PRIVACY POLICY

EFFECTIVE DATE: October 9, 2026

The Breath Works (“Company,” “we,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you use thebreathworks.com, The Breath Works mobile app and our related services (the “Services”). References below to the Website describe our website-specific practices.

1. INFORMATION WE COLLECT

We may collect the following types of personal data:

CONTACT INFORMATION: Email address.

SUBSCRIPTION ACTIVITY: Details about your subscription and the classes you’ve accessed.

TECHNICAL DATA: IP addresses, cookies, and usage data.

PAYMENT INFORMATION: Apple processes subscriptions purchased in the iPhone app. Stripe processes memberships purchased directly through our Website. We receive the account, subscription, transaction and purchase-status information needed to verify and manage access. We do not receive or store your full payment-card details.

JOURNAL DATA: See the section below on Journal Data.

QUIZ PREFERENCES: Experience, selected goals, preferred session length, recommended class/version, and date answered. See the session finder section below.

App account and practice activity

When you create or sign in to an account, we process your email address, account identifier and authentication information. We associate saved preferences, favorites, listening progress, completed listens, streaks and related practice activity with your account to provide access, personalize recommendations and understand how the Services are used. These records are not anonymous. Listening and completion reports describe playback, not measurements of your breathing, a medical assessment or proof that you experienced a health benefit.

We also process security and operational information needed to protect accounts and keep the Services working, such as request timing, protected identifiers used for rate limiting, purchase-verification status and generation-stage or failure records. These records may be associated with your account. The app does not upload an audio recording of your voice for these features.

Session finder and saved breathwork preferences

The app saves your quiz choices on your device and can save them to your Breath Works account when you are signed in, so recommendations can reflect those preferences. The descriptions of browser session storage, Website checkout, Stripe checkout information and internal signup notifications below apply to the Website flow. New memberships purchased in the iPhone app are processed by Apple.

What you provide. If you use the session finder, we collect the choices you make about your breathwork experience, what you are looking for (such as feeling calmer, improving your mood, or releasing emotions), and your preferred session length. We also record the recommended class/version, when you answered, and that the preferences came from the quiz. These are your stated preferences; we do not treat them as a diagnosis or medical assessment.

How we use and connect the answers. We use your answers to recommend a starting session and help us understand your preferences when providing membership services and support. Answers can be associated with the email and checkout you submit. For a new member, they are attached to the member profile when signup completes. When you are signed in, submitting the flow can update your own profile. Authorized administrators can view saved quiz preferences. This is separate from the journal-data section below.

Where they go. Quiz choices and saved preferences are processed on our website and hosting infrastructure, and in the internal signup notifications described below. The quiz integration does not send the answer fields to Stripe, Meta, Google Analytics, or other advertising tools. Stripe receives the payment/account information needed for checkout and an identifier for the recommended session so we can return you to it. The payment, analytics, and cookie practices elsewhere in this policy still apply to other website activity.

Storage and retention. We use browser session storage to retain quiz choices and the recommended class during the same browser-tab session. On our server, a prepared checkout context expires after 30 minutes. If you proceed to checkout, a separate pending copy of your preferences can remain for up to 7 days to connect a completed signup to your account; it is removed from that pending store after transfer. Expired temporary records are no longer used and are removed through routine cleanup. Saved account preferences remain until replaced by newer answers or deleted following a verified request or account deletion. Routine backups may retain copies until they are rotated and are not used for everyday personalization.

Your choices. You can browse the class library without taking the quiz. Retake the flow while signed in to update your choices, or email hello@thebreathworks.com to request access, correction, or deletion of saved quiz preferences. We may verify your identity before acting on a request. Removing quiz preferences does not cancel a paid membership; cancellation is available through your account’s billing settings. Completing the quiz does not by itself subscribe you to marketing emails.

Signup notifications and advertising measurement

Signup source and internal notifications. We record available campaign tags (source, medium, campaign, content, and term) and the referring website domain to understand how visitors reach us. We retain these tags in browser session storage for up to 24 hours and can associate them with your checkout and member profile. Authorized administrators receive a new-signup email containing your contact details, selected plan and offer, trial status, quiz preferences, recommended session, and recorded referral source. Our email delivery providers process that notification. These are internal membership notifications, not a subscription to marketing email. Email and operational records are retained as needed for membership administration and support and are included when we review a verified access or deletion request.

Meta conversion measurement. When a marketing consent choice is recorded at checkout, the session finder can send Meta a confirmed trial-start event and successful payment events to measure advertising performance. These events include the event time, membership plan, offer, currency, and actual amount paid, along with a hashed email address, browser user agent, and existing Meta browser or click identifiers when available. Hashing supports account matching; it does not make the information anonymous. The conversion payload excludes quiz answers, recommended class names, campaign text, and URLs containing query parameters. A free trial is reported with zero revenue. Matching context is retained for up to 30 days and is removed from the active store when the associated preferences are erased. Global Privacy Control is honored when this context is collected. You can manage tracking choices through the cookie preferences or contact us to withdraw consent and request removal of stored matching information. Meta processes information under its Privacy Policy.

Membership offer testing

We may compare different membership offers, including offering different first-year discount percentages to eligible visitors. When you submit your email in the session finder, we can assign you to a test group using a protected identifier derived from your email, so returning visitors remain in the same group. This identifier is pseudonymous, not anonymous. We record your group, assignment date, available referral tags, whether pricing or an offer was shown or selected, and related subscription, payment, refund, fee, and cancellation information to evaluate the offers. The test identifier and group are associated with your Stripe checkout and subscription; authorized administrators can see the group in internal signup notifications and reports. The experiment records do not send your quiz answers to advertising platforms. We retain these records as needed to evaluate membership offers and administer our services, subject to the retention and access/deletion provisions of this policy. Contact hello@thebreathworks.com to request access to or deletion of the linked experiment records.

Your starting session and listening milestones. We can use your saved questionnaire recommendation to personalize Day 1 of the web welcome experience. For signed-in members, the web player can report when a class recording has played for at least 3 seconds, when at least 90% has been listened to, and the dates of playback. This includes recordings you choose yourself without taking the questionnaire. We store the class and recording identifier, recording length, sections played, and start, completion and playback dates with your member account. Played sections let progress accumulate across visits without counting repeated or skipped sections twice. We retain up to 90 playback dates per recording. We use these first-party records to understand follow-through after signup, first-class completion and return visits, and to evaluate membership offers. Browser reporting can be incomplete and is not a medical assessment or proof that an exercise was performed. These records are retained for membership analytics and support until deletion following a verified request or account deletion, subject to routine backup rotation. They are included in access and deletion requests and are not sent to Meta by this integration.

Custom Meditation and feedback

Creating a meditation. When you use Custom Meditation, we process the words you submit, session length and guidance settings, suggested and accepted meditation descriptions, generated scripts and recordings, and request status information. Before generation, the app identifies OpenAI and ElevenLabs and asks for your permission. OpenAI receives your submitted words and session settings to help write and review the meditation. ElevenLabs receives the generated script and speech settings to create the recording. Our application, hosting and storage providers also process this information to manage generation, save your history and provide playback. Saved requests may include previews, unfinished requests and failures. Your saved custom meditations are associated with your account; creating one does not publish it as a public class.

AI-provider processing. The generation providers may retain submitted content, output and service information under the terms, privacy policies and controls that apply to our account. OpenAI states that API data is not used to train its models unless the customer opts in; this is separate from security and other retention. ElevenLabs may use submitted content to improve its models unless applicable account controls or contractual terms exclude that use. See OpenAI’s API data controls, ElevenLabs’ Privacy Policy and ElevenLabs’ data-use controls. We do not represent this processing as involving zero retention or as having the same settings for every provider.

Optional feedback. After an eligible completed listen, the app may ask how the meditation was. You can skip the rating, submit a rating without a note, or add a note of up to 500 characters. Ratings and notes are linked to your account and meditation. Authorized staff may read notes to understand what worked or could improve. Please avoid unnecessary identifying details or information about other people.

Improving future guidance. We use broad topic summaries from saved meditation descriptions, app-reported completed listens and optional feedback to decide where to improve future guidance. Our topic report presents counts rather than personal requests, individual meditation titles or scripts. Authorized staff view submitted notes separately. These records are not anonymous merely because a report presents counts. Topic groups are approximate, and a completed listen does not establish that you performed a practice or experienced a health benefit. A missing rating is not counted as a positive or negative response. We do not send feedback ratings or notes to OpenAI, ElevenLabs or advertising providers, and do not automatically retrain AI models using them. We may make reviewed changes to our teaching guidance for future meditations; feedback does not change recordings you have already saved.

Retention and deletion. Custom meditation requests, descriptions and recordings remain associated with your account until you delete them or they are otherwise removed under the applicable retention process. Removing a downloaded copy does not delete the saved cloud recording. Listening, rating and note records are scheduled for removal 90 days after the completed listen; adding or retrying feedback later does not restart that period. Deleting the associated meditation or account removes those records through our deletion process, including applicable recovery copies. A content-free record of feedback invitations used only to limit how often we ask may remain for up to 90 days after an invitation even if an individual meditation is deleted; deleting your account removes it. Cleanup may involve processing time or retries after a failure, rather than instantaneous removal from every system. Generation providers may separately retain information under their applicable terms and legal obligations.

Your choices. Custom Meditation and feedback are optional. You do not need to submit a diagnosis or detailed medical history. You can withdraw permission for future generation requests in the app’s Custom Meditation privacy controls and separately delete saved meditations. Withdrawal does not itself cancel generation already underway or delete saved requests. Contact hello@thebreathworks.com for access, correction or deletion requests. Account deletion and subscription cancellation are separate actions.

Optional music features

If you choose a music-library feature, the app requests the relevant device permission and uses the selected music information for playback. These features do not upload your entire music library or record audio through your microphone. Manual rhythm taps are processed on your device. If you provide a Spotify link, the app may send that link to Spotify to resolve song or playlist information. If you request a Spotify song’s tempo, the selected track identifier is sent to ReccoBeats to look up song information and audio features. These network requests reveal the request and your network IP address to the receiving service; they do not include your Breath Works account token or a recording of your audio. You can use manual rhythm taps without requesting a tempo lookup. Spotify and ReccoBeats may separately process request and service information under their applicable policies and terms. See Spotify’s Privacy Policy and ReccoBeats’ terms.

2. JOURNAL DATA

The app’s journal stores your entries on your device using iOS Data Protection. Writing a journal entry does not automatically send it to The Breath Works, OpenAI or ElevenLabs, and the current journal does not provide cloud synchronization or automatic AI analysis. Journal files are excluded from the app’s ordinary device backups, so we cannot recover entries from our servers if your device or local data is lost. Entries in Recently Deleted remain stored locally until you permanently delete them. If you export or share an entry, the recipient or app you choose processes that copy. If you separately submit journal text as a custom meditation request or feedback note, it follows the practices for that feature described above.

3. HOW WE COLLECT DATA

We collect data through:

•Information and activity submitted through the app, including account sign-in, purchases, saved preferences, practice activity, custom meditation requests and feedback.

•Online forms completed on the Website.

•Cookies and similar technologies.

•Emails you send us.

•In-person interactions.

4. PURPOSE OF DATA COLLECTION

We collect your data for the following purposes:

•To create and authenticate accounts, verify purchases, provide membership access and manage your subscription.

•To create and deliver requested custom meditations, save practice activity and handle support requests.

•To improve and personalize your experience.

•To send marketing updates (with your consent).

•To comply with legal obligations.

5. DATA SHARING

We only share your personal data with trusted third parties when necessary:

PAYMENT PROCESSING: Apple processes purchases made through the App Store, and Stripe processes purchases made directly through our Website. These providers process payment and billing information under their own terms and privacy policies. We use verified purchase information to provide membership access and handle account support.

EMAIL SERVICES: We use email delivery services for account, membership and support communications. Kit, formerly ConvertKit, processes subscriber records and membership-related email communication. Website checkout and membership events can create or update Kit records containing an email address, available name, membership tags and account-related custom fields. These records are not used only for authentication. Marketing communications and your choices are described elsewhere in this policy.

ANALYTICS PROVIDERS: We may use Google Analytics or similar tools to analyze Website performance and user behavior.

SERVICE PROVIDERS: Our WordPress membership infrastructure and providers including GoDaddy, Railway and Cloudflare process information for hosting, membership administration, generation, security, storage and audio delivery. The information processed depends on the service being provided. Custom Meditation also uses OpenAI and ElevenLabs as described above.

SUPPORT SERVICES: If you email us, Google Gmail processes your email, including sender and message information. Our support workflow uses Google Sheets and Apps Script to keep a private queue, track requests and assist support handling. Some messages’ subjects and latest message text are sent to Google’s Vertex AI Gemini service to classify the request and produce a brief summary for support routing. Authorized people handling support can read the messages you send. The app’s Get Help link opens your email app; it does not automatically upload a support message. Support-service processing is separate from the Custom Meditation generation permission described above. Please avoid sending unnecessary sensitive details or information about other people.

THIRD-PARTY PRIVACY POLICIES

Service providers process information for the functions described in this policy under the arrangements and controls that apply to those services. Some providers also process information for their own billing, security, legal or other purposes under their own notices. Relevant notices include Apple, Stripe, Kit, Google, Railway and Cloudflare. Kit describes its processing of subscriber records in its Data Processing Addendum. The AI and music providers are described in their respective sections above. Provider retention and data-use practices depend on the services, account settings and terms involved; use of a provider does not by itself mean that it retains no information.

We do not sell your personal data.

6. DATA STORAGE AND RETENTION

STORAGE: Data is stored on our hosting infrastructure and in our website membership system; service providers process data as described above.

RETENTION: Personal data is retained for as long as necessary to fulfill the purposes outlined in this policy or as required by law.

Account deletion and retained records

You can request deletion in the app under My Account → Delete Account. We verify account ownership before deleting the account and associated account records through our deletion process. Custom Meditation deletion can include saved requests, recordings, feedback and applicable recovery copies. Some cleanup occurs through a queue and can take time or require retries after a service failure. We may retain limited content-free security, purchase-verification, deletion-recovery or suppression records where needed to prevent replay, complete deletion and meet legal obligations. Protected or hashed identifiers used for these purposes are not necessarily anonymous.

Deletion requests to email services can unsubscribe or suppress a subscriber without erasing every historical record held by that service. Support messages, billing records and other information may separately remain where needed for support, legal obligations or the provider’s own applicable requirements. Contact hello@thebreathworks.com for a verified request covering these records. Routine backups may retain copies until they are rotated. We do not represent account deletion as instantaneous erasure from every independent provider, recipient or device. The journal’s local-storage practices are described above.

Deleting your Breath Works account or uninstalling the app does not cancel an Apple or website subscription. Manage cancellation through the billing provider for your subscription; see the Terms of Service.

7. YOUR RIGHTS

As a user, you have the right to:

•Access your personal data.

•Request correction or deletion of your data.

•Object to processing for certain purposes.

•Withdraw consent for marketing communications.

To exercise these rights, contact us at hello@thebreathworks.com.

8. COOKIES AND TRACKING TECHNOLOGIES

We use cookies to enhance your experience on the Website. Cookies help us track site usage, preferences, and performance. You can manage cookie preferences through your browser settings.

9. INTERNATIONAL DATA TRANSFERS

Our Services and providers may process or allow access to information in the United States and other countries. Processing locations and applicable transfer safeguards depend on the provider services, account settings and contracts. Contact hello@thebreathworks.com for information about relevant processing locations and any applicable transfer safeguards. This policy does not promise that all processing or access occurs exclusively in the United States.

10. CHILDREN’S PRIVACY

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children.

11. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Updates will be posted on this page, and the effective date will be updated accordingly. We encourage you to review this page periodically for changes.

12. CONTACT US

If you have any questions about this Privacy Policy or wish to make a privacy-related request, please contact us at:

EMAIL: hello@thebreathworks.com