Privacy Policy
Last updated June 9, 2026 · Effective June 9, 2026
This Privacy Policy ("Policy") explains how Sleep On It ("we," "us," or "our") collects, uses, discloses, retains, and protects information in connection with the Sleep On It browser extension, our website, and related services (the "Service"). The short version: almost everything Sleep On It stores stays on your own device, we do not run advertising or behavioural tracking, we do not sell or share your personal information for cross-context behavioural advertising, and you can delete your data at any time. The detailed version follows and controls in the event of any conflict with the summary. This Policy is incorporated into our Terms of Service.
1. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable laws including the EU/UK GDPR and the CCPA/CPRA.
- "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and erasure.
- "Controller" means the entity that determines the purposes and means of Processing.
- "Processor" / "Service Provider" means an entity that Processes Personal Data on behalf of the Controller.
- "Local Data" means data stored on your device and not transmitted to us.
- "Merchant of Record" means Lemon Squeezy, which sells the Pro license, processes payment, and bears associated tax and compliance obligations.
2. Who We Are and Scope
Sleep On It is an independently operated software product. For Processing we determine, we act as a Controller. For purchase and payment data, our Merchant of Record (Lemon Squeezy) acts as an independent Controller and/or Merchant of Record under its own privacy policy. This Policy applies to the extension, our website, and our licensing and account-management endpoints. It does not apply to third-party websites, e-commerce platforms, or services that the Service may link to, fetch from, or interoperate with, each governed by its own privacy policy.
3. Information We Collect
We practise data minimisation: we collect only what is necessary to operate the Service.
3.1 Stored Locally on Your Device
The following is stored in your browser using the browser Storage API. It remains on your device, is not transmitted to us, and is under your control:
- Saved items: product name, price, currency, native currency symbol, product URL, image URL, originating site, category, notes you add, timestamps, and item status.
- Settings and preferences: theme, preferred display currency, hourly rate (if you enter one), delay-tier and per-category timer configuration, notification preferences, and other interface preferences.
- Statistics and derived metrics: cumulative savings totals, bought/skipped/expired counts, savings history, and aggregate time-of-day/day-of-week patterns derived solely from your own saved items.
- Pro license state: a cached license-validation result, a locally generated device identifier, an instance identifier from the licensing provider, and trial timestamps.
You may view, export, or erase this Local Data at any time from the extension's settings (including "Delete My Data"). Uninstalling the extension also removes all Local Data.
3.2 Payments and Licensing (Lemon Squeezy)
- Checkout: your email, billing details, and payment instrument are collected directly by Lemon Squeezy. We never receive, see, or store your full payment-card details.
- License activation / validation / deactivation: your license key and a device instance identifier are transmitted to Lemon Squeezy's API to activate, periodically validate (about every 24 hours and at startup), and deactivate your license.
3.3 Our Licensing Endpoints
We may operate licensing and compliance endpoints (hosted on third-party infrastructure such as Railway and Neon) to support license validation, key recovery, and data-subject requests. Where used, limited records may be Processed: a subscription record (email, license key, plan, status, device count/limit, validation timestamps) and a device record (a hashed device identifier and last-seen timestamp, used solely to enforce the per-license device limit). We do not use these records for marketing or profiling.
3.4 Price Research
If you use price-research features, the Service may issue requests to supported e-commerce platforms and search engines using a query derived from the product name of an item you saved. These requests go to third parties operating under their own policies, which may log request metadata (such as IP address). We do not transmit your identity, email, or license key as part of price-research requests.
3.5 What We Do Not Collect
- Your general browsing history or activity on websites at large;
- Analytics, telemetry, behavioural tracking, fingerprinting, or usage monitoring;
- Advertising identifiers, third-party cookies, or cross-context tracking identifiers;
- Financial-account numbers, full payment-card numbers, or bank credentials;
- Website content other than the limited product data you choose to save;
- Precise geolocation, device sensors, biometric or government identifiers;
- Your contacts, calendar, messages, photos, or other personal files.
4. How We Use Information
- To provide, operate, maintain, and improve core functionality;
- To compute on-device estimates such as cost-in-work-hours, savings totals, and rough currency conversion;
- To activate, validate, and manage Pro licenses and enforce device limits;
- To respond to support, data-subject, and refund requests;
- To detect, prevent, and address fraud, abuse, security incidents, and Terms violations;
- To comply with legal obligations, including tax and record-keeping obligations borne by our Merchant of Record.
We do not use your information for advertising, for sale to data brokers, or for automated decision-making producing legal or similarly significant effects.
5. Currency Conversion and On-Device Estimates
The Service presents informational estimates, including a rough currency-conversion feature that converts saved amounts into your selected display currency using a fixed, approximate, built-in exchange-rate table. This conversion is performed locally on your device; no additional Personal Data is collected or transmitted to perform it. Converted figures are approximations only, are not sourced from any live market feed, and may differ materially from real exchange rates. Currency conversion, cost-in-work-hours figures, savings totals, and price research are informational estimates, not financial, tax, or accounting advice, and are subject to the disclaimers in our Terms of Service.
6. Legal Bases for Processing (EEA / UK)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (Art. 6(1)(b)) to deliver the Service and manage your license; legitimate interests (Art. 6(1)(f)) to secure the Service, prevent abuse, and maintain functionality; compliance with a legal obligation (Art. 6(1)(c)); and consent (Art. 6(1)(a)) where specifically requested, which you may withdraw at any time. We do not Process special categories of Personal Data.
7. Disclosure of Information
We do not sell your Personal Data. We disclose information only: to service providers and sub-processors under contractual confidentiality and data-protection obligations; to our Merchant of Record for payment, tax, invoicing, and licensing; for legal reasons (to comply with law, enforce our Terms, or protect rights, property, safety, or security); and in connection with a business transfer (merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets), subject to notice and choices required by law.
8. Third-Party Services and Sub-Processors
| Service | Role | Purpose |
|---|---|---|
| Lemon Squeezy | Merchant of Record / Controller | Payments, tax, invoicing, license issuance and validation |
| Railway (if used) | Processor / hosting | Hosting of licensing and compliance endpoints |
| Neon (if used) | Processor / database | Storage of subscription and device records |
| Cloudflare / Porkbun (if used) | Processor / network | DNS resolution and network protection for our website |
| Google Fonts | Processor | Font delivery on our website |
| E-commerce platforms | Independent third parties | Targets of optional price-research requests |
The presence of a provider above does not imply it receives your identity; it reflects the maximum scope of potential Processing.
9. International Data Transfers
Some recipients (including Lemon Squeezy and infrastructure providers) may Process information in countries other than your country of residence, including the United States. Where required, such transfers are made subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision. By using Pro and licensing features, you understand information may be transferred internationally as described.
10. Data Retention
- Local Data persists on your device until you erase it, clear browser storage, or uninstall.
- Subscription and device records (where our endpoints are used) are retained while your license is active and thereafter only as necessary to meet legal, tax, accounting, fraud-prevention, and dispute-resolution obligations, then deleted or anonymised.
- Payment and tax records are retained by Lemon Squeezy per its policies and applicable tax law.
- Support correspondence is retained as long as necessary to resolve your request and for a reasonable period thereafter.
11. Data Security
- Encryption in transit (HTTPS/TLS) for all network communications with licensing and payment providers;
- Local generation of device identifiers and storage of only cached validation results rather than sensitive credentials;
- Hashing of device identifiers in any server-side records;
- A hardened Content Security Policy and strict input sanitisation throughout the extension;
- Rate limiting and access controls on our endpoints; least-privilege and data-minimisation principles.
No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security, and you provide information at your own risk.
12. Your Privacy Rights
12.1 EEA / UK (GDPR)
You have rights of access, rectification, erasure, restriction, data portability, and objection, and the right not to be subject to solely automated decision-making, and may lodge a complaint with your supervisory authority. Because most data is Local Data on your device, you can exercise access, portability, and erasure directly within the extension at any time.
12.2 California (CCPA/CPRA)
California residents have the rights to know, delete, correct, opt out of "sale"/"sharing," and limit use of sensitive Personal Data, and the right against discrimination for exercising them. We do not "sell" Personal Data and do not "share" it for cross-context behavioural advertising as defined under the CPRA, and we do not knowingly process sensitive Personal Data to infer characteristics. We honour the Global Privacy Control (GPC) signal where applicable.
12.3 Other Jurisdictions
Residents elsewhere (e.g., under Virginia, Colorado, Connecticut, Utah, or comparable laws, or Singapore's PDPA) may have analogous rights. We extend the substantive protections of this Policy to all users regardless of location.
12.4 How to Exercise Your Rights
For Local Data, use the in-extension controls (view/export/delete). For records held by our endpoints, use the in-extension data-export and data-deletion functions or contact us; we will verify your request (typically by confirming control of the associated email or license key) and respond within the timeframe required by law (generally 30–45 days), without a fee except where permitted. For payment records held by Lemon Squeezy, contact Lemon Squeezy or contact us to forward your request where feasible. You may use an authorised agent where the law permits, subject to verification.
13. Children's Privacy
The Service is not directed to children under 13 (or the higher minimum age of digital consent in your jurisdiction), and we do not knowingly collect Personal Data from such children. If you believe a child has provided Personal Data, contact us and we will take reasonable steps to delete it.
14. Cookies, Tracking, and Do-Not-Track
The extension does not use advertising cookies, web beacons, fingerprinting, or cross-site tracking, and does not build behavioural profiles. Our website uses only what is strictly necessary to serve the page and load fonts. Because we do not track you across sites, there is nothing to opt out of; nonetheless, we honour Do-Not-Track (DNT) and Global Privacy Control (GPC) signals where applicable.
15. Automated Decision-Making and Profiling
We do not engage in automated decision-making producing legal or similarly significant effects, and we do not perform profiling for advertising. The statistics and estimates the Service presents are computed for your own information only.
16. Data Breach Notification
In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals without undue delay and in accordance with applicable law.
17. Third-Party Links and Platforms
The Service may link to or fetch from third-party websites and platforms. We are not responsible for their privacy practices or content. We encourage you to review their policies; your interactions with them are governed solely by their terms and policies.
18. Changes to This Policy
We may update this Policy from time to time. Changes will be posted here with an updated "Last updated" date. For material changes affecting how Personal Data is handled, we will take reasonable steps to provide additional notice (for example, in the extension or by email to Pro users where feasible). Your continued use after changes take effect constitutes acceptance. We encourage periodic review.
19. Contact
For privacy questions, data-subject requests, or concerns, contact us at sleeponit.help@gmail.com. We aim to acknowledge inquiries promptly and respond substantively within the timeframe required by applicable law.