Privacy Policy
Last updated: 27 July 2026
OFFMODE (“we”, “us”) is operated by Una Kolbeins ehf. (kennitala 470825-0570), Klapparási 2, 110 Reykjavík, Iceland. Una Kolbeins ehf. is the data controller for the personal data described here. This policy explains what we collect when you use the OFFMODE mobile app, why, and what rights you have over it.
Any privacy question, or a request to exercise your rights: privacy@offmode.app
What we collect
Account information. When you create an account we store your email address and a display name you provide. Your password is stored only as a cryptographic hash — we cannot see or recover it.
Meditation activity. When you complete a session we record which session it was, when you completed it, and how long you listened. From this we calculate your totals and streaks so the app can show your progress.
That is all we collect. We do not collect your name beyond the display name you choose, your location, your contacts, your device identifiers, or any health data.
| Data | Where it is stored | Why |
|---|---|---|
| Email address | Supabase Auth | Account identity, sign-in, password reset |
| Password | Supabase Auth | Stored hashed; never in plain text, never visible to us |
| Display name | Supabase Auth user metadata | Shown to you in the app; supplied by you |
| Session completions — which session, when, how long listened | Our database (user_progress) |
Progress tracking |
| Aggregate statistics — total sessions, total minutes, current streak, longest streak, date of last session | Our database (user_stats) |
The Progress screen in the app |
What stays on your device
Your theme and language preferences, your daily reminder settings and the identifiers of any notifications the app has scheduled, and a cached copy of the session list are stored only on your device. They are never sent to us, and they are erased when you delete the app.
Reminders are scheduled locally by the app on your own device. We do not operate a push notification service, no push token is ever generated, and we never see whether or when a reminder appears.
What we do not do
- We use no analytics, telemetry, or crash-reporting services.
- We show no advertising and use no advertising identifiers — no IDFA, and no App Tracking Transparency prompt, because we do not track you.
- We do not track you across other apps or websites.
- We offer no third-party sign-in providers.
- We do not sell your data, and we do not share it with anyone for their own purposes.
- This website sets no cookies and runs no analytics.
Who processes your data
Your account and activity data is stored using
Supabase,
which provides our database and authentication. Supabase acts as our
processor under a data processing agreement and stores this data on
servers in Ireland (eu-west-1), within the European
Economic Area. Supabase does not use your data for its own purposes.
We use no other third-party services.
Legal basis
We process your account data to provide the service you signed up for (performance of a contract, Article 6(1)(b) GDPR). We process your meditation activity on the same basis — progress tracking is a core feature of the app.
Reminders are scheduled only if you enable them and grant notification permission (consent, Article 6(1)(a) GDPR). You can withdraw that at any time in the app or in your device’s Settings, without affecting anything else.
Where it is stored, and for how long
All account and activity data is stored within the European Economic Area, in Ireland. We keep it for as long as your account exists. When you delete your account, your authentication record, your progress history, and your statistics are permanently deleted from our live systems immediately. Residual copies may persist in encrypted backups for up to 30 days, after which they are overwritten.
Deleting your account
You can delete your account at any time from within the app:
Profile → Account → Delete Account
You will be asked to type a confirmation word. Deletion is immediate and permanent: it removes your login, your progress history, and your statistics. It cannot be undone.
If you cannot access the app, email privacy@offmode.app from the address associated with your account and we will delete it for you.
Your rights
If you are in the EEA or the UK you have the right to access your data, to have it corrected, to have it erased, to receive a portable copy, to object to processing, and to request that processing be restricted. Email privacy@offmode.app and we will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. In Iceland this is Persónuvernd, the Icelandic Data Protection Authority — personuvernd.is.
Children
OFFMODE is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we will remove it.
Security
Data is transmitted over encrypted connections (HTTPS/TLS) and stored on access-controlled infrastructure. Database access is restricted by row-level security, so each account can reach only its own records.
Changes to this policy
If we change this policy we will update the date at the top of this page and, for significant changes, notify you in the app.