BassState Privacy Policy

BassState is built local-first. This policy covers both the BassState app and our website, bassstate.com. The short version:

• The app needs no account. It never asks for your email, phone number, or contacts. Your name, habits, sessions, streaks, settings and health data stay on your device — we cannot see them.
• Apple Health data never leaves your device. With your permission the app reads your heart-rate variability, resting heart rate, sleep and steps to show your State, works them out on the device, and writes the sessions you finish back to Apple Health. None of it is transmitted to us, sold, or used for advertising.
• From the app, the only data that leaves your device is usage analytics and crash reports — no personal identifiers, no health values — and only if you opt in.
• On the website, if you request beta access, subscribe to updates or send us a message we handle the email you give us. The site asks before it uses any cookie it does not need to work: analytics cookies show us how the site is used, and marketing cookies let Google, Meta, TikTok and Reddit tell us which of our ads brought you here — today only Google is switched on. Both are off until you choose, and you can change your mind at any time. We keep a record of each choice, without your IP address or browser details (see §12).
• We never sell your data. There are no ads in the app, and it contains no third-party marketing code.

The rest of this policy explains all of that in the detail UK GDPR requires.

1. Who we are

BassState is a trading name of OKTOANALYTICS LTD., a private limited company registered in England and Wales (company number 11317162), whose registered office is 65 Brimstage Road, Heswall, Wirral, England, CH60 1XE (“we”, “us”). We are the data controller for the personal data described in this policy, which applies to both the BassState iOS app and our website at bassstate.com.

Contact: hello@bassstate.com

2. Data that stays on your device

The app stores the following only on your device, in local app storage. It is never transmitted to us or anyone else. We have no access to it.

Deleting the app removes all of this permanently. Settings → Privacy → Erase local data does the same without deleting the app.

Because this data never reaches us, we cannot view, recover, or restore it — and no data breach on our side can expose it.

3. Apple Health (HealthKit)

If you choose to connect Apple Health, BassState works with it in two ways, both on your device:

• It reads four things — your heart-rate variability, resting heart rate, sleep and steps — to show your State: a daily read of recovery, sleep and energy against your own baseline. Nothing else is read.
• It writes back, with your permission, a record of the sessions you complete — breathing, NSDR and body-scan sessions as Mindful Minutes, focus sessions as Mind & Body workouts — so your practice appears in Apple Health alongside the rest of your activity.

In both directions this data:

• is processed on your device. The app works out your State on the phone, keeps a rolling copy of the readings in its local storage, and never transmits any of it to us or anyone else. No health reading, score or trend is ever included in analytics or crash reports;
• is never used for advertising or marketing, and is never shared with or sold to anyone;
• can be turned off at any time in iOS Settings → Privacy & Security → Health → BassState — reading and writing are separate permissions, and you can withdraw either — and its local copy removed via Erase local data.

Where UK GDPR applies to this on-device processing, our basis is your explicit consent, given through Apple’s Health permission flow and revocable there at any time.

4. Data that leaves your device — only with your consent

On first launch we ask whether you want to share usage analytics and crash reports. Collection is off until you say yes. If you decline, none of the data in this section is collected. To opt out later, turn off Share usage data in Settings → Privacy; collection stops immediately.

Neither kind of report contains your name, email address, phone number, or any health reading, score or trend.

a) Usage analytics (Google Firebase Analytics). Event-level usage data — for example which features are used, session start/completion events, screen views — together with technical context: app version, device model, OS version, language, country (from a truncated IP), and a random per-install identifier that is not linked to who you are. We use it to understand what works and improve the product. Retention: 14 months, then automatic deletion.

b) Crash diagnostics (Google Firebase Crashlytics). If the app crashes: stack traces, device state at crash, OS/app version, and the same random install identifier. Used solely to find and fix defects. Retention: 90 days.

Lawful basis for both: your consent (UK GDPR Art. 6(1)(a); PECR reg. 6 for on-device storage/access). Withdrawing consent stops collection immediately; already-collected data ages out per the retention periods above, or sooner on request (§9).

5. Notifications

BassState sends no push notifications, and we run no server that could. Any reminder the app offers is scheduled on your device by the app itself, and can be switched off at any time in iOS Settings → Notifications → BassState.

6. Purchases

There are no in-app purchases in the app today. When we add a subscription it will be sold through Apple’s App Store: Apple processes your payment — we never receive your card details, billing address, or Apple ID. We would receive only confirmation that a purchase is valid (product, validity period) to unlock premium features on your device.

If we use RevenueCat, Inc. to check App Store receipts and manage subscription status, RevenueCat will receive the Apple receipt and a random app-instance identifier — not your name or contact details. We will update this policy when purchases ship.

7. Who receives data, and international transfers

a) Processors act only on our instructions.

b) Advertising partners. These companies are not our processors. When you allow marketing cookies on the website, each one that is switched on receives data from your visit and uses it as set out below and in its own policy, either jointly with us or on its own account. Today only Google is switched on. Meta, TikTok and Reddit are listed because our cookie choices name them: they receive nothing from this site until their row here says otherwise, and we will ask for your cookie choices again before any of them is switched on.

When Meta or TikTok is switched on, we and that company will be joint controllers for collecting your website events. The essence of the arrangement is: we are responsible for telling you about the collection and for asking your consent before any of it happens; the company is responsible for its own processing after the data reaches it, including your rights over the data it holds. You can exercise your rights with either of us. Their policies: Meta · TikTok · Reddit · Google.

The app shares data with no one beyond Apple and Google Firebase. We do not sell personal data. The app contains no advertising networks or third-party marketing code. The website’s advertising measurement is described in §12(c); apart from the Google Analytics link described in §12(b), none of it happens unless you allow marketing cookies.

8. How long we keep data

App: everything the app holds about you lives on your device, for as long as you keep it there — until you delete the app or use Settings → Privacy → Erase local data. The one exception is the consent-gated analytics and crash data in §4, which Google holds for 14 months and 90 days respectively, then deletes automatically.

Website (§12):

• Email you give us: held by Resend until you unsubscribe or ask us to delete it, and at most 24 months after you joined unless you have since asked to stay.
• Support messages: delivered to our inbox and not stored elsewhere; deleted 24 months after the last message in the conversation.
• Website analytics (Google Analytics 4): 14 months.
• The record of your cookie choices (§12(e)): every row for a consent ID is deleted 24 months after that ID’s last row, by a daily job.
• Advertising partners (§7(b), only if you allowed marketing cookies): Google’s _gcl_*, FPGCL*, FPGSID and FPAU cookies last 90 days. Meta, TikTok and Reddit are not switched on yet; once they are, Meta keeps event data for up to 2 years, TikTok for up to 18 months, and Reddit for as long as its own policy sets (it publishes no fixed period).
• Our analytics relay (§12(b)): Google Cloud keeps its request logs for 30 days.

9. Your rights (UK GDPR)

You have the right of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting prior lawful processing.

Practical routes, given our local-first design:

• Stop all collection: Settings → Privacy → turn off Share usage data.
• Erase device data: Settings → Privacy → Erase local data (or delete the app).
• Erase analytics/crash data held by our processors: email hello@bassstate.com from the device in question; because analytics identifiers are random and not linked to your identity, we will guide you through providing the app’s install identifier (shown in Settings → Privacy) so we can action deletion via our processors. We respond within one month.
• Website email: unsubscribe from any email we send (or reply asking to be removed), and email hello@bassstate.com to have your address deleted from our list.
• Website cookies: change or withdraw your choice at any time through Cookie choices in the site footer or on this page. Turning marketing off deletes the advertising cookies on this site, tells Google through its consent signal, stops every advertising tag, records the change (§12(e)) and reloads the page once. Turning analytics off does the same for analytics. We hold nothing that identifies you to an advertising partner; for data a partner already holds as its own controller, use its own route (its policy is linked in §7(b)), and we will point you to it if you ask.
• Your cookie-choice record: the Cookie choices panel shows your consent ID and a link to view your record. Quote the ID to hello@bassstate.com and we will send you every row recorded under it, or delete them all, within one month. Deleted rows can be restored from our database’s backups for 7 days, after which they are gone for good. Without the ID we cannot find your record, because we store nothing else that identifies you.
• Object to direct marketing: you can object at any time to our newsletter, separately from any cookie choice, by unsubscribing or emailing us; we will stop.

Complaints. You can complain to us at hello@bassstate.com; we will acknowledge your complaint and reply without undue delay. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

10. Children

BassState is not intended for anyone under 13, and we do not knowingly collect personal data from children.

11. Security

Data that stays on your device is protected by iOS’s own encryption and your device passcode. Consent-gated analytics/crash data, and website form submissions, are transmitted over TLS to the processors in §7. Aside from the email addresses our email processor (Resend) holds for website beta/newsletter sign-ups (§12) and the record of your cookie choices (§12(e)), we operate no server-side database of user data.

12. The website (bassstate.com)

This section covers bassstate.com, as distinct from the app above. The website is where you can read the blog, join the beta, subscribe to updates, and contact us.

a) Email you give us (Resend). If you request beta access or subscribe to blog updates, we store the email address you enter and a tag recording which list you joined (beta or newsletter). We use Resend (our email processor) to hold that address and to send you the emails you asked for — for a beta request, a single confirmation that you are on the list; for the newsletter, our occasional posts. If you send us a message from the support page, Resend delivers your email address and message to our inbox at hello@bassstate.com; we use them only to reply, and the message is not added to any list. We use your email only for what you signed up for, and we never sell it. You can opt out any time: use the unsubscribe link in any email we send, reply asking to be removed, or email hello@bassstate.com.

b) Site analytics and cookies (Google Analytics 4 via Google Tag Manager, and Vercel). When you browse bassstate.com we measure how the site is used so we can improve it:

• Google Analytics 4, loaded through Google Tag Manager, records page views and interactions — for example which pages and calls-to-action you use, when a form is started, and blog reads — along with technical context such as your device and viewport type, approximate location (from your IP address), referrer, and the pages you view. This uses cookies and similar identifiers, and stores small flags in your browser’s local storage (for example, whether you have visited before and whether you have already submitted a form). It runs only if you allow analytics (see (d)). Your browser sends these analytics requests first to our own server at relay.bassstate.com, which passes them on to Google Analytics; Google Cloud runs that server for us in Belgium (§7(a)). It sets a cookie of its own, FPID: a random identifier that lets Google Analytics recognise your browser on a later visit, which only our server can read, not the page. The relay may also set FPLC, a short-lived hash of FPID that the page can read, lasting 20 hours, used only to keep FPID working. Google Cloud keeps a standard log of each request, including your IP address, for 30 days. Our Google Analytics is linked to our Google Ads account, so when you allow analytics it also tells Google Ads each time a key event happens — a sign-up, an App Store click or a share — with your Google Analytics identifier. Unless you also allow marketing (see (c)), it carries a flag that it must not be used for personalised ads, and no advertising cookie is set or read for this.
• Vercel Analytics, provided by our host, gives us privacy-friendly, cookieless aggregate traffic figures.

c) Measuring our ads (marketing cookies). We advertise BassState on other sites and apps. If you allow marketing cookies (see (d)), advertising companies learn that you visited, so they can tell us which of our ads brought you here and decide who sees our ads. Today that is Google only: Meta, TikTok and Reddit are named in §7(b) but are not switched on. Apart from the Google Analytics link in (b), none of this happens unless you allow marketing, and we do not show ads on this site. Roles, retention and transfers are in §7(b).

• (i) Google Ads. Only if you allow marketing and analytics: when you sign up or click through to the App Store, our relay at relay.bassstate.com (§7(a)) passes it to Google’s Ads conversion tag, with the click ID of the ad that brought you here. To link that ad click to the sign-up, our relay sets the first-party cookies FPGCL*, FPGSID and FPAU. If you allow marketing, Google’s tag in your browser may also set _gcl_* cookies. Google may also use your Google Analytics data to decide which of our ads you see: through Google signals, which can link it to your Google account if you are signed in with ad personalisation on, and through personalised advertising in Google Ads. Google acts as a separate controller for this.

Click IDs. The ad click IDs that can appear on a link to our site (such as gclid, gbraid, wbraid, fbclid, ttclid, rdt_cid and msclkid) are used only if you allow marketing. Until you do, the site takes them out of the page address as soon as the page loads and keeps them only in your browser’s memory: they are not stored on your device, sent to Google Analytics or anyone else, or carried from page to page. If you then allow marketing, they are put back for Google Ads ((i)).

d) Your choices, and how they are enforced. When you first visit bassstate.com, a banner offers three categories:

• Necessary — always on. It remembers your choices on this device (bs_consent) and records them as in (e).
• Analytics — off until you turn it on. Covers (b).
• Marketing — off until you turn it on. Covers (c).

You can accept both, decline both, or choose each one; accepting and declining are offered equally, and nothing is pre-selected. Nothing in (b) or (c) runs, and no analytics or advertising cookie is set, until you allow its category — Google Tag Manager is not loaded before you allow at least one. If you use the site before choosing, we keep a short note of what you did on that visit in your browser’s memory only: it is stored nowhere, sent to no one and discarded after 30 minutes; if you then allow analytics it is sent with the rest, and otherwise it is discarded unsent.

Changing your mind. Use Cookie choices in the site footer, or the control on this page, at any time. Turning a category off stops it, deletes its cookies on this site (for marketing: _gcl_*, _fbp, _fbc, _ttp, ttclid, _rdt_cid; for analytics: _ga*, FPLC and the two analytics markers) and reloads the page once. The FPID cookie (b) can be removed only by our server or by you: once analytics is off, nothing is sent to our server and the cookie is no longer used; it expires after 2 years, or you can delete it in your browser settings. The same holds for our server’s marketing cookies ((c)(i)) that the page cannot read: once marketing is off they are no longer used, and they expire after 90 days.

Change cookie choices

When we ask again. We ask again 12 months after you allowed anything, no sooner than 6 months after you declined everything, and straight away if we add a purpose or a company that receives data, or change what a category does. Adding a new advertising company always asks again.

e) The record of your choices. So that we can show what you agreed to, each choice you make — on the banner or through Cookie choices, including turning something off — is sent to our consent log at consent.bassstate.com and kept as one row:

• a random consent ID your browser creates the first time you choose, and keeps in bs_consent;
• the version of the banner and of this policy you saw;
• whether analytics and marketing were on or off after the choice;
• what you did (allowed, declined, changed, or withdrew) and where (the banner or Cookie choices);
• the time our server received it;
• a fingerprint (hash) of your previous row, so any later change to a row can be detected.

We do not record your IP address, browser or device details, the page you were on, any analytics or advertising identifier, your email address, or any cookie. Cloudflare, which runs the log for us (§7(a)), sees your IP address and browser details in transit, as any web server does; the log keeps no record of them and no request logs. Your consent ID is sent nowhere else.

The log is kept in Cloudflare’s EU data jurisdiction. Every row for a consent ID is deleted 24 months after that ID’s last row. To get a copy of your rows, or have them deleted, see §9.

Why, and on what basis. Keeping this record lets us demonstrate your consent, as UK GDPR Art. 7(1) requires. Our basis is legal obligation (Art. 6(1)(c), read with Art. 7(1)). Storing your choice and consent ID in your browser, and sending each choice to the log, are part of the consent mechanism you are using, so they are strictly necessary and need no consent of their own.

g) App Store links. The App Store buttons on this site carry a campaign label naming the button you used. The label holds no personal data. Apple reports downloads to us per label only as totals, and only above a minimum count.

Cookies and local storage. Nothing is written to your browser before you choose — see (d) for what is held only in memory:

Beyond storing your choice, you can also block or delete cookies in your browser, opt out of email as in (a), and ask us at hello@bassstate.com what we hold and to delete it.

Lawful basis (website).

• Beta and newsletter emails (a): your consent, given when you submit the form (UK GDPR Art. 6(1)(a); PECR reg. 22 for marketing email).
• Replying to a support message (a): our legitimate interest in answering you (Art. 6(1)(f)).
• Analytics (b): your consent to the analytics category (UK PECR reg. 6; UK GDPR Art. 6(1)(a)), including the Google Analytics link to Google Ads described in (b).
• Advertising measurement and personalised advertising (c), and click IDs: your consent to the marketing category (UK PECR reg. 6; UK GDPR Art. 6(1)(a)); Google Ads ((c)(i)) also needs the analytics category.
• The record of your choices (e): as stated in (e).

Each is obtained through the banner in (d) before any cookie or identifier for that category is stored on your device or sent to anyone. Declining, or later turning a category off, stops it.

Website data is processed by the processors listed in §7, and your UK GDPR rights (§9) apply to it.

13. Changes to this policy

We’ll post updates here with a revised date and version. We keep every version, and a map of which version was in force when, so we can show what you were told when you made a choice. If a change adds a purpose, a company that receives data, or a new kind of processing, we flag it in the app and ask for your cookie choices on the website again before it takes effect. Other edits change the version without asking again.