CircadiaOS
Legal

Privacy Policy

Last Updated: August 12, 2026

1. Introduction

CircadiaOS LLC ("CircadiaOS," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use the CircadiaOS application and related services (the "Service").

CircadiaOS is a software application. We do not manufacture or sell any hardware devices. The Service integrates with your existing third-party wearable devices and smart thermostats through their respective APIs and through third-party aggregation platforms.

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, do not use the Service.

2. Information We Collect

The collection and processing of data described in this section is essential to the operation of the Service. The Service cannot function without access to the categories of data described below. By using the Service, you consent to the collection and use of this data as described.

2.1 Account and Profile Information

When you create an account and complete onboarding, we collect:

  • Name, email address, and account credentials
  • Date of birth (for age verification; you must be 18 or older)
  • Age and biological sex (required because these are moderating covariates for sleep science)
  • Target sleep onset time and target wake time
  • ZIP code and country code (required for local weather context that may inform the Service's scheduling logic; latitude and longitude derived from ZIP are stored where available)
  • Time zone
  • Payment information (processed by third-party payment processors; we do not store full payment card data)
  • Optional: chronotype hint (morning/evening person)
  • Optional: health-relevant flags that moderate the Service's decisions, including menopause status, insomnia history, chronic anxiety, and hypertension. These flags are optional; if provided, they are used to adapt the Service's behavior.
  • Optional: preferences for whether you wish to receive nightly prompts about stress, sleep quality, alcohol consumption, exercise, and illness

2.2 Biometric and Sleep Data

Through your authorized connection to a third-party wearable device (currently Apple Watch, Garmin, Fitbit, Oura Ring, or Whoop) via a third-party aggregation platform, the Service receives the following biometric and sleep-related data ("Biometric Data") after each sleep session is finalized:

  • Heart rate and heart rate variability (HRV) summary values and, depending on the wearable, sample-level time series
  • Sleep staging data (light sleep, deep sleep, REM, awake, where available from the wearable)
  • Sleep duration, sleep efficiency, sleep onset time, wake time, and time-in-bed
  • Resting heart rate
  • Respiratory rate (if available from your wearable)
  • Blood oxygen saturation (SpO2) (if available from your wearable)
  • Skin temperature delta and related temperature signals (if available from your wearable)
  • Wearable-provided scores such as sleep score and readiness score (if available)
  • Wearable session metadata, including session start and end timestamps and nap indicators

This data originates from your third-party wearable device and is accessed by CircadiaOS through authorized APIs with your explicit permission. CircadiaOS does not independently generate, measure, or verify this data.

This data is classified as sensitive personal information under certain privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), and as health information under certain other frameworks. See Section 8 for California-specific rights.

2.3 Environmental and Decision-Log Data

The Service collects and logs the following environmental and operational data:

  • Room temperature readings and thermostat setpoints received from your connected smart thermostat via API
  • Every temperature schedule and every temperature adjustment command sent by the Service, including the four phase setpoints (pre-sleep, early-night, late-night, pre-wake), their times, and execution status
  • Thermostat and HVAC system status (heating/cooling/idle) where available
  • Decision logs: for each nightly scheduling decision, the Service records which calibration or personalization state it was in, which variable (if any) was under test, the prior incumbent schedule, the candidate schedule, the Sleep Quality Index (SQI) and attribution eligibility for each night, and the outcome of each evaluation block (keep, revert, extend, pause)
  • Local weather context used for scheduling decisions (derived from your ZIP code)

This decision-log data is essential to the operation of the Service and to the development and refinement of our sleep optimization logic. Residents of the states of Connecticut and Colorado are advised that you may have specific opt-out rights with respect to certain data collection practices; please see Section 7.

2.4 Optional User-Reported Data

The Service may prompt you to report optional contextual information that helps it distinguish between temperature-related and non-temperature-related variation in your sleep. You are never required to respond to these prompts. If you respond, the Service may collect:

  • Alcohol consumption (number of drinks, if any)
  • Exercise (presence, intensity)
  • Acute illness status
  • Subjective bedtime stress (on a 1 to 5 scale)
  • Morning subjective sleep quality (on a 1 to 5 scale)

2.5 Device and Usage Data

  • Mobile device identifiers and device type
  • App usage data (features used, session duration, interaction patterns)
  • Connected wearable device type, model, and third-party aggregation platform identifiers (e.g., Terra user and reference IDs)
  • Connected thermostat type, model, aggregation platform identifiers, and device identifiers
  • Operating system, app version, and connected device firmware versions where available
  • Crash logs and error reports

2.6 Advertising and Attribution Data

The Service includes third-party software development kits (SDKs) provided by advertising and analytics partners, including the Meta SDK. These SDKs allow us to measure the performance of our advertising and to understand how users discover and subscribe to the Service.

Through these SDKs we collect:

  • App event data, including app installation, first app launch, app opens and closes, and subscription events
  • Campaign and referral information indicating which advertisement or channel led you to install the Service
  • Basic device and app information associated with these events, such as device model, operating system version, and app version

We do not transmit Biometric Data, sleep data, sleep scores, health-relevant flags, or optional user-reported data to advertising or analytics partners under any circumstances.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide and operate the Service, including computing your nightly Sleep Quality Index, managing calibration and personalization, and issuing temperature schedules to your thermostat.
  • To personalize the Service to your individual sleep patterns through per-user sequential experimentation (as described in Section 3.2).
  • To develop and refine CircadiaOS's proprietary understanding of the relationship between temperature and sleep (our "sleep curve" research) using aggregated and anonymized data from users who have not opted out.
  • To improve and develop the Service, including product research and development, validation against public sleep datasets, and evaluation of Service performance across wearable types.
  • To measure the effectiveness of our advertising, attribute app installs and subscriptions to specific marketing campaigns, and understand aggregate acquisition performance, as described in Section 2.6.
  • To communicate with you about the Service, including updates, security alerts, and support.
  • To detect, prevent, and address technical issues, security threats, and fraudulent activity.
  • To comply with legal obligations.

3.1 Data Collection Is Required to Use the Service

The Service fundamentally depends on the collection and processing of Biometric Data, environmental data, and decision-log data to function. Without access to this data, the Service cannot compute a Sleep Quality Index, cannot calibrate to your personal baseline, and cannot generate a temperature schedule. By using the Service, you acknowledge and consent to the collection of this data. If you do not wish for your data to be collected as described in this Privacy Policy, you should not use the Service.

Advertising and attribution data described in Section 2.6 is not required for the Service to function, and you may decline it without any loss of functionality.

3.2 Per-User Personalization and Aggregate Research

CircadiaOS uses your data for two distinct purposes. It is important you understand the difference:

(a) Per-User Personalization. The Service treats each user as their own experimental subject. It does not train a cross-user predictive model to decide your temperature schedule. Instead, after you complete an initial calibration period (approximately 14 qualifying nights), the Service runs sequential, one-variable-at-a-time within-user experiments on your temperature schedule and grades each block against your personal baseline. This is per-user processing of your data and is essential to the core functionality of the Service. You may not opt out of per-user processing while using the Service.

(b) Aggregate Research. Separately, CircadiaOS aggregates and anonymizes data across users who have not opted out in order to develop CircadiaOS's proprietary understanding of how temperature affects sleep across diverse populations. This aggregate research informs the defaults, operating ranges, and logic used by the Service for all users. Because aggregate research data is anonymized, it cannot be used to identify you personally.

You may opt out of contributing your anonymized data to Aggregate Research through the app settings. Opting out of aggregate research will not affect your personal use of the Service or your per-user personalization.

4. How We Share Your Information

We do not sell your personal information or Biometric Data to third parties.

We may share your information in the following limited circumstances:

  • Service providers: We share data with trusted third-party providers who assist us in operating the Service (for example, cloud hosting, analytics, payment processing, and API aggregation platforms such as Terra for wearable data and an equivalent aggregator for thermostat control). These providers are contractually obligated to protect your data and use it only for the purposes we specify.
  • Third-party device integrations: When you connect your CircadiaOS account to a third-party thermostat, we send the minimum data necessary (the temperature schedule and setpoint commands) to operate the integration. We do not share your Biometric Data with thermostat manufacturers or wearable device manufacturers.
  • Advertising and measurement partners: We share limited app event data and, where you have granted tracking permission, your device advertising identifier with advertising platforms including Meta. This is used solely to measure advertising performance and to attribute app installs and subscriptions to specific campaigns. We do not share Biometric Data, sleep data, or health-relevant flags with these partners. These partners may process the data they receive in accordance with their own privacy policies.
  • Aggregated and anonymized data: We may share aggregated, de-identified data that cannot reasonably be used to identify you for research, analytics, publication, and industry benchmarking purposes.
  • Legal requirements: We may disclose your information if required by law, regulation, subpoena, court order, or other governmental request.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such transfer.

5. Data Retention

We retain your personal information and Biometric Data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within ninety (90) days, except where retention is required by law or for legitimate business purposes (for example, resolving disputes, enforcing agreements, or meeting tax and audit requirements).

Aggregated, anonymized data that has been incorporated into our aggregate research and machine learning models cannot be extracted or deleted after anonymization, as it is no longer identifiable. This data may be retained indefinitely for research and product improvement purposes.

Advertising and attribution data is retained by us for no longer than is necessary for campaign measurement, and by our advertising partners in accordance with their own retention policies.

6. Data Security

We implement industry-standard technical and organizational measures to protect your data, including:

  • Encryption of data in transit (TLS/SSL) and at rest (AES-256 or equivalent)
  • Access controls limiting employee access to personal data on a need-to-know basis
  • Regular security assessments and vulnerability testing
  • Secure cloud infrastructure hosted within the United States

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach, we will notify you as required under applicable law.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Right to access: Request a copy of the personal data we hold about you.
  • Right to correction: Request that we correct inaccurate or incomplete data.
  • Right to deletion: Request that we delete your personal data, subject to certain exceptions. Deletion of your account data will terminate your access to the Service, as the Service cannot function without data collection. Anonymized data already incorporated into aggregate research models cannot be deleted.
  • Right to data portability: Request a copy of your data in a structured, machine-readable format.
  • Right to opt out of data sales: We do not sell your data. If this changes, you will have the right to opt out.
  • Right to limit use of sensitive data: You may request that we limit our use of your Biometric Data to purposes strictly necessary for the Service. Note that the Service requires Biometric Data to function; limiting its use may result in reduced or unavailable features.
  • Right to opt out of aggregate research contributions: You may opt out of contributing anonymized data to our aggregate research through the app settings.

To exercise any of these rights, contact us at support@circadiaos.com. We will respond within 45 days as required by applicable law.

8. California Privacy Rights (CCPA/CPRA)

CircadiaOS LLC: Notice at Collection

Effective Date: August 12, 2026

CircadiaOS LLC ("CircadiaOS," "we," "us," or "our") provides this Notice at Collection to California residents pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CPRA"), Cal. Civ. Code § 1798.100 et seq.

This Notice describes the categories of personal information we collect about you, the purposes for which each category is collected and used, and whether each category is sold or shared. For a full description of our data practices, please see our Privacy Policy at circadiaos.com/privacy.

Categories of Personal Information Collected and Purposes of Collection

Identifiers.

We collect your name, email address, account credentials, date of birth, ZIP code, mobile device identifiers, and, where you have granted tracking permission, your device advertising identifier (IDFA). We use this information to create and manage your account, verify your eligibility to use the Service, communicate with you about the Service, provide localized weather context for the Service's scheduling decisions, measure and attribute our advertising, and comply with legal obligations.

Sensitive Personal Information: Biometric and Sleep Data.

Through your authorized connection to a third-party wearable device, the Service receives, after each sleep session, biometric and sleep-related data including heart rate and heart rate variability, sleep staging data (light sleep, deep sleep, REM, awake), sleep duration, sleep efficiency, sleep onset and wake times, resting heart rate, respiratory rate (if available), blood oxygen saturation (if available), and skin temperature delta (if available). We use this data to operate the Service, including computing the nightly Sleep Quality Index, managing calibration and personalization, generating the next night's temperature schedule, and, if you have not opted out, contributing anonymized and aggregated data to our aggregate sleep research. This category of data is classified as sensitive personal information under the CPRA. This category is never disclosed to advertising or analytics partners.

Sensitive Personal Information: Health-Relevant Flags.

At onboarding, we may collect optional health-relevant flags that you voluntarily provide, including menopause status, insomnia history, chronic anxiety, and hypertension. We use these flags to adapt the Service's decisions to your specific context. This information is optional; you may use the Service without providing it. This category of data, when provided, is classified as sensitive personal information under the CPRA. This category is never disclosed to advertising or analytics partners.

Environmental and Decision-Log Data.

We collect room temperature readings from your thermostat, thermostat setpoints, every temperature schedule and adjustment command issued by the Service, decision logs recording each nightly evaluation and outcome, local weather context, and HVAC system status where available. We use this data to operate and improve the Service, to develop and refine our scheduling and personalization logic, and to conduct product research and development.

Commercial Information.

We collect payment information, which is processed by third-party payment processors; we do not store full payment card data. We use this data to process your subscription and manage billing.

Internet or Other Electronic Network Activity Information.

We collect app usage data (features used, session duration, interaction patterns), operating system and app version, connected device firmware versions, crash logs, and error reports. We also collect app event data through third-party advertising SDKs, including app installation, first launch, app opens and closes, and subscription events. We use this information to improve and develop the Service, detect and address technical issues and security threats, measure and attribute our advertising, and communicate with you regarding updates and support.

Device Information.

We collect your mobile device type, connected wearable device type and model, connected thermostat type and model, and relevant third-party aggregation platform identifiers. We use this information to ensure compatibility and to provide and improve the Service.

Retention

We retain your personal information and Biometric Data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within ninety (90) days, except where retention is required by law or for legitimate business purposes. Aggregated, anonymized data that has been incorporated into our aggregate research and machine learning models may be retained indefinitely, as it is no longer identifiable.

Sale or Sharing of Personal Information

CircadiaOS does not sell your personal information or Biometric Data to third parties.

CircadiaOS discloses limited identifiers and app event data to advertising and measurement partners, including Meta, for the purpose of measuring advertising performance and attributing app installs and subscriptions to campaigns. CircadiaOS does not use this data for cross-context behavioral advertising, and instructs its advertising partners to process California residents' data on a limited basis for measurement and attribution purposes only.

Right to Limit Use of Sensitive Personal Information

Because the Service collects sensitive personal information, including Biometric Data and (if provided) certain health-relevant flags, you have the right to limit the use of your sensitive personal information to uses that are necessary to perform the Service. You may exercise this right by contacting us at support@circadiaos.com. Please note that limiting the use of your Biometric Data may result in reduced or unavailable features, as the Service requires this data to function.

You also have the right to opt out of contributing your anonymized data to our aggregate sleep research through the app settings, and to decline app tracking permission through your device settings.

Your CPRA Rights

As a California resident, you have the following rights under the CPRA:

  • Right to know what personal information we collect, use, and disclose
  • Right to delete your personal information
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of personal information
  • Right to limit the use and disclosure of sensitive personal information
  • Right to non-discrimination for exercising your privacy rights

To exercise any of these rights, please contact us at:

CircadiaOS LLC. Email: support@circadiaos.com. Website: circadiaos.com

We will respond to verifiable consumer requests within 45 days as required by applicable law.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly. If you believe a person under 18 has provided us with personal information, please contact us at support@circadiaos.com.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the app and, where required by law, by email. Your continued use of the Service after changes are posted constitutes acceptance of the updated Privacy Policy.

11. Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

CircadiaOS LLC

Email: support@circadiaos.com

Website: circadiaos.com