Privacy, in plain sight.

1. Who is responsible for Hypnavia

Hypnavia’s creator and the controller for website and correspondence data is Marcin Białecki, Poland, operating under the Code of Dream brand. Contact, including privacy requests: contact@hypnavia.com. Code of Dream is a brand name, not a separate company acting as controller.

This policy covers the Hypnavia Android and iOS app, hypnavia.com and email contact. The app is intended for adults. It works offline, without accounts, advertising, telemetry or automatic crash reporting. We do not automatically receive your session data or sell personal data.

2. App data and permissions

Settings, profiles, session history, statistics, notes, selected media and optional microphone recordings are processed on your device. Recordings may contain voices and surrounding sounds. Silence removal happens locally without cloud transcription. Recording requires enabling the feature and granting microphone permission; automatic recording at session start is off by default.

Optional camera permission controls the flashlight, not photography or video capture. Optional iOS music-library access and system file pickers let you select your media. Motion sensors, vibration, brightness and buttons support session controls. Android may use a notification and foreground service; optional device-administrator permission locks the screen.

Change permissions in system settings and disable optional features in the app. Refusing permission limits the corresponding feature. We do not require health information. Do not send private recordings or notes unless needed to handle your request.

3. Deletion and your own backups

History, notes, profiles and media remain until you delete them in the app or remove app data through the operating system. Shortened recordings with silence removed do not automatically expire. Full recordings become eligible for deletion after 3 days by default; cleanup runs at app startup or when retention settings change. You can change the period, disable expiry or protect an individual recording.

Manual backups may include settings, profiles, history, notes and media. Password encryption is on by default for backups but can be disabled. This does not mean all local files and exports are encrypted. The app disables system data backup on Android and marks its directories as excluded from iOS backup; this does not guarantee the absence of every system copy.

Exports to a file provider you select, including a cloud service, follow that provider’s terms. Deleting app data does not remove previous exports or original files. We have no remote access to your device to delete or recover them. Website and email links open an external application.

4. The website

The website has no visitor analytics, advertising, forms or embedded third-party content. It does not store cookies or localStorage data. Language follows browser preferences or the page address, with English as the fallback. Fonts and images are served from the same website.

Displaying the site requires processing an IP address and requested URL. The server may also record the time, response status, browser details, referring address and security events. This supports delivery, troubleshooting and protection against abuse, based on our legitimate interest under GDPR Article 6(1)(f).

SeoHost retains website access and error logs and SMTP, IMAP and POP3 mail logs for 30 days. Older entries may remain in backups until the relevant copy expires under the cycle described below.

5. When you email us

We process your email address, message, attachments and correspondence metadata to respond and handle your request. Providing data is voluntary, but we may be unable to help without an address and description of the issue. Ordinary contact relies on our legitimate interest in communication and user support (GDPR Article 6(1)(f)). Compliance with legal obligations, including data-rights requests, relies on Article 6(1)(c).

We retain correspondence while handling the matter and afterwards, to the extent needed to provide continuity of support if you contact us again, for no longer than 24 months after it is closed. For a single enquiry, this runs from the last substantive message. We delete messages earlier when they are no longer needed. We retain only necessary information longer to meet a specific legal obligation for its required period, or to establish, exercise or defend a specific claim until proceedings conclude and the applicable limitation period expires (GDPR Article 6(1)(c) or (f)).

While the service is active, SeoHost retains two monthly backups, with a retention period confirmed by the provider as 60 days. Deleted files, messages and older logs may remain in these copies until they expire, for up to 60 days after removal from active storage. Messages in backups are not used for ordinary correspondence. Separately, after our data-processing agreement with SeoHost ends, the agreement provides for deletion of the last backup within 6 months. Backup periods do not determine how long messages are kept in the active mailbox.

6. Hosting, email and security

SEOHOST Sp. z o.o., based in Poznań, Poland, provides hosting and email. Data needed for these services is entrusted to SeoHost under a data-processing agreement. Its subprocessor list includes DATASPACE P.S.A., EXEA S.A. and OVH Sp. z o.o. (infrastructure), Quality Unit, s. r. o. (SeoHost support) and Monarx, Inc. (threat protection). Access depends on each provider’s role; this does not mean every provider receives all correspondence. We disclose information to public authorities only on a proper legal basis, and to advisers where a particular matter requires it. This does not give anyone access to data held only in the app.

SeoHost uses US-based Monarx, Inc. to protect hosting. Threat analysis may involve IP addresses, file paths, system-user names and identifiers, and selected files that may contain personal data. This service may transfer data outside the EEA, including to the USA. The provider states that safeguards include Standard Contractual Clauses (SCCs). This does not mean the entire account is uploaded. You can request information or a copy of the applicable safeguards at our contact address.

The site uses HTTPS. Correspondence access is limited to authorised people. The SeoHost agreement does not provide for default encryption at rest; an encrypted connection does not mean all data stored on the server is encrypted. Local file protection also depends on your device security and chosen backups.

SEOHOST — documents / dokumenty

SEOHOST — Monarx

7. Your rights

Subject to the GDPR’s conditions, you may request access, correction, deletion and restriction of processing. You may object to legitimate-interest processing on grounds relating to your situation. Portability applies where its legal conditions are met. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Write to contact@hypnavia.com. We normally respond within one month and explain any legally permitted extension within that time. You may complain to Poland’s President of the Personal Data Protection Office (uodo.gov.pl) or another competent supervisory authority. You manage local app data on your device. We do not use advertising profiling or solely automated decisions with legal or similarly significant effects.

8. Policy updates

This policy concerns the current free version. Before introducing new data processing, for example for paid Premium features, we will update this information and obtain consent where required. The current policy is available at hypnavia.com/privacy/ and through the app. We will communicate material changes in a way appropriate to their scope. This policy does not limit rights under applicable local law.