Effective date: 13 August 2026 Last updated: 13 August 2026
Lull is a sleep tracking and coaching app for iPhone, iPad and Apple Watch, published by Mileafy LLC (“we”, “us”). This policy explains what the app collects, where it goes, and what control you have over it.
The data controller for the purposes of the GDPR and UK GDPR, and the business for the purposes of the CCPA/CPRA, is:
Mileafy LLC, a Delaware limited liability company (est. 2022) 8 The Green, STE A, Dover, DE 19901, United States[email protected]
Not medical advice. Lull is a wellness app, not a medical device. Its scores, insights and coaching are for general information and self-experiment only. They are not a diagnosis and are not a substitute for advice from a qualified clinician. If you have a suspected sleep disorder, talk to a doctor.
1. The short version
- Your sleep data is read from Apple Health and is processed and stored on your device. We do not upload your sleep sessions, heart rate, HRV, workouts or cycle data to our servers.
- Your logged habits, wake-up reasons, morning ratings, techniques and self-experiments are also stored only on your device.
- What does leave the device: an account identifier, your onboarding answers, subscription status, a push token — and, when you use the AI features, a summary of already-computed numbers (plus the text you type into the coach or the habit log).
- We do not track you across apps or websites. There is no advertising identifier (IDFA), no ad SDK, no analytics SDK, and crash reporting is disabled.
- We do not sell or share your personal information, and we never use Health data for advertising or marketing.
- You can delete your account and all of it from inside the app.
2. Data that stays on your device
The following never leaves your iPhone, iPad or Apple Watch except as described in Section 3.
2.1 Apple Health (HealthKit)
With your explicit permission, Lull reads — and only reads, never writes — these Health data types:
| Health type | Why |
|---|---|
| Sleep Analysis | Detecting your nights and naps, sleep stages, and computing your Sleep Score |
| Heart Rate | Overnight resting heart rate as a recovery signal |
| Heart Rate Variability (SDNN) | Overnight recovery signal |
| Workouts | Correlating daytime activity with sleep quality |
| Menstrual Flow | Cycle phase, which measurably affects sleep |
Lull also uses HealthKit background delivery so it can notice you have woken up and ask how you slept. This runs on your device.
Health-specific commitments (Apple App Store Guideline 5.1.3): we do not use HealthKit data for advertising, marketing or similar services; we do not disclose it to advertisers, data brokers, or any third party for their own purposes; and we do not sell it. You can withdraw Health access at any time in Settings → Privacy & Security → Health → Lull, or Settings → Health → Data Access & Devices.
2.2 Things you tell the app
Stored locally, in app storage and a shared app group container:
- Habit factors you log — including the free text you type (“two beers around 9pm”), the classified factor type, and its timestamp.
- Wake-up reasons, which can include sensitive-feeling entries such as anxious mind or pain / discomfort.
- Morning check-in ratings (how rested you felt).
- Wind-down techniques you ran (4-7-8 breathing, military method, cognitive shuffle, 20-minute rule, warm shower) and when.
- Self-experiments and sleep-program state.
- Your onboarding profile: age band, primary goal, what you expect from the app, and your weekday/weekend bedtime and wake times.
- Computed sleep scores, trends and insights.
- Travel/time-zone state derived from your device time zone. Lull does not use location services and has no location permission.
2.3 Screen Time (Family Controls) — optional
If you enable the wind-down feature, Lull uses Apple’s Screen Time APIs to shield apps you choose during your wind-down window, or (if you decline blocking) to notice when you use them late.
Apple’s API gives us opaque tokens, not app names — we cannot see which apps you selected, and neither can our servers. What is stored locally is: the opaque selection, and timestamps of when a wind-down session ran or a late-usage threshold was crossed. Those timestamps are turned into sleep factors on your device.
2.4 Widgets and Apple Watch
Your most recent scored night is written to a shared app group container so the home/lock screen widget and the watch complication can display it, and is pushed to a paired Apple Watch over Apple’s WatchConnectivity (device-to-device). This does not pass through our servers.
3. Data that leaves your device
3.1 Account (Firebase Authentication)
Lull creates an account so your settings survive a reinstall and so the AI features can be rate-limited and abuse-protected. You can start with an anonymous account — no name, no email.
If you choose Sign in with Apple or Sign in with Google, the provider gives us a stable user id and, depending on your choice, an email address and display name. With Apple you may use Hide My Email, in which case we only ever see a private relay address.
3.2 Your account record (Cloud Firestore)
We store one document per account containing:
- account id (
uid), whether the account is anonymous, which sign-in providers are linked; - created / updated / last-opened timestamps,
platform(“iOS”), app version; - your device push token and device language, so we can send the trial-ending reminder;
- a mirror of your onboarding answers — age band, primary goal, expectations, and your bedtime/wake times — so signing in on a new phone restores your setup instead of replaying onboarding;
- your subscription state (trial active, renewal date, auto-renew), written by our server from RevenueCat events.
Your sleep sessions, scores, habit logs, wake reasons, techniques and experiments are not stored here. Security rules restrict each account to reading and writing only its own document, and only those fields.
3.3 AI coaching and habit classification
Lull’s AI features call our own backend (Firebase Cloud Functions, hosted in the United States), which relays the request to a model provider and returns the answer. Nothing from these requests is written to a database.
a) Habit classification. When you type a habit in plain language, that text is sent so it can be turned into structured factors (type, direction, time).
b) Coach insights, trends and chat. Lull computes everything on your device first and sends only a pre-computed digest — a period label, number of tracked nights, average score, a short list of findings with point deltas and night counts, average overnight resting heart rate and HRV, a recent heart-rate delta, and one-line summaries of any running experiment or program. When you chat, your message and up to the last 8 turns of that conversation are included.
Raw HealthKit samples are never sent. The model’s job is to phrase numbers it has been given, not to receive your health record.
Model providers. Requests are handled by Anthropic (Claude) and OpenAI (GPT), each acting as the fallback for the other so the feature degrades gracefully:
| Feature | Primary | Fallback |
|---|---|---|
| Coach insights / trends / chat | Anthropic Claude | OpenAI GPT |
| Habit classification | OpenAI GPT | Anthropic Claude |
Both are engaged as processors under agreements that prohibit using your inputs to train their models. Off-topic coach messages are screened and redirected before any substantive model call.
Server logging. Our backend records metadata for every model call — account id, feature label, model, token counts, and the length of your text — for cost control and abuse prevention. Logging of the content (your text, the digest, the reply) is switched off in production and is only enabled temporarily for debugging.
3.4 Purchases (RevenueCat + Apple)
Subscriptions are sold by Apple; Apple processes the payment and we never see your card details. We use RevenueCatto know whether your subscription is active. RevenueCat receives your pseudonymous account id and Apple’s transaction data. We set no name or email on your RevenueCat record.
3.5 Push notifications (Firebase Cloud Messaging)
Your push token is used to send the “your trial ends in 2 days” reminder. Nightly prompts, wind-down reminders and the “how did you sleep?” prompt are local notifications generated on your device.
3.6 Abuse prevention (Firebase App Check / Apple App Attest)
The app proves to our backend that it is a genuine, unmodified copy of Lull. This uses Apple’s App Attest and does not identify you.
3.7 What we do not collect
No advertising identifier (IDFA) and no App Tracking Transparency prompt, because we do not track. No advertising or attribution SDKs. No product-analytics SDK. Crash-report collection is disabled in the shipped build. No location. No contacts, camera, microphone or photos.
4. Why we process it (and legal bases, GDPR/UK GDPR)
| Purpose | Legal basis |
|---|---|
| Tracking and scoring your sleep; showing trends and insights | Explicit consent (Art. 9(2)(a)) for health data, given via the Health permission sheet; withdraw it in iOS Settings |
| Running your account, syncing your profile, restoring it on a new device | Contract (Art. 6(1)(b)) |
| AI coaching and habit classification | Consent for the health-derived digest; contract for delivering the feature |
| Wind-down app shielding | Consent, given via the Screen Time authorization prompt |
| Trial reminders and transactional push | Contract, plus your notification permission |
| Managing subscriptions and entitlements | Contract |
| Rate limiting, App Attest, fraud and abuse prevention | Legitimate interests (Art. 6(1)(f)) |
| Retaining purchase records for refunds, tax and billing disputes | Legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decision-making with legal effect, and we do not profile you for advertising.
5. Sharing
We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law (CCPA/CPRA). We have never done so, including for anyone under 16.
We disclose data only to the processors listed above, each for the narrow purpose described:
| Processor | Purpose |
|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, App Check) | Accounts, profile sync, backend hosting, push, attestation |
| Anthropic | AI coaching and habit classification |
| OpenAI | AI coaching and habit classification |
| RevenueCat | Subscription status |
| Apple | Payments, sign-in, push delivery, App Attest |
We may also disclose data if legally required (court order, lawful request), or as part of a merger or acquisition — in which case we will notify you before your data becomes subject to a different policy.
International transfers. Our backend and Firestore data run in Google Cloud region us-central1 (United States); the model providers process in the United States. Transfers out of the EEA/UK rely on the European Commission’s Standard Contractual Clauses and the UK Addendum.
6. Retention
- On-device data is kept until you delete it, sign out, or delete the app. Local histories are capped — the most recent 1,000 logged factors and 500 technique sessions — and older entries roll off automatically.
- Your account record is kept while your account exists, and is deleted when you delete it.
- AI request content is not stored. Operational metadata logs are kept in Cloud Logging for the retention window of that log bucket and then expire.
- Purchase records at RevenueCat and Apple are retained after account deletion, because we need them to service refunds, chargebacks and tax obligations. They are keyed only to your pseudonymous account id and carry no name or email from us.
7. Your rights and how to use them
Delete everything (the fast path). In the app: You → Delete account. This runs a server-side erasure that removes your account document and every subcollection under it, purges the stored purchase webhook records keyed to you, revokes your Sign in with Apple token (so Lull disappears from Settings → Sign in with Apple), and deletes your authentication account. The app simultaneously wipes all local and shared-container data described in Section 2 — including your free-text habit entries — and clears the copy on your Apple Watch.
Two things deletion does not do, by design, and the app says so before you confirm: it does not cancel or refund your App Store subscription (only Apple can — Settings → Apple Account → Subscriptions), and it does not erase the purchase record described in Section 6.
Signing out also wipes local data, so the next person to use the device does not inherit your sleep history.
Health data. Lull never writes to Apple Health, so revoking access and deleting the app leaves your Health record untouched.
Depending on where you live you also have the right to access, correct, port, restrict or object to our processing, to withdraw consent at any time, and to be free from discrimination for exercising these rights. To exercise any of them, email [email protected] — the in-app “Help & support” link pre-fills your account id so we can find your record. We respond within 30 days (extendable where the law allows). We do not charge a fee, and we will not degrade the service because you asked.
EEA/UK residents may lodge a complaint with their national data protection authority.
8. Security
Data in transit is encrypted with TLS. Data at rest in Google Cloud is encrypted by the platform. Model provider API keys live in Google Secret Manager and are never shipped in the app binary. Backend access is authenticated per request, rate-limited per account, and gated by device attestation. Firestore security rules restrict each account to its own record and to the specific fields the app owns — your subscription state, for example, is server-written and cannot be altered from the app.
No system is perfectly secure. If a breach affects your data, we will notify you and the relevant regulators as required by law.
9. Children
Lull is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If you believe a child has provided us data, email [email protected] and we will delete it.
10. Changes
If we make a material change we will update the “Last updated” date, post the new policy at this URL, and — where the change requires it — ask for your consent again in the app before the new processing begins.
11. Contact
Mileafy LLC 8 The Green, STE A Dover, DE 19901 United States
Email: [email protected]
For subscription, billing or refund questions, contact Apple — see our Terms & Conditions, Section 6.5.