Privacy Policy
Effective 16 August 2026 · Last updated 16 August 2026
The short version
Ruff Night reads one thing from Apple Health — your sleep — and turns it into a score your friends can see. The raw sleep recording never leaves your phone. We show you no ads, we run no analytics or tracking SDKs, and we have never sold anyone's data and do not intend to start. Your nightly sleep records are automatically deleted after 30 days, and deleting your account removes everything else.
Below is the long version, and it is specific. Every table and retention window on this page was read out of the live database rather than assumed.
Who this is
Ruff Night is a small independent iOS app. It is not a company with a data science team — it is a side project built for a handful of people to check on each other's sleep. That shapes everything below: there is no advertising business to fund, so there is nothing to be gained from collecting more than the app needs.
Questions, complaints, or a request to see or delete your data: privacy@ruffnight.app.
What we read from Apple Health
Sleep, and nothing else. The app asks iOS for read-only permission to one Apple Health category — Sleep Analysis. It requests no other health type: not heart rate, not steps, not workouts, not weight. It also asks for no write permission at all, so Ruff Night cannot add, change, or remove anything in your Health app.
The raw recording stays on your phone. Your sleep samples — the individual asleep and awake segments your watch or ring recorded, with their real timestamps — are read on-device, scored on-device, and then discarded. What travels to our server is the result: a number out of 100 and the handful of measurements behind it. Nobody, including us, can reconstruct your raw Health data from what we store.
You can revoke it at any time in iOS Settings → Health → Data Access & Devices → Ruff Night. The app keeps working; it simply stops receiving new nights, and you can enter them yourself instead.
What we store, and for how long
Everything lives in one Postgres database hosted by Supabase on
Amazon Web Services in Northern Virginia, USA (us-east-1).
If you are outside the United States, using the app means your data is stored there.
| What | Specifically | Kept |
|---|---|---|
| Your account | Apple's stable identifier for you, the email address Sign in with Apple returns (this is Apple's private relay address if you chose Hide My Email), the display name you typed, an auto-generated 6-character friend code, your dog's breed, and your time zone. | Until you delete |
| Your settings | Which tracker you use, the bed and wake times that define your quiet hours, whether pushes wait for quiet hours to end, whether Borks are enabled, and whether sync nudges are enabled. | Until you delete |
| Your nights | One row per night: the score out of 100 and its three components; hours slept; minutes awake; number of wake-ups; how far the night's bedtime sat from your own rolling average, in minutes; and the shape of the night — where the wake-ups fell, stored as offsets from when you fell asleep rather than as clock times, so the record cannot say what time you went to bed. | 30 days |
| Nights you report yourself | If you tell the app how you actually slept, we store the bed and wake times you entered — these are real times, not offsets — a coarse "how often did you wake" answer, and the score they produce. | 30 days |
| Your friends | Which accounts you are connected to, who asked whom, and whether each request is pending or accepted. Requests nobody answers expire. | Until you unfriend or delete (unanswered requests: 30 days) |
| Alert preferences | For each friend, whether you want every morning's score or only scores below a number you pick, and that number. | Until you unfriend or delete |
| Borks | Who barked at whom, and on which day — this is what enforces the one-per-day limit. | 30 days |
| Push delivery records | Your device's push token, plus a log of which notification was sent to whom on which day, so you are not pushed twice about the same morning. | Log: 30 days Token: until you delete |
| Diagnostics | Whether the app woke up in the background and read your night successfully, how long it took, your app version and iOS version, and the day. This is how we notice that syncing has silently stopped. It contains no sleep content beyond the score. | 30 days Daily summary: until you delete |
| Treats and purchases | Your treat balance, a ledger of how each treat was earned or spent, what you own and have equipped, and for cash purchases: Apple's transaction identifier, which pack, the price, and Apple's signed receipt. | Until you delete |
"30 days" is a scheduled job, not a promise we keep by hand. A task runs in the database every night at 03:00 UTC and deletes sleep entries, Borks, notification logs, nudge logs, diagnostics and expired friend requests older than 30 days. Nothing has to remember to do it.
The rows marked "until you delete" genuinely have no expiry. Your treat ledger and purchase history in particular are kept indefinitely while your account exists — a balance you paid for cannot expire on a 30-day timer, and a purchase record is what lets a payment dispute be answered. We would rather say that plainly than imply a blanket 30-day sweep that the code does not perform.
What your friends can see
A friendship in Ruff Night is mutual and symmetric. There is no one-way follow: if you are connected, you each see the other's nights. Adding someone requires them to accept, and either of you can remove the other at any time, which immediately stops all visibility in both directions.
A confirmed friend can see, for each of your recent nights: your score, how long you slept, how many times you woke, the shape of the night, and whether you reported it yourself instead of it coming from a tracker. They can also see your display name, your dog and its bed, and send you one Bork a day. Self-reported nights are labelled as such, so a friend is never shown an estimate as though it were a measurement.
Your friend code is the consent. Nobody can find you by name, email, or by guessing — a friend request can only be created from your 6-character code, which means somebody has to have given it to you. If a code gets out, remove the person and the code stops mattering to them.
Notifications
When your night lands, we push it to the friends who asked for it. The notification contains your display name, your score, and how long you slept. That text passes through Apple's Push Notification service to reach the other phone — that is the only way to deliver a push on iOS, and it means Apple handles the message in transit.
You control this. Quiet hours hold pushes about you inside a window you set, and the push is delivered afterwards rather than dropped. Each friend independently chooses whether they hear about every night or only bad ones. Turning notifications off entirely in iOS Settings stops all of it.
We also send you two kinds of message about your own account: a nudge if no sleep has arrived by midday, and a warning if the app appears to have stopped running in the background. Both can be turned off in the app.
Purchases
Treat packs are bought through Apple's In-App Purchase system. We never see your card, your billing address, or your Apple account — Apple takes the payment and hands us a signed receipt, which our server verifies before adding treats to your balance. We store Apple's transaction identifier, which pack you bought, the price, and that receipt.
Treats are a cosmetic currency with no cash value and cannot be transferred or exchanged for money. Refunds are handled by Apple, not by us — see the terms.
What we don't do
- No advertising, ever. There is no ad SDK in this app and no advertising identifier is read.
- No third-party analytics. No Google Analytics, no Firebase, no Facebook SDK, no Mixpanel, no Amplitude. The app ships exactly one third-party code dependency: the Supabase client it uses to talk to its own database.
- No selling or sharing your data for anyone else's marketing, and no "partners" to share it with.
- No profiling or automated decisions about you. The score is arithmetic on your own sleep, and it is described openly inside the app under Settings → How sleep score works.
- No location, contacts, camera, microphone, or photos. The app never asks for any of them.
The only companies that touch your data are Apple (sign-in, Health on your device, push delivery, payments) and Supabase, which hosts the database. Supabase is a processor acting on our instructions, not a party that gets to use your data.
How we protect it
Traffic between the app and the database is encrypted (HTTPS/TLS). The database enforces row-level security: the rules live in the database itself, so a query can only return your own rows and those of people you have a confirmed friendship with — a bug in the app cannot widen that. Sensitive actions such as adding a friend, spending treats, or crediting a purchase run as fixed server-side functions rather than as writes the app is trusted to get right.
No system is perfect, and this is an honest description of a small app rather than a claim of invulnerability. If you find a security problem, please write to privacy@ruffnight.app — you will get a real reply.
Deleting your account
In the app: Settings → Delete account.
It is immediate and it is not a soft delete. Your profile, every night, every friendship, your alert preferences, your Borks, your treats and purchase history, your diagnostics, your push token, and your sign-in identity including the email address are all removed. There is no recovery afterwards, and no copy kept for later.
Your friends' own rows survive, naturally — but their link to you goes with you, and your nights go with your account.
If you would rather have a copy first, Settings → Download my data writes out the last 30 days of your nights, which is the same window the database keeps.
Your rights
Depending on where you live you may have rights to access, correct, delete, or receive a copy of your data, or to object to how it is used — for example under the GDPR in Europe and the UK, or the CCPA in California. We extend all of them to everybody rather than checking where you are, because with an app this size it is easier to do the right thing once. Export and deletion are both built into the app and need no request; for anything else, write to privacy@ruffnight.app.
Our lawful basis for processing, where that concept applies, is your consent — given when you grant Health access and enable notifications — and the performance of the service you asked for. You can withdraw consent at any time by revoking Health access, turning off notifications, or deleting your account. We do not sell personal information as that term is defined under California law, and we do not share it for cross-context behavioural advertising.
Children
Ruff Night is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, write to us and we will remove it.
Changes
If this policy changes, the date at the top changes with it. Where a change materially affects what we collect or who can see it, we will also say so here rather than letting you find it by re-reading. Small corrections and clarifications are made in place.