Privacy Policy

Last updated: September 8, 2026

REMedy is a patient-generated health data sleep diary. The information you put in it, including how sleepy you were, when you slept, and what interventions you make, is highly personal. This page explains exactly what we collect, where we store it, who can reach it, and how to get rid of it.

Who runs REMedy

REMedy is operated out of North Carolina, United States. It is built and run by one person who lives with hypersomnia, with input and collaboration from one other person. It is for anyone struggling with sleepiness or low energy, and for anyone who simply wants to document their own health over time.

For any question about your data, including a request to delete it, please contact remedysleepproject@gmail.com.

What we collect

From Google, when you sign in: your name and email address. We never see your Google password and have no access to your Gmail, contacts, calendar, files, or anything else in your Google account.

What you enter yourself: your journal entries and anything in them, including personal notes, medications, and various sleep measures such as bed and wake times, sleep duration, and naps. Also your answers to the sleepiness questionnaire and the score it produces, your time zone, and your display and settings preferences.

Automatically: our server keeps a short operational log of requests. These logs do not record your IP address, nor are they linked to your account.

What we do not collect

• No analytics, no advertising, no tracking pixels, and no third-party trackers of any kind.
• No location data, no device fingerprinting, no contacts, no photos.
• No connection to any electronic health record, insurer, employer, or pharmacy.

We do not sell your data, rent it, share it for advertising, or use it to train anything. We do not disclose your journal contents to anyone, for any commercial purpose, ever.

REMedy has no AI features, and your journal entries are never sent to an AI system. We may look at aggregate patterns across users to improve the product, using statistics that cannot identify you or reproduce anything you wrote.

Cookies

REMedy sets only the cookies it needs to function: one that keeps you signed in, one that protects forms against cross-site attacks, a one-hour cookie that carries your quiz score across sign-up if you take the quiz first, and a brief one that shows a confirmation message after an action. There are no advertising or analytics cookies, so there is no consent banner to dismiss.

Other companies involved

• Google handles sign-in. Google therefore knows you have a REMedy account. Google receives nothing you write in your journal.
• DigitalOcean hosts the server the site runs on, in the United States.
• Google Fonts and a stylesheet service (Tailwind CDN) deliver the typeface and styling for the pages. Your browser fetches those files directly, which means those services can see your IP address and that you loaded a REMedy page—the same way any website using a web font works. They receive no account information and no journal content.

No other company receives your data. We may disclose information if we are legally compelled to, and if that ever happens we will tell you unless we are legally barred from doing so.

Where your data resides, and who can access it

Your entries are stored in a single database on one server in the United States. Traffic between your browser and that server is encrypted (HTTPS). Sign-in tokens are stored hashed rather than in readable form, and REMedy stores no passwords at all.

Two people have the technical ability to reach the server: the operator, and one technical collaborator who administers the machine REMedy runs on. No larger organization exists. No one else is authorized to access your data, and neither person reads your journal except where you have asked for help with your account.

Deleting your account

Settings has a Delete my account and all data option. It runs immediately and removes your account, every journal entry, every questionnaire response, and every sign-in session in one operation. It cannot be undone, and we cannot restore anything afterwards. At present REMedy keeps no backups, so there is no other copy of your data anywhere to erase. If that changes we will update this page to say how long a deleted record can persist in a backup before it is overwritten, and we will not start keeping backups without making that change.

While your account exists, your data is kept for as long as you keep it. A sleep diary is only useful over months, so nothing expires on its own.

If there is ever a breach

REMedy is not covered by HIPAA, which applies to clinics, hospitals, and insurers rather than to a consumer app. It is covered by the U.S. Federal Trade Commission's Health Breach Notification Rule. If your health information is ever exposed or disclosed without authorization, we will notify you by email without unreasonable delay and in no case later than 60 days after discovering it, and we will notify the FTC (and the press, where the rule requires it). That commitment covers accidental disclosure, not only a hack.

Your choices

• See your data: all of it is visible in the app, and the report page prints a copy of any two-week span you choose.
• Correct it: write to us and we will fix or remove an entry.
• Delete it: Settings, as above. No explanation required and no retention period.
• Ask a question: the email address above reaches a person.

Children

REMedy is intended for adults. It is not designed for and not directed at anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, write to us and we will delete it.

Changes to this policy

If this policy changes, the date at the top changes with it. If a change materially affects how your health information is handled, we will email account holders rather than relying on you to re-read this page.

Questions: remedysleepproject@gmail.com · See also our Terms of Use.