Privacy Policy

1. Introduction

Graverholt Unlimited ("Company," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use The Gateway Experience app, our website, iOS app, Android app, and related services (collectively, the "Service").

Please read this Privacy Policy carefully. By using the Service, you consent to the practices described in this policy. If you do not agree with our policies, please do not use the Service.

The Gateway Experience is operated by Graverholt Unlimited. Your account information, authentication status, and subscription data are used solely to provide and improve the Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address and password when you create an account, or basic profile information (name, email) when you sign in with Apple or Google
• Third-Party Sign-In: If you use Sign in with Apple or Sign in with Google, we receive your email address and a unique identifier from those services. We do not receive your Apple ID password or Google password.
• Payment Information: Billing details processed securely through Stripe (web), Apple App Store (iOS), or Google Play (Android). We do not store your full credit card number or payment credentials.
• Preferences: Your music preferences, style selections, binaural settings, and custom binaural presets you create
• Uploaded Audio: If you use the Binaural Infusion feature, audio files you upload (MP3, WAV, FLAC, M4A) are processed through our DSP pipeline and stored in your personal library. You may also import audio from YouTube videos where available — imported audio is temporarily downloaded for processing and deleted immediately after. We do not share, sell, or use your uploaded or imported audio for any purpose other than providing the Service to you.
• Communications: Information you provide when contacting our support team

2.2 Information Collected Automatically

• Usage Data: Track history, listening patterns, and feature usage
• Usage Statistics: Meditation minutes, session counts, streaks, and preferred styles for your personal stats dashboard
• Device Information: Browser type, operating system, device type, and device identifiers
• Mobile Device Data: On iOS and Android apps, we may collect device model, OS version, app version, and anonymous usage analytics to improve the app experience
• LED Headset Data: If you use a compatible LED headset, we collect Bluetooth connection status and headset battery level for the duration of your session. We do not store headset data after your session ends. Accelerometer/IMU telemetry from the headset is processed locally on your device and is never transmitted to our servers.
• Log Data: IP address, access times, pages viewed, and referring URLs
• Cookies and Local Storage: Session cookies, authentication tokens, and local storage for service functionality and offline access

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and manage your subscription
• Create meditation music based on your preferences
• Send you service-related communications (account verification, billing, updates)
• Respond to your comments, questions, and support requests
• Monitor and analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

3.1 Legal Basis for Processing (GDPR)

If you are in the EEA, UK, or another jurisdiction requiring a legal basis, we process your data under:

• Contract Performance (Article 6(1)(b)): Account creation, audio generation, subscription management, and delivering the Service you requested
• Legitimate Interest (Article 6(1)(f)): Service improvement, analytics, fraud prevention, and security measures
• Consent (Article 6(1)(a)): Marketing communications and non-essential cookies. You may withdraw consent at any time.
• Legal Obligation (Article 6(1)(c)): Tax and financial record retention, responding to lawful government requests

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

4.1 Service Providers

We share information with third-party vendors who perform services on our behalf:

• Stripe: Payment processing and subscription management for web purchases
• Apple: In-App Purchase processing and subscription management for iOS app purchases. Apple's privacy policy applies to transactions made through the App Store.
• Google: In-App Purchase processing and subscription management for Android app purchases. Google's privacy policy applies to transactions made through Google Play.
• Cloud Hosting: Data storage and infrastructure (Render for API/worker services, PostgreSQL for database)
• Audio Processing: Third-party audio processing services
• Redis: Job queue management for background processing
• HubSpot: Customer relationship management, support ticket routing, and marketing communications (with your consent)
• Analytics: Service usage analysis
• Modal: Cloud-based audio processing infrastructure used to generate and process binaural beat audio. Audio data is processed on Modal servers and returned to our systems.
• AWS S3 (or S3-compatible storage): Secure cloud storage for generated audio tracks, uploaded audio files (Binaural Infusion), and music library assets.
• AWS CloudFront: Content delivery network (CDN) for efficient, low-latency audio streaming. Audio files are served via time-limited signed URLs through CloudFront edge locations.
• Cloudflare: DNS, CDN, and security services including bot protection (Turnstile). Cloudflare may process IP addresses and browser metadata for security purposes.

4.2 Authentication Providers

If you choose to sign in using third-party authentication:

• Apple: Sign in with Apple provides your email (or a private relay email) and a unique identifier. Apple does not share your Apple ID password with us.
• Google: Sign in with Google provides your email, name, and profile picture (if available). Google does not share your Google password with us.

4.3 Legal Requirements

We may disclose your information if required by law, legal process, or government request, or to protect our rights, privacy, safety, or property.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing (bcrypt)
• JWT-based authentication tokens
• Secure webhook signature verification for payment processing
• Database encryption at rest
• Regular security assessments
• Access controls and authentication

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Specific retention periods:

• Account Data: Retained while your account is active
• Audio Tracks: Stored in your library for up to 180 days from creation. Tracks not accessed within 30 days are moved to cost-efficient storage. After 180 days, audio files are automatically removed from cloud storage. You may download or re-generate tracks at any time while they are available. Pre-rendered sample tracks (free tier) are retained indefinitely.
• Custom Binaural Presets: Stored until you delete them or your account is terminated
• Processing Job Data: Temporary processing data retained for up to 30 days for debugging and recovery purposes
• Payment History: Retained as required by law and for accounting purposes (7 years for tax compliance)
• Uploaded Audio (Infusion): Source files are processed and may be temporarily cached during processing. Processed tracks are retained in your library until you delete them or your account is terminated
• Usage Statistics: Meditation minutes, streaks, and preferences retained while account is active
• Subscription Data: Records of subscription purchases (Stripe, Apple, or Google) retained for billing dispute resolution
• Local Device Storage: The mobile application may automatically save audio tracks to your device after playback to enable offline listening and reduce data usage. This occurs only over Wi-Fi by default. Locally stored tracks remain on your device until you clear them via Account settings, uninstall the app, or the cache limit (default 2 GB) is reached, at which point the oldest tracks are removed automatically. You can disable auto-save or clear all locally stored tracks at any time from the Storage & Offline section in your Account settings. No locally cached data is transmitted back to our servers.

We may retain certain information after account deletion for legitimate business purposes (such as legal compliance, dispute resolution, or enforcing our agreements).

7. Your Rights and Choices

Depending on your location, you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information
• Portability: Request transfer of your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing communications
• Restrict Processing: Request limitation of how we use your data

To exercise these rights, please contact us at josh@graverholtunlimited.com. We will respond to your request within 30 days.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Keep you logged in to your account
• Remember your preferences and settings
• Understand how you use our Service
• Improve our Service based on usage patterns

You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of the Service.

8.1 Mobile App Tracking

Our iOS and Android apps do not use advertising tracking or sell your data to advertisers. We collect only the minimum data necessary to provide and improve the Service:

• iOS: We do not request App Tracking Transparency permission as we do not track users across other companies' apps or websites for advertising purposes
• Android: We do not use the Advertising ID for cross-app tracking
• Analytics: We may collect anonymous, aggregated usage statistics to understand feature usage and improve the app experience

9. Health Data (Apple Health & Health Connect)

The Gateway Experience integrates with Apple HealthKit (iOS) and Health Connect (Android) to provide wellness insights alongside your meditation practice. This section describes how we handle health data, in compliance with Apple's HealthKit guidelines and Google's Health Connect policies.

9.1 Health Data We Access

• Write: Mindful minutes (meditation session duration, start/end times)
• Read: Mindful minutes, sleep duration, heart rate, resting heart rate, heart rate variability (HRV), steps, blood oxygen (SpO2), and respiratory rate

9.2 How Health Data Is Used

Health data is used exclusively to:

• Log your meditation sessions as mindful minutes in Apple Health / Health Connect
• Display a wellness dashboard with health metrics alongside your meditation practice
• Provide meditation impact analysis (e.g., comparing sleep quality on meditation vs. non-meditation days)
• Generate personalized wellness insights based on your cross-referenced health and meditation data

9.3 Health Data Protections

We commit to the following protections for all health data accessed through Apple HealthKit and Health Connect:

• On-Device Processing: All health data is read and processed locally on your device. Raw health metrics (heart rate, sleep, HRV, steps, SpO2, respiratory rate) are never transmitted to our servers.
• No Advertising: Health data is never used for advertising, marketing, or any purpose other than providing the wellness features described above.
• No Third-Party Sharing: Health data is never shared with, sold to, or disclosed to any third party, including advertisers, data brokers, or analytics providers.
• No Sale of Data: We do not sell health data under any circumstances.
• No Profiling: Health data is not used to build user profiles for purposes unrelated to the wellness features of the Service.
• User Control: You can revoke health data access at any time through your device's health settings (iOS: Settings → Health → The Gateway Experience; Android: Settings → Health Connect → The Gateway Experience). Revoking access removes the app's ability to read or write health data but does not affect your account or other features.

9.4 Meditation Session Logging

When health integration is enabled, meditation sessions of 1 minute or longer are automatically logged as mindful sessions. Session metadata (duration, brainwave preset, style, timestamps) may be synced to our backend for your personal stats dashboard, but this metadata contains no health metrics — only meditation session information.

10. Children's Privacy

The Service is not intended for children under 13 years of age (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately so we can delete it.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own, primarily the United States. These countries may have different data protection laws.

For transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, and our service providers' compliance with applicable data protection frameworks.

By using the Service, you acknowledge that your data will be processed in the United States and other jurisdictions where our service providers operate.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected and how it is used
• Right to request deletion of your personal information
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

13. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including:

• Access (Article 15): Request a copy of your personal data
• Rectification (Article 16): Correct inaccurate personal data
• Erasure (Article 17): Request deletion of your data
• Restriction (Article 18): Request limitation of processing
• Portability (Article 20): Receive your data in a machine-readable format
• Object (Article 21): Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for marketing or analytics at any time

Our legal basis for processing is described in Section 3.1 above.

Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been processed in violation of the GDPR. A list of EEA supervisory authorities is available at edpb.europa.eu.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically for any changes.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: josh@graverholtunlimited.com