Somi Privacy Policy

Controller details

1. Summary

Somi does not require a named account. The App creates a pseudonymous Supabase identifier to authenticate Object Hunt requests and prevent abuse.

Your alarms, missions, settings, and mission completion history are stored locally on your device. When you use Object Hunt, the photo you take is securely sent through our Supabase backend to Google's Gemini API so it can determine whether the requested object appears in the photo.

We use Supabase to authenticate and process Object Hunt requests, Google Gemini to analyze Object Hunt photos, RevenueCat to validate and manage App Store subscription access, and Zoho to receive and respond to support emails. Apple processes App Store purchases.

Somi does not use third-party advertising SDKs, behavioural advertising, cross-app tracking, location services, or Bluetooth.

2. Data stored locally on your device

Somi processes the following data locally on your device to provide its core functions:

• Alarm schedules, alarm settings, and app preferences;
• Mission settings and completion history;
• Camera inputs used for missions other than Object Hunt;
• Alarm and notification settings.

This information remains on your device. Object Hunt photos are handled separately as described in sections 3, 7, 9, and 13.

You can remove locally stored Somi data by deleting the App from your device. Deleting the App does not cancel an App Store subscription.

3. Device permissions

Somi requests access to device features only when they are relevant to a mission or alarm feature you choose to use.

Somi does not use location or Bluetooth and does not request access to them.

You can change or withdraw a permission at any time in your device settings. Turning off a permission may prevent the corresponding mission or alarm feature from working.

4. Subscription information

Somi is a subscription-only app. Purchases are made through Apple's In-App Purchase system.

We use RevenueCat to manage and validate subscription access. RevenueCat processes:

• a randomly generated, pseudonymous App User ID;
• subscription entitlement and status information;
• purchase history and transaction or receipt-related information needed to validate your subscription.

We do not associate RevenueCat's anonymous App User ID with your name, email address, or a Somi account because Somi does not offer accounts.

RevenueCat does not collect precise or coarse location data through Somi, and its use in Somi is not for advertising or cross-app tracking. Apple processes your Apple Account and payment information. Bedroomlabs does not receive or store your complete payment-card details.

For more information about Apple's processing, please review Apple's privacy information and App Store terms. For more information about RevenueCat's processing, please review RevenueCat's privacy information.

5. Support communications

If you email us at hi@bedroomlabs.co, we process the information you choose to include, such as your email address, name, device details, and the contents of your request.

We use Zoho to provide email support. We use support communications to respond to you, troubleshoot issues, protect Somi, and maintain support records.

6. How and why we process data

Where the GDPR applies, our legal bases are:

• Performance of a contract: to provide Somi's subscription access and the features you request.
• Your consent: when you grant an optional device permission, such as Camera or Photos access.
• Legitimate interests: to respond to support requests, prevent misuse, secure and improve Somi, and manage our relationship with users.
• Legal obligations: where we must keep or disclose information to comply with applicable law.

You may withdraw a device permission through your device settings at any time. Withdrawal does not affect processing that occurred before withdrawal.

7. Sharing and service providers

We share personal data only as needed to operate Somi, respond to you, comply with law, or protect our rights and users.

The relevant recipients are:

• Apple, which processes App Store purchases and subscription billing;
• RevenueCat, which provides subscription validation and entitlement management;
• Supabase, which provides backend hosting, pseudonymous authentication, request processing, and abuse prevention;
• Google Gemini, which analyzes Object Hunt photos and returns an object-match result; and
• Zoho, which provides our support email service.

We require service providers to protect data consistently with applicable privacy law. We do not sell personal data, use it for targeted advertising, or share it with advertising networks or data brokers.

8. International data transfers

Bedroomlabs is established in Romania. Apple, RevenueCat, Supabase, Google, and Zoho may process data in countries outside the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, we use an applicable transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with additional safeguards where required. You may contact us at hi@bedroomlabs.co to request more information about the safeguards relevant to your data.

9. Retention

Local Somi data: remains on your device until you delete it, delete the App, or reset your device.

Object Hunt photos: are sent for a single classification request. Bedroomlabs does not save them in its application database. Google may retain prompts, photos, and responses for up to 55 days for abuse monitoring and legal or regulatory requirements. We use Google's paid service, under which this content is not used to improve Google's general products or models.

Object Hunt service data: Supabase stores a pseudonymous authentication identifier and short-lived daily request counters used to authenticate requests and prevent abuse.

Subscription data: is retained by Apple and RevenueCat as necessary to manage purchases, validate entitlements, prevent fraud, meet legal obligations, and comply with their retention practices.

Support communications: are retained for as long as reasonably necessary to respond to and document your request, maintain support records, resolve disputes, and comply with legal obligations.

We delete or anonymize personal data when it is no longer needed for these purposes, unless a longer retention period is required or permitted by law.

10. Children and teens

Somi is intended for users aged 18 and older.

People under 18 may not use Somi. We do not knowingly collect personal data from children.

If you believe that a child has provided us personal data without the necessary permission, contact us at hi@bedroomlabs.co.

11. Your privacy rights

If the GDPR or similar privacy law applies to you, you may have the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability where applicable;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a supervisory authority, including the competent authority in your country of residence, place of work, or place of the alleged infringement.

To exercise these rights, contact us at hi@bedroomlabs.co. We may need to verify your identity before responding.

Because Somi does not have named user accounts and core Somi data remains on your device, Bedroomlabs may not have access to locally stored alarm, mission, photo, or settings data. You can delete that local data by deleting the App. Contact us if you want to exercise rights concerning backend service data.

12. Security

We use reasonable technical and organisational measures designed to protect the personal data we process. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Object Hunt image recognition

When you choose Object Hunt and take a photo, Somi compresses the image and sends it over an encrypted connection to a Supabase Edge Function operated for Bedroomlabs. The function sends the image and the requested object category to Google's Gemini API. Gemini returns whether the requested object appears in the image, together with a confidence score and short reason.

The photo is used only to complete that Object Hunt attempt. We do not use facial recognition, ask Gemini to identify people, or save the photo in our application database. Automated image recognition can be inaccurate, and you may retry with another photo or object.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide appropriate notice through the App or another suitable method before the changes take effect, where required by law.

15. Contact

For privacy questions or requests, contact: