AirFlow Master — breath training app
Last updated: 13 September 2026
In short: we store your email address, your breathing sessions and your Control Pause measurements — so the app can show you your history and progress. We do not sell this data, we show no ads, and we share nothing for marketing purposes. You can delete your account and all of its data yourself, inside the app.
The data controller is Szymon Rudnicki, an individual developing the AirFlow Master app (available on Google Play and the App Store). Contact for any data protection matter: airflowmaster.app@gmail.com
For every completed breathing session we store: the technique name, duration, date and time, difficulty level, session category, and — if you provide them — a session quality rating (1–5), a mood (emoji) and your note. For every Control Pause test: the breath-hold time in seconds, the date and time, and a note if you add one. Plus one statistic: your longest streak of training days.
Google's libraries automatically collect crash reports (Firebase Crashlytics) and performance data: start-up and network timings (Firebase Performance). We also record basic analytics events (Firebase Analytics) — the fact that you signed in, the method used, and authentication error codes. Reports and events carry your account identifier, but never your email address.
App settings (volumes, narrator on/off, vibrations, chosen background theme) are stored locally only — they never reach our servers. The app also keeps a local copy of your own sessions and measurements so it works offline.
We do not collect Bluetooth sensor data (the feature is disabled in the released app, and readings from a test device are never stored), heart rate, location, contacts, photos or advertising identifiers.
Breath-hold times, session quality ratings, mood and notes may qualify as health data. You provide them voluntarily and entirely on your own initiative — the app never requires them. We use them only to show you your own history, charts and progress — never for advertising profiling. You can delete any single entry, or your whole account at any time (section 8). The note field is free text: do not type anything into it that you would rather not have stored.
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account, storing sessions and measurements, showing history, streaks and charts | Art. 6(1)(b) — necessary to provide the service you asked for |
| Wellbeing, mood and breathing data that you enter voluntarily | Art. 9(2)(a) — your explicit consent, given by entering the data yourself; you may withdraw it by deleting the entry or your account |
| App stability: crash reports, performance data, basic usage analytics | Art. 6(1)(f) — our legitimate interest in keeping the app working |
| Subscription handling and entitlement checks (applies to the paid-subscription version) | Art. 6(1)(b) — performance of a paid service contract |
We do not sell data and we do not pass it to other companies for marketing. We rely on the following providers, who process data on our behalf:
| Provider | Scope |
|---|---|
| Google (Firebase) | authentication, the database holding your sessions and measurements, crash reports, analytics, performance data, Google sign-in |
| Apple | Sign in with Apple (iOS only) |
| RevenueCat | subscription handling and receipt validation — applies to the paid-subscription version of the app; transaction identifiers and a pseudonymous user identifier |
| Google Play / Apple App Store | processing subscription payments (if you buy one); we never see full card details |
These providers may process data outside the European Economic Area, including in the USA, on the basis of standard contractual clauses or the EU–US Data Privacy Framework.
Training data is kept until you delete it — either entry by entry or together with your account. We do not delete it after a period of time, because a long progress history is the point of the app. Crash reports and analytics data are subject to the retention periods configured in Google's services.
You have the right to access your data, rectify it, erase it, restrict processing, port it, and to object to processing based on legitimate interest. You may withdraw consent for health-related data at any time by deleting the entries or your account.
You can do most of this yourself in the app (section 8). For a copy of your data write to us (section 12) — the app has no automated export yet, so we will prepare it manually.
You may also lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (uodo.gov.pl).
In the app: Profile → Account settings → Delete account. For security we ask you to confirm and to sign in again.
This deletes: all of your breathing sessions, all of your Control Pause measurements, your stored streak statistic, and the Firebase Authentication account itself (and, for Google sign-in, the app's link to your Google account). The operation cannot be undone.
You can also delete a single session or a single measurement from the history view without deleting your account.
The app contains no age-restricted content — breathing exercises are for everyone, and there is nothing in the app that should stop a child from using it. It is not, however, designed for children, nor directed at them.
An account requires an email address, so anyone under 16 should create one with their guardian's knowledge and consent. We do not verify users' age.
The connection to the server is encrypted (TLS), and database security rules give each user access to their own entries only, requiring a verified email address. Passwords are stored as hashes by Firebase Authentication.
If the scope of processing changes (for example when subscriptions launch), we will update this page and change the date at the top. Significant changes will be announced in the app's release notes.