Somly Privacy Policy
Effective date: 25 October 2026
This policy explains what Somly does with your data. It describes the app as it actually behaves, feature by feature — not a generic template.
The short version
- Somly works without an account. Alarms, timers, reminders, your sleep history and your night recordings all live on your phone. If you never sign in, nothing about you is stored on our servers unless you choose to send us feedback.
- Signing in stores a small profile so your account works across devices.
- Somly Plus syncs your sleep history to your own private area of our database.
- Night audio leaves your phone in exactly one case: you have linked a parent account that has Plus, and sleep sharing is on. Those copies are deleted automatically after 7 days.
- There is no advertising, no analytics SDK, and no tracking. We do not sell or share your data for advertising, and Somly does not follow you across other companies' apps or websites.
- When the app crashes, a crash report is sent so we can fix the bug. It says what went wrong in the app, not who you are or what you were doing.
Who this policy covers
Somly ("we", "the app") for iOS and Android. Contact: privacy@somly.app.
What stays on your phone
These never leave your device unless you explicitly back them up or share them:
- Alarms, timers, reminders and lists, and all app settings
- Your sleep history: bedtime, wake time, duration, quality score, mood, wake-up difficulty, snooze count, your notes and dream notes
- Night audio recordings and wake notes. Somly records sound during a sleep session to build your morning report. The audio is written to the app's private storage and deleted according to the retention period you pick in Sleep settings.
- Custom alarm sounds you add from your own files
- Photos you attach to reminders
- Your chosen weather location
Deleting the app removes all of it.
What we store when you sign in
Signing in is optional and is what enables family features, subscriptions and sync. We use Firebase Authentication (Google), which holds your email address and name for any signed-in account. Under your account id we store:
| Data | Why |
|---|---|
| Email address | Identifies the account and lets you sign back in |
| Display name and nickname | Shown to family members you link with |
| Account id (uid) | The key everything else is stored under |
| Avatar choice, or an uploaded avatar photo | Shown in the app and to linked members |
| Subscription status and expiry, and the store's identifier for the purchase | Unlocks Plus features and lets Apple or Google tell us when the subscription changes |
| Notification token for this device | Lets family nudges and alarm reminders reach you |
| Invite code | Lets a buddy or family member find your account to link with it |
| Time zone and the time of your next alarm | Shown to people you are linked with, and used to time family alerts |
| Wake-up history and streak | Shown to people you are linked with |
| Alarms and reminders a linked parent sets for you | Delivered to your phone; a reminder is removed from our servers once your phone has received it |
Our database is for accounts with Somly Plus, and for a child's phone that a parent with Plus manages. A free account keeps only its sign-in record, its invite code and its subscription status there; everything else in the table stays on the phone.
Sign in with Apple and Google Sign-In are supported. If you use Apple's "Hide My Email", we only ever see the relay address Apple gives us.
Somly Plus sync
With an active Plus subscription, your sleep sessions are mirrored to your own private area of our database so they survive a new phone. That record contains the same fields listed above, including any notes and dream notes you wrote. It does not contain the audio. Security rules restrict it to your account.
Cloud backup
With Plus you can also back up your alarms, timers, reminders, lists and app settings from Profile, and restore them on another phone. There is one backup per account, and a new one replaces the last. It does not include photos attached to reminders, sounds you added from your own files, or sleep recordings.
Kids & Family sleep sharing
This is the only feature that uploads recordings, and it needs all of the following at once:
- You are signed in, and
- the parent you linked has an active Somly Plus subscription, and
- you have linked a parent account and the link is active, and
- sleep sharing is turned on in the app.
Linking is a deliberate action on both sides. Once it is in place, sharing is on by default and can be turned off at any time in the app.
While it is on, your last 7 nights — the morning report, the detected sound highlights, and (if you leave recordings included) the night's audio — are readable by your linked parent. Notes and dream notes you write about a night are never part of the shared copy. Each shared night is stamped to expire 7 days after you woke up, and a scheduled job deletes the record and the audio when it does. Turning sharing off deletes the shared copies immediately. Audio kept on your own phone follows your own retention setting, separately.
Wake-up buddies and family links
Linking with a buddy or a family member is done with an invite code and has to be accepted by the other side. Once a link is active, the people you are linked with can see your name and avatar, your wake-up streak, whether and when you woke up on recent days, the time of your next alarm and your time zone — that is what the feature is. Someone who has only sent you a request sees none of it until you accept. A parent you linked can also set and change alarms and send reminders to your phone. Removing a link ends all of this at once.
Location and weather
If you allow location access, Somly reads your approximate location (low-accuracy) and sends the coordinates to our own weather service, which runs on Cloudflare and fetches the forecast from MET Norway (the Norwegian Meteorological Institute). MET Norway is sent only the coordinates, rounded to about a kilometre; the request comes from our service, so it never sees your phone's address. Searching for a place by name sends that text to the same service, which looks it up with GeoNames or with Photon (place names from OpenStreetMap, run by komoot); they too see only the search text. Our service receives no account information and no device identifier. It keeps forecasts for a few hours and search results for up to a week in Cloudflare's cache, so that neighbours and repeated searches are answered without asking again, and keeps no record of who asked. Your chosen location is saved on your phone, not on our servers. You can decline location access and pick a city manually instead.
To show the name of the place, the same coordinates are passed to your phone's own place-name service — Apple's on iOS, Google's on Android.
Microphone
The microphone is used during a sleep session to detect sounds like snoring and noise for your morning report, and to record a short wake note if you make one. It is not used at any other time. Where that audio goes is covered above: local by default, uploaded only under the Kids & Family conditions.
Apple Health and Health Connect
This is off unless you switch it on in Profile → Health. When it is on:
- Each night you track is saved as sleep in Apple Health (iPhone) or Health Connect (Android) — its start and end time only — so your other health apps can see it.
- For each night, Somly reads the heart rate, heart rate variability and breathing rate that a watch or other device wrote there during that night, and shows them in the night's report.
What Somly reads from Health stays on your phone. It is not stored by Somly, not synced, not included in cloud backups or Kids & Family sharing, and never sent to us. Switching the feature off stops Somly reading and writing; what it already saved stays in Health, where you can delete it and take back access.
Camera and photos
The camera is used for wake-up missions — scanning a barcode, photographing a place you registered, or checking for a smile — and for taking an avatar photo. Mission photos are evaluated on the device and are not uploaded. Photo library access is used to attach an image to a reminder or choose an avatar. Only an avatar photo is uploaded, and only to your own account's storage.
Notifications
Alarms and reminders are delivered locally by your phone. Push notifications are used for family features — a nudge from a linked member, or an alert that someone overslept. Your device's notification token is stored with your account so those can be delivered.
Crash reports
When Somly crashes or runs into an unexpected error, a crash report is sent to Firebase Crashlytics, a Google service. The report contains what went wrong and where in the app's code, the app version, the phone model, operating system version and language, and a random identifier for this installation of the app, which is not tied to your account. It does not contain your name, email address or account id, and none of your alarms, reminders, sleep data, recordings or notes. We use crash reports only to find and fix bugs.
Feedback
Profile → Write feedback sends us what you wrote, the rating and category you picked, and the app version, operating system version and language of the phone it came from. If you are signed in, your account id and email address go with it so we can reply. It works without an account, and then nothing identifying you is attached.
The website waitlist
If you join the waitlist at somly.app, we store the email address you give, your name if you add it, which phone you use, and the language and country your browser reports. Before saving, we check whether that email is already on the list or already has a Somly account, and tell you if it is. We use the entry to send you one email when Somly launches, and for nothing else. Write to privacy@somly.app to be taken off the list at any time.
Purchases
Somly Plus is sold through the App Store or Google Play. We never see your payment details. Your purchase is verified with Apple or Google, and the result — active or not, and until when — is written to your account. Manage or cancel the subscription in your App Store or Google Play settings; deleting your Somly account does not cancel it.
Who else processes your data
- Google (Firebase) — authentication, database, file storage, push messaging, crash reports, and the server-side code that verifies purchases and expires shared nights.
- Apple — sign-in, push delivery, subscription verification, and on iOS the name of the place your weather is for.
- Google (Android) — on Android, the name of the place your weather is for.
- Cloudflare — runs our own weather service: the coordinates or search text your phone sends, and the internet address the request comes from, which is used only to limit how often one address can ask and is not stored. And, only if you ask Somly to generate a background picture while signed in with Plus: the words you type and your sign-in token go to our own service on Cloudflare, which checks your subscription with Firebase and has Cloudflare's Workers AI paint the picture. It keeps a count of the pictures each account generated that day, for two days, and nothing else.
- MET Norway — weather forecasts, from rounded coordinates only, asked for by our weather service rather than your phone.
- GeoNames and Photon (komoot, OpenStreetMap data) — place search, from the search text only, asked for by our weather service.
- Pollinations — the same request, when our own service cannot take it (you are signed out, or the day's pictures are used up): only the words you type are sent to pollinations.ai, which returns the picture. Nothing about you or your account goes with them.
That is the complete list. We do not use any advertising network, analytics SDK or attribution SDK.
What we do not do
- No advertising and no ad identifiers
- No analytics or behavioural profiling
- No tracking across other companies' apps or websites
- No selling or sharing of personal information for advertising
- No reading of your contacts, calendar, messages or browsing history
- No use of Apple Health or Health Connect data beyond what is described above, and none unless you switch it on
How long we keep things
| Data | Kept |
|---|---|
| On-device sleep audio | The retention period you choose in Sleep settings |
| Shared nights and their audio | 7 days after the night ends, deleted automatically |
| Account profile, synced sleep history, cloud backup and wake-up history | Until you delete your account, or until your Somly Plus subscription ends — the cloud copy is deleted then; what is on your phone stays |
| Website waitlist entry | Until Somly has launched and the launch email is sent, or until you ask us to remove it |
| Feedback you sent | Until we no longer need it to improve Somly; your account id and email are removed from it when you delete your account |
| Crash reports | 90 days, then deleted by Firebase Crashlytics |
| Local alarms, reminders and history | Until you delete them or remove the app |
Deleting your data
Profile → Delete account permanently deletes your Somly account and everything stored for it in the cloud: your profile, synced sleep history, cloud backup, uploaded avatar, shared nights, wake-up history, your invite code, your links to buddies and family, and account settings. Feedback you sent is kept without your account id or e-mail address. Alarms, timers and data on your phone are kept, and you continue as a guest. This cannot be undone, and it does not cancel an active subscription — cancel that in your Apple ID or Google Play settings.
You can also delete individual items without deleting the account: a single night and its recording, all recordings, or all shared copies (by turning sharing off).
Children
Somly's family features let a parent and a child link accounts. A child's account holds the same limited profile described above, and a linked parent can see the child's morning reports and, if enabled, night recordings, for 7 days. A parent can unlink at any time, which immediately ends that access.
If you believe a child has given us personal data without the involvement of their parent or guardian, write to privacy@somly.app and we will delete it.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to your local data protection authority. Account deletion in the app covers most of this immediately. For anything else, write to privacy@somly.app.
Our legal bases for processing, where the GDPR applies, are: performing the contract you enter into by using the app (your account, sync and subscription), your consent (location, microphone, camera, sleep sharing — each revocable in your device or app settings), and our legitimate interest in keeping the service working and secure.
Where your data is processed
Our cloud services run on Google and Apple infrastructure and may be processed in countries other than yours, including the United States. Where required, the transfer is covered by the standard contractual clauses those providers offer.
Security
Traffic between the app and our services uses HTTPS. Access to your stored data is enforced by server-side rules that restrict every record to your own account and, for shared nights only, to an actively linked parent while the subscription is active. Subscription status is written only by our server after verifying the purchase with Apple or Google — the app cannot grant itself Plus.
No system is perfectly secure, and we cannot guarantee absolute security.
Changes to this policy
If we change how Somly handles your data, we will update this page and move the effective date. Significant changes will be announced in the app.