Salus Studios

ON THE RECORD

Privacy Policy

Last updated: August 2026

The short version

We collect only what we need to deliver purchases and tools, run secure services, and provide a Salus account if you choose one. We do not sell your data. App measurement is switched off in White Noise today and collects nothing; if we ever switch it on the app will ask first, keep the two purposes separate, and never change what the app lets you use.

Who we are

Salus Studios Limited, a company registered in England & Wales (company number 17268621), is the data controller for the personal information described in this policy. This policy covers this website (salus-studios.co.uk) and the digital products, tools and websites we operate, including those sold under our trading names.

What we collect

When you make a purchase

  • Email address (to send your receipt and your download or access link)
  • Payment information (processed entirely by our payment providers, Stripe and PayPal; we never see or store your card details or payment-account login)
  • Purchase history (which products you bought and when)

When you use a free tool

  • The text you submit (sent to our provider to generate your result; not stored after the response is returned)

When you use one of our apps

Signing in to a Salus account is optional. In White Noise, you can play the sounds available under your free or store-bought entitlement, make and save mixes on that device, use the sleep timer, and buy or restore Premium through Apple or Google without a Salus account. A purchase made while signed out stays valid through that store. It is linked to a Salus account only when you choose to sign in and claim or restore it. Signing in is needed only for shared-account features, including syncing saved mixes and carrying an account-linked Premium entitlement to another device or platform.

If you do sign in, this is what we hold:

  • Your email address and provider profile metadata, from Sign in with Apple or Sign in with Google. This can include your name. Google can also provide your Google profile picture URL and related picture metadata, which Supabase retains with your authentication identity. If you use Apple's Hide My Email, the only address we ever see is Apple's relay address, and that is all we can ever contact you on.
  • An account identifier we generate, which is what everything else is filed against.
  • Your subscription status, meaning which plan you are on and whether it is currently live. Once you deliberately link a purchase by signing in and claiming or restoring it, we keep this so the subscription can work on your next phone or another platform without you being charged twice. The purchase itself is handled by Apple or Google, and we never see your card.
  • What you choose to sync from the app, once you are signed in. In White Noise this means each saved mix's automatically assigned name, selected sound identifiers, volume levels, update time, and deletion state, so the mix can follow you between devices. The app does not offer a field for user-written mix names.

We do not use any of this account or saved-mix data for advertising, we do not sell it, and we do not build a profile from it. You can delete your account from inside the app itself, on the account screen. Doing so closes the shared account across our apps and deletes its active authentication profile and synced app data. Limited purchase, security, and deleted-account suppression records can remain under the exceptions and retention terms described below. You can also request deletion without the app through our White Noise account-deletion page.

When you create an account, Resend delivers one strictly transactional welcome email from Salus Studios about the account and how to access it. It contains no advertising, product promotion, or marketing subscription. We do not send a per-user signup notification to our operator.

A shared Salus account is only for people aged 13 or older. White Noise can still be used without a Salus account. If you are under 13, do not sign in or create a shared account. We do not ask for a date of birth. If we learn that an account belongs to a child under 13, we will delete it. A parent or guardian who believes a child has created an account can contact us below.

Analytics and measurement in White Noise: Sleep, Rain & Fan

Measurement is switched off in the White Noise app we ship today. Nothing described in this section is being collected. The app does not create a measurement identifier, does not read Apple AdServices or Google Play Install Referrer, and sends no measurement request at all. There is no set-up step and no screen to dismiss: you open the app and it plays.

This section stays here because it is where we will describe measurement if we ever switch it on, and we would rather you could read it in advance than find it appearing one day. If that happens the app will ask first, inside the app, with equal routes to reject all, accept all or customise, and either choice will be changeable in Settings afterwards. Refusing would not affect free sounds, Premium, accounts, saved mixes, purchases, or any other part of the app, because nothing in the product depends on measurement.

Two purposes are described below and they are kept entirely separate. Both would be off until chosen.

Service analytics

If you enable service analytics, White Noise uses a random purpose-specific install identifier to record app opens, sounds played, mixes created, sleep timers, paywall views, and the start of a purchase. We use this to understand and improve the app. The app does not send your account ID, email, name, advertising attribution, or arbitrary free text with these records.

Advertising attribution

If you separately enable advertising attribution, White Noise can use Apple AdServices on iOS or Google Play Install Referrer on Android to understand which external Salus Studios campaign led to an install. This may include Apple campaign, ad-group, keyword and ad identifiers, or Android UTM and click identifiers such as GCLID, GBRAID and WBRAID, plus provider timestamps. We then measure the same bounded app journey and provider-confirmed subscription events, including trial, start, renewal, cancellation, expiry, refund and revocation. White Noise displays no adverts. This purpose measures our own external campaigns and is not used for third-party advertising, cross-app tracking, retargeting, or a data-broker profile.

How optional measurement is separated

  • Each purpose has its own random receipt, install identifier, secrets, queue, table rows, retention, and report path. No identifier is reused between purposes, and our reporting must not join the two purpose datasets.
  • Measurement is not stored against your Salus account, email, name, Apple account, or Google account.
  • The raw Apple attribution token is encrypted only while resolution is pending and is deleted within 24 hours. Google Play's raw referrer is parsed in transit and is not stored on our server. A pending on-device Android referrer is deleted within 72 hours.
  • Individual install and event records are deleted within 90 days. Irreversible daily aggregate counts may be retained for up to 24 months, with small groups suppressed.
  • Turning a purpose off stops access, capture, identifiers and delivery immediately, including offline. The app keeps only the protected deletion request until the server confirms withdrawal. If a remote request needs attention, Settings says so and does not pretend local deletion has erased server records.

If measurement is ever switched on, Settings will show the current wording, locale, version, retention and withdrawal status, and a later opt-in would create entirely new identifiers. Until then there is nothing stored to show. You can request help through the White Noise deletion page or contact us below.

Operational logs and website measurement

  • Website hosting and security logs can include IP address, browser or user-agent details, requested page, request time, and response status. Cloudflare processes these to deliver and protect our websites.
  • App authentication audit logs are created by Supabase for events such as sign-in, token refresh, sign-out, and account changes. They can include the account identifier, event, provider, IP address, user agent, and event time. The hosted Auth Audit Logs retention under our project's current plan is one hour.
  • App and API operational logs can include request time, endpoint, response status, execution details, IP address, user agent or client details, and the account identifier when a request is authenticated. We use these to operate, secure, and diagnose account, sync, deletion, and purchase-verification services. Supabase's current hosted API and database log retention for our project is one day, and no external log drain is configured.
  • Server-side error reports can be sent to Sentry with error and stack information plus a limited function, account identifier, email address, order, subscription, or transaction reference where the relevant service attaches one. White Noise does not use Sentry as an in-app analytics or crash-reporting SDK.
  • Restricted operational alerts can be sent to our Telegram account when a server-side process needs attention. An alert can contain error text and the minimum account identifier, email address, order, or subscription reference needed to investigate it. We do not use Telegram for app analytics or marketing messages.
  • Cookieless website counts are provided by Plausible Analytics as aggregate visit statistics, with no cookies and no personal visitor profiles.

What we do not collect

  • We do not use Google Analytics or Facebook Pixel
  • Some of our sites use Google Ads conversion tracking (gtag) to measure advertising. This may set cookies to attribute visits to ad clicks. You can opt out at Google Ad Settings.
  • We do not run retargeting ads
  • We do not sell your email or share it with third parties for their own marketing. The processors listed below receive data only where needed to provide their service to us.
  • Apart from the Google Ads conversion cookies described above, we do not set non-essential tracking cookies

Third-party services (data processors)

How we use your data

  • Purchase data (email, payment, order history), necessary to fulfil your order and deliver your files or access.
  • Email capture on free tools, to keep you informed about relevant products. You can opt out at any time by clicking the unsubscribe link in any email or contacting us.
  • Optional app account data, to authenticate you, send the one transactional account welcome, sync the mixes you choose to save, carry an account-linked entitlement between devices, and let you manage or delete the shared account.
  • Operational and security records, to deliver requests, protect accounts, verify purchases, diagnose failures, prevent abuse, and investigate incidents.
  • Aggregate website measurement, to understand site usage without building personal visitor profiles.

Your rights (UK & EU GDPR)

If you are in the UK or the European Economic Area, you have the right to access, correct, delete, restrict or object to our processing of your personal data, and the right to data portability. You also have the right to complain to the Information Commissioner's Office (ICO) or your local supervisory authority. To exercise any of these rights, email [email protected] and we will respond within one month.

Your California privacy rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

  • Right to know, request disclosure of the personal information we collect, use, and share about you.
  • Right to delete, request deletion of personal information we have collected from you, subject to certain exceptions.
  • Right to opt out of sale, we do not sell your personal information. You do not need to opt out.
  • Right to non-discrimination, we will not discriminate against you for exercising any of your rights.

To exercise any of these rights, email [email protected] and we will respond within 45 days.

Data retention

  • Purchase records, retained for 7 years after the transaction date, as required for tax and accounting purposes.
  • Supabase hosted authentication audit logs, retained for one hour under our project's current plan.
  • Supabase hosted API and database logs, retained for one day under our project's current plan. We have no external log drain configured.
  • Website hosting and security logs, retained according to Cloudflare's applicable service settings and privacy terms. There is no single Salus-controlled 90-day period that applies to these provider logs.
  • Sentry error reports and Telegram operational alerts, retained under the applicable provider and account settings while they remain relevant to investigating and resolving the operational issue. We do not represent these records as being automatically deleted after 90 days.
  • Plausible aggregate website counts, retained as non-profiled aggregate statistics rather than individual visitor histories.
  • Marketing leads (free-tool email capture), retained until you unsubscribe or request deletion.
  • App account data (your email, provider profile metadata including any Google profile picture URL, account identifier, subscription status and anything you synced), retained until you delete your account, which you can do from inside the app at any time.
  • White Noise individual measurement data, retained for no more than 90 days after receipt. A withdrawal request deletes the related purpose data sooner.
  • White Noise raw attribution material, Apple attribution tokens are deleted within 24 hours; raw Google Play referrers are not retained on our server and are deleted from pending device storage within 72 hours.
  • Anonymous measurement aggregates, retained for no more than 24 months, with identifiers removed and small groups suppressed.
  • Measurement withdrawal tombstones, retained for 90 days so a delayed consent request cannot reactivate a purpose that you turned off.
  • Deleted-account email hash, retained without a fixed automatic expiry while it is needed solely to prevent delayed billing events from silently recreating a deleted account. It cannot be used to contact you.

Changes

If we make significant changes to this policy, we will update this page and the date above.

Contact

Questions or data requests? Email [email protected], or write to Salus Studios Limited (company no. 17268621), England & Wales.