Version: 2.4
Last updated: 14 October 2026
Effective: 14 October 2026
Applies to: the CalmCarry mobile app and the CalmCarry API (together, the “Service”). It does not cover the separate The Glow Company retail website, which has its own privacy policy.

---

Who we are

The Service is operated by GLOWCO INTERNATIONAL LLC (“CalmCarry”, “we”, “us”, “our”), the entity that publishes CalmCarry on the App Store and operates the CalmCarry API. GLOWCO INTERNATIONAL LLC is the controller (and, for California purposes, the business) responsible for the personal information described in this policy. “The Glow Company” is a retail brand associated with our group; purchases made on that website are governed by that website’s own privacy policy, not this one.

How to reach us about privacy:

• Email: Admin@glowco.co
• Post: GLOWCO INTERNATIONAL LLC, 607 Gazetta Way, West Palm Beach, Florida 33413, United States of America

Data Protection Officer. We are not required to appoint a Data Protection Officer under Article 37 of the UK or EU GDPR, and we have not appointed one. Privacy questions can be sent to Admin@glowco.co.

UK and EU users. We are a controller based in the United States. Where the law requires us to designate a representative in the UK or the EU under Article 27 of the UK/EU GDPR, that representative’s name and contact details will be published in this section. In the meantime you can raise any UK or EEA data-protection matter with us directly at Admin@glowco.co, and you always keep the right to complain to your local supervisory authority (see your rights).

---

The short version

• We ask for as little as we can, and we use it only to run the app. We never sell your personal information, and we never “share” it for cross-context advertising. We do use a few named service providers, only to operate the Service (see Who we share it with).
• There are no advertising SDKs and no cross-app or cross-site tracking in this app.
• We never receive audio of you. If you use the optional sleep tracker, your phone’s microphone notices sounds in the room overnight, and everything it measures, including any short clips it keeps, stays on your phone and is never sent to us or anyone else. If you speak a request to Ask CalmCarry, your phone turns your speech into text on the device. We do not track your location.
• Two optional adult features send what you write to us: Ask CalmCarry (the text of your request, which we pass to OpenAI to understand it and do not keep) and Community (the posts you choose to publish). Neither can be reached from Kids Mode. See Ask CalmCarry and Community.
• If the app crashes, a crash report with no name, email or account details goes to our crash-reporting provider so we can fix it. See Crash and performance reports.
• A child profile is different: your child’s name and what they do in the app are never sent to us. What a child profile needs is stored on the device only, and the only thing it does online is download its own sounds and stories. See Children.
• You can export everything we hold about you, or delete your account, from inside the app in a couple of taps. See Your rights.

This summary is for convenience only and does not replace the full policy below.

---

California notice at collection

For California residents, at or before collection: we collect the categories of identifiers, California customer-records information, commercial information, internet or other electronic network activity, the content of posts and requests you choose to write in the app, and, in the form of your account log-in credentials, sensitive personal information. We use them only to provide and secure the Service as described below. We do not sell or share personal information, and we do not use sensitive personal information beyond what is needed to provide the Service. Retention is described under How long we keep it and the California section. This notice links to the full policy you are reading.

---

The information we collect, why, and our legal basis

We collect only the categories below, and only for the purposes shown. For users in the UK/EEA, the “Legal basis” column states the lawful basis under the UK GDPR and EU GDPR. Providing your email address (or, if you use Apple or Google sign-in, the identifier those services release) is necessary to create and operate your account; without it we cannot give you an account. Everything else below is optional, and the core app works without it.

Information you give us when you create an account

If you sign in with Apple or Google, we receive the email address and name that provider releases to us. If you use Sign in with Apple’s Hide My Email, we only ever see the relay address. For Sign in with Apple we also store a token used for one purpose only: so that if you delete your account, we can tell Apple to revoke it.

If you subscribe

We store your subscription tier, status, plan, renewal date, and the store’s own reference for the purchase. Your card details never reach us. Payment is handled entirely by Apple or Google under their own privacy policies. Legal basis: contract.

If you register a CalmCarry device

We store the device serial number, an optional nickname you choose, the model, and warranty status; and, if you enter them on the warranty form, the purchase date and the retailer where you bought the device. To confirm a registration, our server looks up the order number and email you enter in The Glow Company’s order records. If you make a warranty claim or contact our team from the app, we store the details of that claim or message so we can answer it. Legal basis: contract, and compliance with our legal obligations for warranty and consumer-protection records.

Information we collect automatically while you use the app

You can turn off both the account-linked session records and the pseudonymous usage events at any time: Settings, then “Usage & activity data”. Turning it off stops the sending immediately and discards anything still queued on your device. Where we rely on legitimate interests, you have the right to object; where we rely on consent, you can withdraw it at any time, without affecting processing already carried out.

Is play history “health” data? We do not treat which sessions you played as health data: we do not diagnose you, score your sleep, or infer any health condition from it. It exists only to power your own progress, recents and streaks, and you can switch it off.

If you use the sleep tracker

The sleep tracker is an optional feature for adult profiles. It works entirely on your phone:

• The microphone listens only while a night is being tracked: when you tap “Start tracking tonight”, use Siri or Shortcuts, or turn on “Track every night”, which starts tracking when the app is open between 8pm and 4am. Your phone shows its microphone indicator the whole time. You can stop at any time.
• What it keeps. Your phone works out how loud the room was minute by minute and notices sound events. It stores those numbers, your start and stop times and any tags you add, on your phone. Sleep estimates are calculated on screen and are not stored.
• Short clips. If “Keep short clips” is on (it is on unless you turn it off), the tracker saves up to 50 clips of about 6 seconds of louder sounds each night, so you can hear what happened. It never records the whole night. Clips are saved in the app’s own storage on your phone, are left out of iCloud backup, and delete themselves after the period you choose in “Keep clips for” (1, 3, 7 or 30 days; 7 by default).
• Nothing is uploaded. No audio, clips, night data or sleep estimates are sent to us or to any service provider.
• Deleting it. Use “Delete this night”, “Delete all recordings” or “Delete all nights”, turn “Keep short clips” off, choose “Stop and delete” while tracking, sign out, or delete the app.

The sleep tracker is a wellness feature, not a medical device. It does not diagnose or monitor any condition. It cannot be used from a Kids or Teen profile.

If you use Ask CalmCarry

Ask CalmCarry is an optional feature for adult accounts that lets you ask for a sound, a story or a setting in your own words. When you send a request:

• We receive the text of your request, the kind of profile in use (adult), your app version and your sign-in, so we can check you are signed in and count how many requests you make each day.
• We pass the text to OpenAI, our service provider, only so it can work out which app action you asked for. OpenAI receives the text only, without your name, email or account details. Under our agreement OpenAI does not use it to train its models. OpenAI may keep it for up to 30 days for abuse monitoring, and then deletes it.
• We do not store the text of your request on our servers or on your phone. We keep only a count of how many requests you made each day.
• If you use the microphone button, speech recognition runs on your phone. The audio is never recorded or sent to us or anyone else; only the text you send is.

Legal basis (UK/EU): contract (providing the feature you asked to use). Ask CalmCarry cannot be opened from Kids Mode.

If you use Community

Community is an optional, adults-only feed for CalmCarry members. If you take part:

• We store the posts and replies you publish, the topic you chose, the nickname shown with them, a two-letter country guessed from your phone’s language setting, when you posted or edited, the status of the post, and any reports, blocks or mutes you make. Other Community members can see what you publish, so please do not post anything you want to keep private, including health details or anything that identifies a child.
• Before a post is published it is checked automatically, using OpenAI’s moderation service, for content that breaks the Community rules. A post that fails or cannot be checked is held for a person on our team to review. Our team also reviews reported posts and can remove posts or accounts that break the rules.
• You can delete your own posts at any time. Deleting your account deletes your Community profile, posts, replies, reactions, reports, blocks and mutes. If other members replied to one of your posts, an empty “[deleted member]” placeholder stays so their replies still make sense, with your text erased.

Legal basis (UK/EU): contract (providing the Community you chose to join) and legitimate interests (keeping it safe). Community cannot be opened from Kids Mode.

Crash and performance reports

If the app crashes or hits an error, it sends a crash report to Sentry, our crash-reporting provider, so we can find and fix the problem. A report contains technical details such as the error, the screen it happened on, your device model, operating-system version and app version. For a small sample of sessions the app also sends performance timings, such as how long a screen took to load. Reports are not linked to your name, email or account, and the app is set not to send personal information with them. Legal basis (UK/EU): legitimate interests (keeping the app working). Sentry keeps reports for no more than 90 days. No crash or performance reports are sent while a child profile is active.

What we do NOT collect

No audio, and no sleep data. The microphone is used only for the sleep tracker and for speaking a request to Ask CalmCarry. In both cases the sound is handled on your phone, and no audio, clips, sleep data or sleep estimates are sent to us. No location. No contacts or calendar. If you choose a profile picture from your photos, it is re-saved on your phone with its hidden photo details (such as location) removed, and it is never uploaded. No advertising identifier and no cross-app tracking. No health-app data. No biometric data: Face ID or Touch ID is used only to unlock the parent gate, and that check happens on your device through Apple, so we never receive your face or fingerprint. For California purposes, we do not collect protected-classification characteristics, biometric information, precise geolocation, sensory (audio or visual) data, professional or employment information, education information, or inferences drawn to create a profile.

---

Children’s privacy (COPPA)

CalmCarry is bought and set up by adults, and accounts are intended for adults. Inside an adult account there is an optional, parent-gated Kids Mode intended for a child to use under a parent’s supervision. We do not collect a child’s name, profile or any other personal information. The one technical exception is that delivering a sound or story to the phone means our hosting provider briefly sees the phone’s IP address, which the U.S. Children’s Online Privacy Protection Act (COPPA) can treat as a persistent identifier. We use it only to deliver the file and keep the Service secure, which COPPA calls support for internal operations. We never use it to identify, contact, advertise to or profile anyone. We explain all of this here so parents know exactly how it works.

No information that identifies a child is ever transmitted to us. When a parent creates a child profile, the only child-specific information involved is a first name the parent types, together with that profile’s settings, and the CalmCarry app keeps them on the device only. They are not sent to us or to any third party, so we do not receive, store, see, or produce them. While a child profile is active, the app sends no analytics events, no session records, no push tokens, and no crash reports, shows no advertising, and offers nothing social or interactive with other people. Ask CalmCarry, Community and the sleep tracker cannot be opened from a Kids or Teen profile.

Sounds and stories downloads. While a Kids or Teen profile is active, the only thing the app does over the internet is download its own sounds and stories so they are ready to play. This can also happen in the background on Wi-Fi, and on mobile data if they still aren’t ready after a day. Each download asks for one audio file that is the same for every family. It carries no account, profile, device or child information. Like any internet request, it shows the phone’s IP address to our hosting provider, Vercel. Vercel uses it only to deliver the file and keep the Service secure, and keeps it in its logs for up to about a day.

Apart from the delivery described above, no information about a child is collected or sent anywhere, and none of our service providers ever receives a child’s name or profile.

Parental controls and rights. Kids Mode sits behind a parent gate that a child cannot pass. At any time a parent can review what a child profile contains (the on-device first name and settings), change it, remove it, or refuse to permit any further collection or use of the child’s information. Removing the child profile or deleting the app erases the on-device first name. Because we hold nothing about your child on our servers, there is nothing for us to send you, correct, or delete on request; if you have any question about your child’s information, email us at Admin@glowco.co and we will help.

If a child uses a standard account. CalmCarry accounts are for adults. If we learn that we have collected personal information from a child under 13 through a standard account, we will delete that information promptly. You can notify us at Admin@glowco.co.

If we ever change what Kids Mode does so that any child information would be collected or transmitted, we will not do it quietly: we will update this policy, show you the change in the app before it takes effect, and, where the law requires it, obtain verifiable parental consent before collecting anything new.

---

How we use your information

We use the information above only to: create and run your account; deliver the sessions, mixes, timers and reminders you ask for; carry out requests you make through Ask CalmCarry; run and moderate Community; process and maintain your subscription; register your device and handle warranty; keep the Service secure, prevent abuse, and find and fix crashes and other problems; answer your support messages and warranty claims; understand, in aggregate, which parts of the app help; comply with our legal obligations; and communicate with you about your account and about material changes to this policy. We do not use your information for advertising, and we do not make decisions that produce legal or similarly significant effects about you by solely automated means.

---

Household and caregivers

CalmCarry lets one subscription cover a household. If you invite another adult as a caregiver (or accept an invite) using a one-time code, the linked adults in your household can see the household’s profiles and registered devices and can share the subscription. The invite is a code, so we do not collect the other person’s email to set it up. Removing the link, from either side, stops that shared access.

---

Who we share it with

We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising (as those terms are used under U.S. state privacy laws). We disclose personal information only in the limited ways below.

Service providers (processors) process data on our documented instructions, under contract, only to run the Service, and are each contractually required to protect your information to at least the standard described in this policy and to use it only to provide services to us:

Independent third parties. Apple and Google act as independent controllers, not our processors, when they authenticate your sign-in and process App Store or Google Play payments; their handling of that data is governed by their own privacy policies, which we do not control. These disclosures are limited to what is necessary for sign-in and payment and do not constitute a sale or share of personal information.

We may also disclose personal information: to comply with law, legal process, or a lawful government request; to enforce our terms or protect the rights, safety, and property of our users, the public, or us; and in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this policy or give you notice and choice as the law requires.

None of these providers ever receives a child’s name or profile. When a Kids or Teen profile downloads its sounds and stories, Vercel sees the phone’s IP address, as described under Children.

---

International data transfers

We are based in the United States, and our API (Vercel), database (Neon, AWS US East) and the other service providers listed above are in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States.

For users in the UK and the EEA, where we transfer personal information to the United States we rely on the European Commission’s Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum, together with additional safeguards as appropriate. You can ask us for more information about these transfer mechanisms using the contact details above.

---

How long we keep it

• Session records and pseudonymous usage events: 400 days, then deleted automatically by a daily job. We keep them that long so month-to-month and seasonal patterns remain meaningful, and no longer.
• Account information (including saved mixes and any push token): kept while your account exists, and erased when you delete it or when you turn the relevant feature off.
• Sleep tracker nights and clips: stored on your phone only, never by us. Clips delete themselves after the period you choose (7 days by default); night data stays until you delete it.
• Community posts: kept until you delete them or your account, or until our team removes them for breaking the rules. A post others replied to becomes an empty “[deleted member]” placeholder with its text erased.
• Ask CalmCarry requests: not stored by us. OpenAI may keep the text for up to 30 days for abuse monitoring.
• Crash and performance reports: kept by Sentry for no more than 90 days.
• Support messages and warranty claims: kept for as long as needed to answer them and honour the warranty.
• Security and operational logs (which may include IP addresses): not stored in our own database; any such logs are held only transiently by our hosting provider for security and abuse-prevention, currently for up to about a day.
• Subscription records: the underlying purchase is recorded by Apple or Google, not by us, and kept under their policies; we keep only the minimal status described above, for as long as your account exists.
• Warranty and device records: kept for as long as needed to honour the warranty and to meet our legal and accounting obligations.
• A child’s first name: never sent to us, so never retained by us; removed from the device when the profile or the app is deleted.

---

Your rights

Wherever you live, you can use the following controls inside the app:

• Access / get a copy of your data. Settings, then “Export my data” hands you everything tied to your account, ready to save or send on.
• Delete your account and data. Settings, then “Delete account”. Deleting your account erases your account information from our systems. A limited set of records may be retained where the law allows or requires it, for example warranty and consumer-protection records and tax and accounting records, and your store purchase history remains with Apple or Google under their policies. Everything else is deleted or de-identified. Deleting your account does not cancel a subscription: cancel that in your Apple or Google account settings.
• Correct your details by editing them in the app, or by emailing us.
• Turn off usage measurement. Settings, then “Usage & activity data”.

You may also make any of these requests, or ask a question, by emailing Admin@glowco.co. You may use an authorized agent to submit a request on your behalf; we will ask for proof of the agent’s authorization and may verify your identity directly. We will verify your request against your account, respond within the time the applicable law requires (for California and several other states, within 45 days, extendable once by a further 45 days with notice to you), and will not discriminate against you for exercising your rights. If we ever need to deny a request, we will tell you why, and you may appeal by replying to our decision or emailing Admin@glowco.co.

UK and EEA (UK GDPR / EU GDPR)

In addition to the above, you have the right to: access; rectification; erasure; restriction of processing; data portability; and to object to processing based on our legitimate interests. Where we rely on consent, you may withdraw it at any time. Our legal bases are stated in the tables above. You also have the right to lodge a complaint with your supervisory authority, for example the Information Commissioner’s Office (ICO) in the UK, or your national data protection authority in the EEA. We would appreciate the chance to address your concern first. See also the note for UK and EU users under Who we are regarding our representative.

California (CCPA / CPRA)

If you are a California resident, you have the right to know, access, correct, and delete the personal information we hold about you, to obtain a portable copy, and to appeal a denial. You also have the right to opt out of the “sale” or “sharing” of personal information and to limit the use of sensitive personal information. However, we do not sell or share personal information, and we use sensitive personal information only to provide and secure the Service (a purpose for which no “limit” opt-out is required under 11 CCR § 7027), so there is nothing to opt out of. We will not discriminate against you for exercising any right.

Categories of personal information we have collected in the last 12 months, and disclosed only to the service providers named above for the business purposes described:

• Identifiers: email address, name, device serial number, and a random per-install identifier.
• California customer-records information: your account details and warranty/device-registration records.
• Commercial information: your subscription tier and status.
• Internet or other electronic network activity: which sessions you played and pseudonymous usage events, if you leave usage measurement on.
• Other information you write: Community posts you publish, Ask CalmCarry requests (passed to OpenAI and not stored by us), and support messages.
• Sensitive personal information: your account log-in credentials (email together with your password, which we store only as a one-way hash), collected and used solely to authenticate you and secure your account.

We collect these from you directly; from your device as you use the app; and from third parties you choose to use with the Service, namely Apple and Google, who release your email and name when you use Sign in with Apple or Google and provide subscription and purchase references from the App Store or Google Play. We have not sold or shared any category of personal information, and we do not knowingly collect or sell the personal information of consumers under 16. California’s “Shine the Light” law: we do not disclose personal information to third parties for their own direct marketing, so there is nothing to request under it.

Retention by category (California): identifiers, customer-records information, and commercial information are retained for the life of your account and deleted when you delete it; internet or other electronic network activity information (session records and usage events) is retained for 400 days; sensitive personal information (login credentials) is retained for the life of your account; device and warranty records are retained as long as needed to honour the warranty and meet our legal and accounting obligations.

Other U.S. states

If you reside in a U.S. state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana), you have rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. Because we do not sell your data, serve targeted advertising, or profile you, those opt-outs do not apply to us. To appeal a denied request, reply to our decision or email Admin@glowco.co; we will respond within the time your state’s law requires.

Other regions

Depending on where you live, you may have similar rights under laws such as the UAE Personal Data Protection Law (contactable authority: the UAE Data Office), the Australian Privacy Principles (the OAIC), and Canadian privacy law. Use the contact details above and we will honour the rights that apply to you.

---

Do Not Track and Global Privacy Control

The app contains no advertising or cross-site tracking, so there is nothing for a “Do Not Track” or Global Privacy Control (GPC) signal to stop. Because we never sell or share personal information, no opt-out signal is required to change how we treat your data.

---

Automated decision-making

We do not use your personal information to make decisions about you by solely automated means that produce legal or similarly significant effects. Community posts are screened automatically before publishing; a post that is held is reviewed by a person, and you can contact us about any decision.

---

Third-party services and links

Signing in with Apple or Google, and paying through the App Store or Google Play, are governed by those companies’ own privacy policies. Our marketing and support pages, and the purchase of a physical CalmCarry device, take place on the separate The Glow Company website, which has its own privacy policy. We are not responsible for the privacy practices of services we do not operate.

---

How we protect it

Traffic between the app and our servers is encrypted in transit. Passwords are stored only as one-way hashes. Sign-in tokens are held in your phone’s secure keychain. Changing your password immediately ends every other signed-in session. Administrative access to the database is restricted, and rate limiting protects sign-in and password reset against automated guessing. No service can promise perfect security, but we design so that the most sensitive thing in a family’s account, a child’s information, is never in our systems at all.

---

Changes to this policy

If we make a material change we will update the “Last updated” and “Effective” dates above and tell you in the app before the change takes effect. Your continued use of the Service after a change becomes effective means you accept the updated policy, except where we are required to obtain your consent.

---

Contact us

GLOWCO INTERNATIONAL LLC
Admin@glowco.co
607 Gazetta Way, West Palm Beach, Florida 33413, United States of America