Privacy Policy

BeWithly ("we", "our", "us") is operated by BeWithly UG, Munich, Germany. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection law.

This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have.

We collect the following categories of data:

2.1 Account Data

• Email address
• Display name
• Password (encrypted, never stored in plain text)
• Profile preferences and settings

2.2 Usage Data

• Focus session duration and results
• Lesson completion progress
• Streak and achievement data
• App usage patterns during sessions

2.3 Special Category Data (GDPR Article 9)

The Smartphone Addiction Scale (SAS-SV) assessment measures patterns that may relate to your psychological wellbeing. This is considered sensitive data under GDPR Article 9. We collect this data only with your explicit consent. Your assessment results are:

• Strictly private to you
• Never shared with third parties
• Never used for advertising
• Deletable at any time

2.4 Technical Data

• Device type and operating system
• App version
• Error logs (anonymized)
• Session timestamps

2.5 Circle and Social Data

• Circle names and member relationships (only with mutual consent)
• Session participation records

• Contract performance (Art. 6(1)(b) GDPR): Account data required to provide the service
• Explicit consent (Art. 9(2)(a) GDPR): SAS-SV assessment and special category data
• Legitimate interests (Art. 6(1)(f) GDPR): App improvement and security
• Legal obligation (Art. 6(1)(c) GDPR): Compliance with applicable laws

• To provide and improve the BeWithly service
• To personalize your CBT-based program
• To enable multiplayer focus sessions with your circles
• To send session notifications and program reminders
• To measure aggregate app performance (anonymized)
• To comply with legal obligations

We do not sell your personal data. Ever.

We share data only with:

• Infrastructure providers: Servers hosted in the EU (GDPR compliant)
• Analytics: Mixpanel (anonymized, aggregated data only)
• Error monitoring: Sentry (anonymized error logs only)
• Legal authorities: Only when required by law

All third-party processors have signed Data Processing Agreements.

• Account data: retained for the duration of your account plus 30 days after deletion
• Assessment data: retained until you delete it or your account
• Session history: retained for 12 months then anonymized
• Error logs: retained for 30 days

You have the following rights:

• Right of access (Art. 15): Request a copy of all data we hold about you
• Right to rectification (Art. 16): Correct inaccurate data
• Right to erasure (Art. 17): Delete your account and all associated data
• Right to data portability (Art. 20): Export your data in machine-readable format
• Right to withdraw consent (Art. 7): Withdraw consent for special category data at any time
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to restrict processing (Art. 18): Request restriction of processing

To exercise any of these rights, contact us at privacy@bewithly.com or use the "Delete my account" option in the app settings.

BeWithly's session enforcement tools are voluntary. You always retain full control of your device. Sessions are designed to build awareness, not to restrict emergency access. Enterprise users benefit from Right to Disconnect protections in accordance with applicable national law.

BeWithly is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us immediately at privacy@bewithly.com.

BeWithly uses only technically necessary cookies. We do not use advertising or tracking cookies.

We implement appropriate technical and organizational security measures including:

• End-to-end encryption in transit (HTTPS/WSS)
• Encrypted passwords
• Regular security audits
• Access controls and authentication
• EU-based data storage

We will notify you of material changes to this policy via email or in-app notification at least 30 days before they take effect.

You have the right to lodge a complaint with your local data protection authority. In Germany: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach.