Effective date: August 4, 2026
Koala Sleep is built to respect your privacy. The short version: your sleep information stays on your device, an account is optional, and optional product analytics are sent only if you choose to allow them.
Sleep & habit data. Bedtimes, wake times, sleep quality, notes, routines, and the entries you create are stored locally on your device. We cannot see them.
Microphone (optional). If you start a sleep-tracking session, the app uses the microphone to save local sleep audio for playback and estimate restlessness, snoring, and talking from sound patterns. This runs entirely on your device. Audio is not uploaded or transmitted.
Notifications (optional). If you enable reminders, they are scheduled locally on your device. We do not send notifications from a server.
Koala account (optional). If you continue with Apple or Google, those providers send Koala a signed identity token. Koala verifies it and stores a provider-specific user identifier, optional verified email address, optional display name, account timestamps, and hashed session credentials in Cloudflare D1. Koala does not receive or store your Apple or Google password. Creating an account does not upload your sleep history, recordings, routines, notes, alarms, or onboarding answers.
Koala Plus purchases. Koala uses Apple and RevenueCat to offer, validate, restore, and manage subscriptions. They process purchase history and a Koala-assigned user or device identifier so the app can determine whether Koala Plus is active. Apple handles payment details; Koala does not receive your card or bank information.
Camera-based Morning Quests (optional). When you deliberately capture a photo or silent Handstand clip for a Morning Quest, Koala sends that capture and a random installation identifier through its Cloudflare verification service to Google's Gemini API. The capture is used only to decide whether the quest was completed. Koala does not save the photo or video to your photo library or account. Google may retain Gemini API prompts and responses for a limited period for abuse monitoring under its paid-service terms.
Service reliability data. Koala's account and quest services use a random installation identifier for session security and rate limiting. Operational logs may include a random request identifier, broad country-level location, result or error category, request duration, and Cloudflare data-center code. These logs do not include sleep entries, recordings, account names or email addresses, or the quest photo or video itself.
Product analytics (optional). If you tap Allow in the app's analytics prompt, Koala uses Mixpanel to record product events such as onboarding steps viewed, paywall views, purchase or restore outcomes, and the schedule type and number of selected days when an alarm is set. Koala also includes category-only onboarding attribution answers: how you found Koala and, if provided, your optional gender selection. These events help us understand which audiences Koala reaches and where the app is confusing or unreliable. Koala does not send the alarm time, date, selected weekday names, label, sleep notes, audio recordings, bedtime or wake time, free-text onboarding answers, name, email address, or account information to Mixpanel.
If you tap Don’t Allow, Mixpanel remains opted out, analytics events waiting for your choice are discarded, and no product analytics are sent.
Your sleep, routine, onboarding, and recording data lives on your device. Deleting the app removes that local data. If you allow product analytics, Mixpanel processes those limited events and category-only attribution answers on our behalf.
RevenueCat retains subscription records and Koala-assigned identifiers as needed to provide purchase status and restoration. Koala's Cloudflare services retain limited account, session, rate-limit, and operational data as described above. Quest captures are forwarded for real-time verification and are not stored by Koala.
You can delete an optional Koala account from the Profile screen. This removes the active account, linked provider identities, and saved server sessions. Cloudflare D1 provides short-window point-in-time recovery, and encrypted SQL backups are retained in a private Cloudflare R2 bucket for up to 90 days before automatic deletion. Account data deleted from the active service may therefore remain in restricted backups until that retention period expires.
Koala Sleep is a general-audience wellness app and is not directed to children under 13. Koala does not knowingly collect personal information from children.
Koala Sleep is a wellness and self-tracking tool, not a medical device. It does not diagnose, treat, cure, or prevent any condition. Sleep-stage estimates are approximate and should not be used for medical decisions.
We may update this policy as the app evolves. Material changes will appear here with a new effective date.
Questions? Email vascopanukorn@gmail.com.