OAIC).
Legal bases (UK/EU GDPR): performance of a contract (running your account and subscription); legitimate interests (keeping the service secure and working, and understanding aggregate usage); consent (push notifications, and usage measurement, which you can withdraw at any time); legal obligation (tax and accounting records).
Where your data is held
Our API is hosted by Railway in the United States, and our database is hosted by Neon in AWS US East (N. Virginia), United States. If you use the app from outside the United States, your information is transferred there.
For users in the UK and the EU/EEA, these transfers are made under the European Commission’s Standard Contractual Clauses, and the UK International Data Transfer Addendum for UK users, which place contractual safeguards on the information when it is processed in the United States.
How we protect it
Traffic between the app and our servers is encrypted in transit. Passwords are stored only as one-way hashes. Sign-in tokens are held in your phone’s secure keychain. Changing your password immediately ends every other signed-in session. Administrative access to the database is restricted, and rate limiting protects sign-in and password reset against automated guessing.
No service can promise perfect security, but we design so that the most sensitive thing in a family’s account, a child’s information, is never in our systems at all.
Changes to this policy
If we make a material change we will update the date at the top and tell you in the app before the change takes effect.
Contact
Admin@glowco.co | 607 Gazetta Way, West Palm Beach, Florida 33413, United States of America
