NIGHTECHO
Privacy Policy
International Edition · Users Outside Mainland China
Effective date: August 9, 2026
Last updated: August 9, 2026
Controller: AtlasAI LIMITED · Hong Kong SAR · BRN 79281059
Privacy contact: atlasai.global@gmail.com
This Privacy Policy explains how ATLASAI LIMITED ("ATLASAI," "we," "us," or "our") handles information when you use the NightEcho mobile application and related services (collectively, "NightEcho"). It applies to users outside mainland China. A separate privacy notice applies to users served by the mainland China version.
For purposes of applicable data protection law, AtlasAI LIMITED, a company incorporated in Hong Kong SAR with Business Registration Number 79281059, is the controller of personal information processed through NightEcho, unless this Policy states otherwise. You can contact us at atlasai.global@gmail.com.
NightEcho is a sleep-management and wellness product. It is not a medical device and does not provide medical diagnosis, treatment, or emergency services.
1. Privacy at a glance
· NightEcho does not require an account and does not ask for your name, phone number, or home address to use the app.
· Sleep records, event audio clips, camera frames used for pulse measurement, motion readings, HealthKit data, heart-rate records, and AI chat history are stored or processed on your device as described below.
· NightEcho does not save a full-night raw audio recording. It may save selected sleep-event clips of approximately 10 seconds on your device.
· Camera frames used for pulse measurement and temporary motion readings are processed on the device and are not saved or uploaded.
· When Apple's on-device Foundation Models framework is available, supported AI requests are processed on your device.
· If the on-device model is unavailable, NightEcho sends the information described in Section 3.2 to our service gateway and Google Gemini only after you provide separate, explicit cloud-AI consent.
· We do not sell personal information. We do not use HealthKit data, sleep audio, camera data, or AI conversations for advertising or marketing.
Notice at collection
The table below summarizes the categories NightEcho may process at or before collection. More detail appears in the sections that follow.
Device and service identifiers
Examples and source: Random installation identifier generated by NightEcho; short-lived service token; IP address and request metadata generated when you connect
Purpose: Authenticate requests, deliver cloud features, prevent abuse, secure and troubleshoot the service
Disclosures: ATLASAI's infrastructure and security providers
Retention: Installation identifier until app data is deleted; token for approximately 30 minutes; technical and security logs for no more than 90 days, unless a longer period is required for an active security investigation or by law
Sleep, health, and wellness information
Examples and source: Information generated by NightEcho, entered by you, or read from HealthKit with permission
Purpose: Provide sleep tracking, reports, trends, wellness insights, and requested AI features
Disclosures: Processed on device; report summaries disclosed to ATLASAI and Google Gemini only after separate cloud-AI consent
Retention: Local data until you delete available data or the app; ATLASAI cloud-AI content for no more than 30 days; Google retention under the paid-service terms described in Section 7
Audio, camera, and motion information
Examples and source: Microphone, camera, and accelerometer data accessed with iOS permission
Purpose: Detect sleep events, save selected event clips, estimate pulse, and detect phone pickup
Disclosures: Processed on device; not disclosed to ATLASAI or cloud-AI providers
Retention: Selected event clips until deleted; camera frames and temporary motion readings are not retained
User-provided content
Examples and source: AI questions, chat history, mood entries, notes, preferences, support messages, and screenshots you choose to send
Purpose: Provide requested features, personalize responses, maintain local history, and respond to support
Disclosures: Processed on device; cloud-AI text disclosed to ATLASAI and Google Gemini with consent; support content disclosed to support and infrastructure providers
Retention: Local content until deleted; ATLASAI cloud-AI content for no more than 30 days; Google retention under its paid-service terms; support and privacy correspondence for no more than 3 years after the matter is closed, unless law requires longer
Commercial information
Examples and source: App Store product identifier and subscription or entitlement status received from Apple
Purpose: Unlock paid features, restore purchases, and maintain transaction records
Disclosures: Apple and ATLASAI
Retention: For the subscription term and any additional period required by tax, accounting, fraud-prevention, or consumer-protection law
Inferences
Examples and source: Sleep scores, stage estimates, trends, reports, and AI-generated insights
Purpose: Provide the reports and wellness features you request
Disclosures: Processed on device; text or numerical summaries disclosed to ATLASAI and Google Gemini only with cloud-AI consent
Retention: Local data until deleted; ATLASAI cloud-AI content for no more than 30 days; Google retention under its paid-service terms
NightEcho does not sell any of these categories and does not share them for cross-context behavioral advertising.
2. Information processed on your device
2.1 Sleep and wellness information
NightEcho may create and store information such as:
· sleep-session start and end times, estimated time to fall asleep, awakenings, duration, estimated sleep stages, sleep scores, and trends;
· sound levels, derived sound features, and detected event labels such as snoring, talking, coughing, movement, or other environmental sounds;
· sleep reports, AI-generated insights, improvement plans, goals, routines, plan completion, reminders, alarms, and app preferences;
· mood entries, notes, and other information you choose to enter; and
· relaxation playback history, saved mixes, and related settings.
This information is stored locally using iOS storage technologies. It may be included in a cloud-AI request only in the circumstances described in Section 3.2.
2.2 Microphone and sleep-event audio
With your permission, NightEcho uses the microphone during a sleep session to analyze environmental sound and generate sleep-related events. NightEcho may save selected event clips of approximately 10 seconds in an audio format on your device so you can play them back in a report.
NightEcho does not upload original audio recordings or event audio clips to ATLASAI, Google Gemini, or another AI provider. It does not save a continuous, full-night raw audio recording.
2.3 Camera and pulse measurement
With your permission, NightEcho uses the camera and flash while you cover the camera with a fingertip. Video frames and color changes are processed in real time on your device to estimate pulse. Camera frames are not saved or uploaded. The resulting heart-rate record, including the measured value and time, is stored locally on your device.
This feature provides a wellness estimate and is not a medical measurement or diagnosis.
2.4 Motion data
With your permission, NightEcho briefly reads accelerometer data at low frequency during power-saving sleep tracking to detect when the phone is picked up and restore screen brightness. These temporary motion readings are processed in memory, are not retained as a motion history, and are not uploaded.
2.5 Apple Health and Apple Watch data
If you authorize HealthKit access, NightEcho requests read-only access to the following seven data types used in sleep reports:
1. sleep analysis;
2. heart rate;
3. respiratory rate;
4. blood oxygen saturation;
5. heart-rate variability (SDNN);
6. sleeping wrist temperature; and
7. sleeping breathing disturbances.
NightEcho does not write health data to HealthKit in the production app. Data read from HealthKit is stored locally with your sleep report and is used to provide the features you request. Report summaries may include derived HealthKit metrics in a cloud-AI request only after the separate consent described in Section 3.2.
NightEcho does not use HealthKit data for advertising, marketing, or use-based data mining, and does not sell HealthKit data.
2.6 AI chat history
NightEcho stores your AI chat messages and generated responses locally so that you can continue or review conversations. You can delete individual conversations or clear chat history in the app.
On devices where Apple's Foundation Models framework is available, supported prompts are processed by Apple's on-device language model. They are not sent to ATLASAI's cloud-AI gateway merely to obtain the on-device response.
3. Information transmitted from your device
3.1 Service access and security data
When NightEcho accesses ATLASAI's cloud service, the app may transmit or generate:
· a random installation/service identifier created by NightEcho;
· the NightEcho app identifier, package identifier, request time, and short-lived service token;
· network and security information ordinarily generated by an internet request, such as IP address, request time, response status, and security or error logs.
The random service identifier is not your Apple ID, device serial number, or HealthKit identifier. It remains on your device until app data is deleted and is used to issue and secure cloud-service tokens, prevent abuse, and troubleshoot service availability.
NightEcho reads your device language and region settings locally to select the applicable service and response language. The client code reviewed for this Policy does not send those settings as separate profile fields, although the language of text you submit is apparent from the request itself.
3.2 Cloud AI information
If Apple's on-device model is unavailable, NightEcho offers cloud AI. Before the first cloud-AI request, NightEcho displays a separate notice and asks for your explicit consent.
If you agree, NightEcho routes the request through ATLASAI's service gateway at api.zonghongai.com to Google's Gemini model service. Depending on the feature you use, the request may contain:
· sleep-report summaries and derived metrics, including sleep timing, duration, stage estimates, scores, trends, event labels, sound levels, and relevant HealthKit-derived metrics;
· sleep goals, routines, preferences, plan status, or other context needed to personalize a response;
· the question or instruction you enter;
· earlier messages and generated responses needed to maintain the current conversation; and
· system instructions that set the AI assistant's purpose, tone, and safety boundaries.
Cloud AI receives text and numerical summaries. NightEcho does not send original sleep audio, event audio clips, camera frames, your photo library, contacts, or precise location to the cloud-AI service.
We use cloud-AI information only to provide the requested response, operate and secure the service, troubleshoot failures, comply with law, and enforce safety rules. We do not use it for advertising or to train a NightEcho model. NightEcho uses a paid Google business service for production user data. Under Google's paid-service terms, Google does not use prompts or responses to improve its products, although it may log them for a limited period for abuse prevention, security, and required legal disclosures.
Cloud-generated content may be incomplete or inaccurate. Do not use it as medical advice or as a substitute for a qualified healthcare professional.
3.3 Purchases and subscriptions
Subscriptions and purchases are processed by Apple through StoreKit and the App Store. NightEcho receives product and entitlement information needed to unlock features, such as the product identifier, subscription status, and expiration or renewal status. We do not receive your full payment-card number or App Store password. Apple's processing is governed by Apple's privacy policy and App Store terms.
3.4 Support communications
If you contact us, we process the information you provide, such as your email address, message, screenshots, diagnostic details, and any other content you choose to send. Please do not send sleep recordings, detailed health records, or other sensitive information unless we specifically request it and explain why it is needed.
3.5 Notifications
With your permission, NightEcho schedules local reminders and alarms through iOS. Local notification content and schedules are stored on your device and managed by iOS. NightEcho does not require notification permission to use the app's other features.
3.6 Advertising attribution and tracking
NightEcho does not contain a third-party advertising or attribution SDK, access the advertising identifier (IDFA), or engage in cross-app tracking in the version covered by this Policy. If iOS displays an App Tracking Transparency (ATT) permission prompt, declining it does not limit NightEcho's sleep, report, AI, or subscription features.
If a later version introduces advertising attribution or cross-app tracking, we will update this Policy and the App Store privacy disclosures before collecting that data and will use IDFA only if you authorize tracking through ATT. We will not use or disclose HealthKit data, sleep audio, camera data, or AI conversations for advertising, campaign audience creation, or cross-app tracking.
4. Why we process information and our legal bases
The legal bases below apply where laws such as the EU General Data Protection Regulation or UK GDPR require a legal basis.
Provide sleep tracking, reports, local storage, reminders, pulse estimates, subscriptions, and requested features
Information involved: Sleep and wellness data, local audio clips, camera-derived pulse results, motion readings, preferences, transaction status
Legal basis: Performance of our contract with you; your device permission; and, where required for health-related or other sensitive data, your explicit consent
Read HealthKit data and incorporate selected metrics into requested features
Information involved: The seven HealthKit types listed in Section 2.5 and derived report metrics
Legal basis: Your explicit consent and HealthKit permission
Provide on-device AI
Information involved: Prompts, report context, and generated responses processed on your device
Legal basis: Performance of our contract and your request to use the feature
Provide cloud AI
Information involved: The cloud-AI information listed in Section 3.2
Legal basis: Your explicit consent
Authenticate cloud requests, prevent abuse, protect users, and troubleshoot
Information involved: Random service identifier, token, IP address, request metadata, security and error logs
Legal basis: Our legitimate interests in providing a reliable and secure service and, where applicable, legal obligations
Process subscriptions
Information involved: Product and entitlement information
Legal basis: Performance of our contract and compliance with accounting or legal obligations
Respond to support and privacy requests
Information involved: Contact details and message content
Legal basis: Performance of our contract, legitimate interests in support, consent where applicable, and legal obligations
You may refuse microphone, camera, motion, HealthKit, notification, tracking, or cloud-AI permission. Refusing a permission prevents only the feature that requires it, except where the permission is technically necessary to perform the feature you request.
5. How we disclose information
We disclose information only as described below:
· Google Gemini. After explicit cloud-AI consent, Google processes the text and numerical information described in Section 3.2 to generate a response and protect the service.
· Infrastructure and security providers. Providers that host or protect ATLASAI's service gateway may process request content, IP addresses, tokens, and operational logs solely to provide, secure, and maintain the service for us.
· Apple. Apple operates iOS, HealthKit, StoreKit, notifications, ATT, and the on-device Foundation Models framework. Apple processes information under its own terms and privacy policy. NightEcho's access to HealthKit is controlled by your iOS permissions.
· Professional advisers and authorities. We may disclose information when reasonably necessary to comply with law, enforce our terms, protect users or others, respond to lawful requests, or establish, exercise, or defend legal claims.
· Corporate transactions. If ATLASAI is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred subject to confidentiality and applicable law. We will provide notice where required.
We require service providers that process personal information for us to protect it consistently with this Policy and applicable law, use it only for instructed purposes, and apply appropriate security measures.
We do not sell personal information. We do not disclose personal information for cross-context behavioral advertising in the app version covered by this Policy.
6. International data transfers
Cloud AI, support, and security information may be processed in countries or regions other than where you live, including locations where ATLASAI, Google, or our infrastructure providers operate. Privacy laws in those locations may differ from the laws in your jurisdiction.
Where required, we use recognized transfer mechanisms and safeguards, such as an adequacy decision, standard contractual clauses, the UK International Data Transfer Addendum, or another lawful mechanism. We also assess providers and apply technical and organizational protections appropriate to the information involved.
7. Retention and deletion
We retain information only for as long as reasonably necessary for the purposes described in this Policy, taking account of the information's sensitivity, security needs, legal obligations, and any dispute or enforcement requirement.
· Local sleep records, reports, heart-rate records, event audio clips, preferences, and plans: retained on your device until you delete available items or delete the app and its data.
· Local AI chat history: retained on your device until you delete an individual conversation, clear chat history, or delete the app and its data.
· Temporary camera frames and motion readings: processed in memory and not retained as files or histories.
· Random service identifier and local consent/settings records: retained on your device until NightEcho's app data is deleted.
· Cloud-AI content: processed to generate the response and retained by ATLASAI for no more than 30 days for abuse prevention, security, troubleshooting, legal compliance, and handling deletion requests. Google may retain paid-service prompts and responses for a limited period for these purposes under its applicable terms. We do not claim that cloud AI has zero data retention unless ATLASAI has enabled and verified an approved zero-data-retention configuration.
· Technical and security logs: retained for no more than 90 days, unless a longer period is reasonably necessary for an active security investigation, dispute, or legal obligation.
· Support and privacy correspondence: retained for no more than 3 years after the matter is closed, unless a longer period is required by law or an active dispute.
· Subscription records: retained by Apple under Apple's policies and, where ATLASAI receives entitlement or transaction records, for as long as needed to provide access and meet legal obligations.
When information is no longer required, we delete it or de-identify it, unless retention is required by law. Deleting the app through Delete App removes NightEcho's local app data; using iOS Offload App may retain it.
8. Your choices and controls
· Microphone, camera, motion, HealthKit, notifications, and tracking: review or change permissions in iOS Settings. HealthKit permissions can also be managed in the Health app.
· Cloud AI: you may decline the cloud-AI notice and continue using features that do not require cloud AI. To withdraw consent after accepting it, stop using cloud-AI features and contact us at atlasai.global@gmail.com. Deleting NightEcho and its app data removes the local consent setting; if you reinstall, you can decline the cloud-AI prompt. You may also ask us to delete cloud-AI records associated with a request where we can reasonably identify them.
· AI chat history: delete a conversation or clear chat history in the app.
· Other local data: use available in-app deletion controls or delete the app and its data from your device.
· Subscription: manage or cancel subscriptions in your Apple ID subscription settings. Deleting the app does not cancel a subscription.
· Communications: you may choose not to send support email and can disable local notifications in iOS Settings.
Withdrawing consent does not affect processing that was lawful before withdrawal.
9. Your privacy rights
Depending on where you live, you may have the right to:
· know whether we process your personal information and access a copy;
· correct inaccurate information;
· request deletion;
· restrict or object to certain processing;
· receive information you provided in a portable format;
· withdraw consent at any time;
· opt out of a sale, sharing for cross-context behavioral advertising, or certain targeted advertising where applicable; and
· complain to your local data protection authority.
To exercise a right, email atlasai.global@gmail.com with the subject NightEcho Privacy Request. Describe the request and the app version and country/region you use. Because NightEcho has no account system, we may need information reasonably necessary to locate a server-side request and verify that you control the relevant device or correspondence. We will not ask for more information than necessary and will respond within the period required by applicable law.
Most NightEcho information is held only on your device, so ATLASAI cannot access or delete it remotely. You can delete that information using the controls in Section 8.
You will not be discriminated against for exercising a privacy right. You may use an authorized agent where applicable; we may request proof of authorization. If local law provides a right to appeal our decision, reply to our decision email and state that you are appealing.
California and other U.S. state notices
In the preceding 12 months, NightEcho may have processed the following categories: identifiers (random service identifier, IP address, and support email), internet or electronic activity (cloud requests and operational logs), commercial information (subscription status), sensory and health-related information (processed primarily on device and included in cloud summaries only with consent), user-provided content, and inferences (sleep scores and insights).
Sources, purposes, recipients, and retention criteria are described in Sections 2 through 7. We do not sell these categories. We do not share them for cross-context behavioral advertising in the app version covered by this Policy. We do not use or disclose sensitive personal information to infer characteristics for advertising or unrelated purposes.
10. Children
NightEcho is intended for adults and is not directed to anyone under 18. Do not use NightEcho or its cloud-AI features if you are under 18. We do not knowingly collect personal information from a person under 18. If you believe a minor has provided information to our cloud service, contact atlasai.global@gmail.com so we can investigate and take appropriate action.
11. Security
We use technical and organizational measures designed to protect information, including iOS permission controls, local storage protections, encrypted HTTPS transport, short-lived service tokens, and access restrictions. No system is completely secure, and we cannot guarantee absolute security. Protect your device with a passcode and keep iOS and NightEcho up to date.
12. Third-party services and links
NightEcho relies on services governed by their own notices. You should review:
· Gemini API Additional Terms of Service
NightEcho is not responsible for the privacy practices of third-party websites you choose to open.
13. Changes to this Policy
We may update this Policy when NightEcho's features, providers, data practices, or legal requirements change. We will update the date above and provide additional notice in the app or by another appropriate method when a material change requires it. If a change requires new consent, we will ask before applying that change to the relevant information.
14. Contact us
AtlasAI LIMITED
Hong Kong SAR
Business Registration Number: 79281059
Email: atlasai.global@gmail.com
Subject for privacy requests: NightEcho Privacy Request