Privacy policy
Last updated: 23 October 2026 (in-app attribution added to the website and creator program section)
Dozely is a sleep app: bedtime stories read by a companion in a little burrow, and a mixer of night sounds. It is available on the App Store (iPhone) and on Google Play (Android), and it is built to be quiet in every sense, including this one. We do not track how you use the app. There is no analytics SDK, no advertising, and nothing is sold or shared for marketing. This page explains exactly what does happen to data.
Who is responsible
ON Group ApS
Færgevej 43C, 6100 Haderslev, Denmark
CVR 43279882
Contact: hello@dozely.net
ON Group ApS is the data controller for the personal data described below.
What Dozely stores on your device only
Most of what the app remembers never leaves your phone. It is not uploaded to us, and we cannot see it:
- Your story progress: which stories you have heard, how far you got, and the point where you drifted off, so the app can offer to pick up there
- Stories you have downloaded for offline listening
- Your saved sound mixes and their names, and the last mix you played
- How the burrow looks (you and your companion), your souvenirs, Still mode, and timer and sound preferences
- Whether your subscription is currently active
Uninstalling the app deletes all of it.
Dozely no longer asks for a sleep goal or how you are feeling, and it does not collect either. Answers that an earlier version stored with an account have been deleted from our servers.
The story library
Stories are streamed and downloaded from our storage provider (Supabase). So that only the app can fetch them, the first time you open Dozely it signs in to Supabase with an anonymous identifier: a random ID with no name, email address or device details attached. When the app fetches the story list or a story, our provider's servers see that identifier and your IP address, as any web server does, and keep them in short-lived service logs. We do not use them to follow what you listen to.
What we collect if you create an account
An account is optional. Dozely works fully without one. If you do create one (with Supabase, our account provider), we store:
| Data | Why | Legal basis |
|---|---|---|
| Email address and a securely hashed password | To sign you in and let your subscription follow you to a new phone | Performance of a contract |
| Account creation and update timestamps | Basic account housekeeping | Legitimate interest in operating the service |
We never see your password. It is hashed by our authentication provider and cannot be read by us or recovered — only reset.
Subscriptions and payment
Dozely offers one subscription, billed yearly after a free trial. We never see or handle your card details. Payment is taken entirely by the store you installed from: the App Store, charged to your Apple ID, on iPhone; Google Play, charged to your Google account, on Android.
To know whether your subscription is active, we receive from our subscription provider, RevenueCat: your subscription status, its renewal or expiry date, the store transaction identifier, and the country of your store account. If you are signed in, this is linked to your Dozely account so the subscription follows you between devices. If you are not signed in, it is linked only to a random identifier generated on your device.
We also look at this subscription information in aggregate — how many people are on a trial, how many subscriptions renewed or were cancelled, and the revenue that adds up to. That is ordinary business reporting about subscriptions, and it is the only kind of analysis we do. It is not tracking of how you use Dozely: it tells us nothing about which sounds you play, which stories you listen to, when you open the app, or how long you sleep.
What we do not do
- No analytics SDK, and no tracking of how you use the app — we cannot see which sounds you play, when you open Dozely, or how long you listen
- No advertising, and no advertising identifiers; no tracking across other companies' apps and websites (Dozely does not ask iOS for permission to track, because it does not track)
- No third-party trackers or social media SDKs
- No selling or sharing of personal data
- No microphone or camera access — Dozely only plays audio, never records
- No location data
- No profiling and no automated decision-making
The website and the creator program
This section covers dozely.net itself. The website sets no cookies and uses no third-party trackers, fonts or scripts; everything is served from our own host (Simply.com, Denmark).
| What | What we keep | Why, and legal basis | How long |
|---|---|---|---|
| Visits to the home page | The page's a and c link parameters (which partner or channel sent you), a hashed form of your IP address, your browser's user agent and the time |
To know which channels send visitors and to keep out bots and floods. Legitimate interest | Up to 13 months, then deleted or kept only as totals |
| The waitlist | Your email address, and the channel that sent you | To send one email when Dozely is in the stores. Consent, which you can withdraw at any time by emailing us | Until that email is sent, or until you ask us to remove it |
Creator links (/c/<name>) |
Which creator's link was opened, a hashed IP address, the user agent, the kind of device (Android, iPhone or other) and the time. Clicks by known bots are not stored | To count clicks for the creator and pay commission correctly. Legitimate interest. Creators see only totals, never you | Up to 25 months |
| In-app attribution (which creator sent you) | On Android, the Google Play install referrer the app reads once on first launch (only the creator's link name it carries). If you type a creator code in the app, that code. Either is stored with our subscription provider, RevenueCat, as an attribute of your app user id (the random identifier, or your account if you are signed in). On iPhone, a creator link only adds Apple's campaign tag to the App Store link; Apple reports downloads and sales per creator to us as totals, never per person | To pay the creator who referred you their commission. Legitimate interest. Creators see only totals, never you | For as long as your subscription exists, plus what accounting law requires for the commission records (5 years in Denmark) |
| Creator program applications | Name, channel link, email, country, monthly views, how you would promote Dozely, a hashed IP address and user agent. A copy is emailed to our inbox | To review your application and, if you join, run the program with you. Steps before a contract, then performance of a contract | Declined: up to 12 months. Creators: while you take part, plus what accounting law requires (5 years in Denmark for payout records) |
| Creator dashboard and admin login | Your email address, used by Supabase to send a one-time login link; the login session is stored in your browser's local storage, not in a cookie | To show creators their own numbers. Performance of a contract | While you take part in the program |
A hashed IP address is your IP address run through a one-way function together with a secret value, and shortened. We cannot turn it back into your IP address; it only lets us see that two requests came from the same place, for limits against spam and duplicate clicks.
Applications, creator links and logins are stored with Supabase in the EU (Ireland), as described below. Questions about any of this: hello@dozely.net.
Who processes data for us
We use a small number of providers, each under a data processing agreement, each only for the purpose named:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Account sign-in, account data storage, and the story library (streaming and downloads) | Ireland (EU) |
| RevenueCat | Subscription status management | United States |
| Apple (App Store) | Payment processing and app distribution on iPhone | Global, per Apple's own policy |
| Google Play | Payment processing and app distribution on Android | Global, per Google's own policy |
Your account data is stored in the EU (Ireland) and does not leave it. Subscription status is processed by RevenueCat in the United States; that transfer relies on the European Commission's Standard Contractual Clauses.
How long we keep it
Account data is kept for as long as your account exists. Delete the account and we delete the associated personal data, other than records we are legally required to retain — chiefly transaction records kept for accounting purposes. Data stored only on your device is gone the moment you uninstall.
Deleting your account and data
In the app: open You, tap Account and settings, then Account, and choose Delete account. After one confirmation your account and everything stored with it are erased immediately and permanently. There is no waiting period and nothing to email us about.
Or by email: write to hello@dozely.net from the address your account uses and ask us to delete it. We will do so within 30 days and confirm by email.
Deleting your Dozely account does not cancel your subscription — subscriptions are managed by the store. On iPhone, cancel it in Settings, under your name, then Subscriptions. On Android, cancel it in the Play Store under Payments & subscriptions. Otherwise it will renew.
Your story progress and downloads live only on your phone: uninstalling Dozely erases them.
Your rights
Under the GDPR you have the right to access your data, correct it, delete it, receive a portable copy, restrict or object to processing, and withdraw consent where processing relies on it. Email hello@dozely.net and we will respond within 30 days.
If you believe we have handled your data improperly you may complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk, or to the supervisory authority in your own country.
Children
Dozely is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.
Changes
If this policy changes materially we will update the date at the top and, for significant changes, notify account holders by email.