Sleep Well Lady — Privacy Policy

1. Who we are

The Sleep Well Lady application and service are operated by Dick Press Publishing LLC, a Florida limited liability company based in St. Petersburg, Florida, USA. For questions about this policy, email support@sleepwelllady.com.

2. What Sleep Well Lady is (and is not)

Sleep Well Lady is a manually-triggered, single-purpose SMS safety-alert app. When you hold the button in the app for two seconds, it sends a prewritten SMS with your GPS location to one to three trusted contacts you personally added on your own device. If you do not cancel the alert, follow-up location updates continue to stream to those contacts in the same SMS thread for as long as the alert is active — so if you are being moved, they can see it in real time. When you cancel the alert, streaming stops. Sleep Well Lady is not a substitute for calling 911. It does not dispatch police, does not share your location with anyone outside an active alert period, does not host mutual or family location sharing, does not sell your data, does not create advertising profiles, and does not integrate with any data broker. The alert itself carries no audio or video — only your pre-written message and location. Separately, the app includes an optional overnight monitoring feature (on by default; you can turn it off in Settings) that records short ambient audio clips on your device when loud sounds occur, so you have your own record of an incident. Those clips never leave your phone unless you create an optional cloud-backup account — see Section 3.

3. Data we collect

On your device (leaves your phone only when you trigger an alert or enable optional cloud backup):

• The one to three trusted-contact phone numbers you enter, encrypted at rest in your iOS Keychain.
• The pre-drafted alert phrase you write during setup.
• Your event history (timestamps, event type, short notes) and — if monitoring is on — short ambient audio clips recorded when loud sounds trigger an event.
• Your own consent record (timestamp of when you accepted the Terms of Service).
• A queued-message buffer for alerts that failed to send when signal was unavailable.
• These are wiped when the app is uninstalled.

On our backend, only if you create an optional cloud-backup account:

• Your account email address, your trusted-contact details, your event history, and your event audio clips — so you can recover them if your phone is lost, taken, or destroyed.
• Encrypted at rest (AES-256), scoped to your account by row-level security. Not visible to any partner organization, and not accessible to staff in the normal course of operations.
• You can delete your account at any time, which permanently deletes all of it. Without an account, none of this data exists on our servers.

On our SMS carrier (Twilio):

• Every outbound alert SMS: the sending Twilio 10DLC number, the recipient number, the timestamp, the delivery status, and the message body.
• Retained per Twilio's default 13-month rolling window.
• Compellable by warrant under the federal Stored Communications Act (18 U.S.C. § 2703); metadata compellable by subpoena.

On our backend (Supabase Postgres, encrypted at rest):

• One row per trusted-contact opt-in event: the recipient's phone number, a timestamp, the exact TCPA consent language shown, and the IP and user agent at time of consent.
• One row per outbound SMS send attempt with masked phone digits, HTTP status, and Twilio's delivery code — this is a diagnostic audit trail so we can debug delivery failures. We do not store message bodies here.
• Row-level security is enabled. Encryption at rest is AES-256 (Supabase Postgres storage layer).

What we do NOT collect

• No location history. Location is included in the outbound alert message and is not stored anywhere on the server after delivery — with or without a cloud-backup account.
• No video, no health data, no biometrics. Motion sensing is used on-device to detect restlessness and is never stored or transmitted.
• Audio never reaches our servers unless you have created a cloud-backup account, and then only your own event clips, under your own account.
• No device fingerprint beyond what is required to render the app.
• No advertising identifiers.

4. How long we keep it

• Trusted-contact opt-in records: retained for four years, which is the federal TCPA statute of limitations, then permanently deleted.
• SMS diagnostic audit rows: retained for twelve months, then permanently deleted.
• Message bodies (Twilio side): retained per Twilio's default 13-month rolling window.
• Optional cloud-backup data (account email, contacts, event history, audio clips): retained until you delete it or delete your account, whichever comes first. Deletion is immediate and permanent.
• You can request deletion of your data at any time. See Section 8.

5. Who we share it with

• We do not sell, rent, or share your data with advertisers — full stop.
• Twilio processes every outbound SMS to deliver it to your trusted contact. Twilio does not repurpose your data.
• Supabase hosts our Postgres database and edge functions. Supabase does not repurpose your data.
• Resend processes optional email notifications to trusted contacts if a user has enabled email fallback. Resend does not repurpose your data.
• Law enforcement: we require judicial process (subpoena or warrant) before disclosing any records. We give the affected user notice of any legal-process request unless legally barred. Our Law Enforcement Response Policy is public.
• Partners: if Sleep Well Lady operates as a program of a partner organization (for example, a domestic-violence shelter), no personally-identifying user data is shared with that partner. Partners never see who has installed the app or who a user's trusted contacts are.

5a. SMS/Text messaging program terms

The Sleep Well Lady SMS safety-alert program is operated by Dick Press Publishing LLC and sends messages from the 10DLC number +1 (938) 444-0912.

• Program name: Sleep Well Lady safety-alert SMS.
• What it is: A trusted contact of a Sleep Well Lady app user receives a safety-alert SMS only when that app user manually triggers an alert by holding a button in the app for two seconds. Follow-up location updates continue in the same SMS thread while the alert is active. There is no marketing, no automated broadcast, and no drip.
• Message frequency: Less than one message per recipient per month on average.
• Message and data rates may apply.
• Opt-in: Recipients opt in at https://sleepwelllady.com/opt-in.html — a standalone consent page with an unchecked consent checkbox, presented separately from any Terms of Service or Privacy Policy. No third-party affiliate marketing collects this opt-in on our behalf.
• Opt-out: Reply STOP to any SMS from our number, or email support@sleepwelllady.com. STOP handling is immediate and permanent per the FCC's April 11, 2025 revocation rule.
• Help: Reply HELP to any SMS from our number for help and contact information.
• Cost: There is no charge from Sleep Well Lady for the SMS. Your mobile carrier's standard message and data rates may apply.
• Carriers: Carriers are not liable for delayed or undelivered messages.

6. Security

• Encryption at rest for all server-side data (AES-256).
• Encryption in transit for all API traffic (TLS 1.2+).
• Multi-factor authentication required on all administrative logins.
• Row-level security policies in the database limit access to the minimum-necessary data per operation.
• The full incident-response plan and breach playbook (Florida FIPA § 501.171 compliant, including 24-hour notification to any partner organization) are available on request.

7. Compliance

• TCPA (Telephone Consumer Protection Act, 47 U.S.C. § 227): Trusted contacts opt in on a standalone web page — sleepwelllady.com/opt-in.html — separate from any Terms of Service or Privacy Policy, with an unchecked consent checkbox. STOP handling is immediate and permanent per the FCC's April 11, 2025 revocation rule.
• A2P 10DLC: Registered under Dick Press Publishing LLC with The Campaign Registry. Use case: Low Volume Mixed. Sender number: +1 (938) 444-0912.
• CTIA Messaging Principles and Best Practices: Full compliance.
• Florida FIPA § 501.171: Breach notification obligations tracked.
• Florida § 39.201 / § 415.1034 mandatory reporting: The app does not create a new reporting obligation. If a trusted contact receives an alert and forms suspicion of harm to a child or vulnerable adult, they are notified in the message and again during opt-in of Florida's universal-reporter regime.

8. Your rights

• Access: request a copy of any data we hold about you.
• Deletion: request permanent deletion of any data we hold about you.
• Correction: request correction of inaccurate data.
• Opt-out of SMS at any time: reply STOP to any SMS from our number.
• Email support@sleepwelllady.com to exercise any of these rights. We respond within 30 days.

9. Children

Sleep Well Lady is intended for adults. We do not knowingly collect information from anyone under the age of 18.

10. Changes to this policy

We will update the "Last updated" date at the top of this page whenever this policy changes. Material changes will be announced in the app and, where operationally possible, via email to users who have chosen to receive product notifications.

11. Contact

Sleep Well Lady — operated by Dick Press Publishing LLC
Katie Dickieson, Founder
Email: support@sleepwelllady.com
Location: St. Petersburg, Florida, USA
SMS sender: +1 (938) 444-0912 (operated via Twilio)