LEGAL

DRIFTY PRIVACY POLICY

Incorporating the EU/UK GDPR Notice (Annex A), the California CCPA/CPRA Notice (Annex B), and Other United States State Privacy Notices (Annex C)

Version 1.0
Effective Date: September 22, 2026
Last Updated: September 22, 2026

1. OVERVIEW AND SCOPE

Drifty, Inc. ("Drifty," "we," "us") builds a general wellness application for iOS and watchOS that senses sleep-related signals, delivers haptic cues, and presents non-diagnostic insights. Because the product touches health-adjacent data, we have designed it around a simple principle: keep the most sensitive data on your device, collect the minimum needed, and never sell it.

This Privacy Policy explains what we collect, why, on what legal basis, with whom we share it, how long we keep it, and the rights you can exercise. It applies to the Drifty App, driftysleep.com, and all related services (the "Services").

Consumer health data is also covered by our separate Consumer Health Data Privacy Policy, which applies to residents of Washington, Nevada, Connecticut, and other states with consumer health data laws.

Data Controller / Business: Drifty, Inc., TO BE COMPLETED: registered business address. Contact: driftyteam1@gmail.com.

2. PRIVACY ARCHITECTURE: WHAT LEAVES YOUR DEVICE

This section is a plain-language summary and does not replace the detail below.

We do not use HealthKit-derived data for advertising, marketing, or data brokering, and we do not disclose it to any third party for those purposes.

3. INFORMATION WE COLLECT

3.1 Information you provide

3.2 Health and wellness information (special category / sensitive)

Collected only with your permission, and only if you enable the corresponding feature:

• Sleep session start and end times, duration, and platform-derived sleep stage estimates
• Heart rate, heart rate variability, and, where available, blood oxygen and respiratory rate samples
• Motion, accelerometer, and body position signals
• Acoustic event classifications derived on-device (for example, a snore-like or disturbance-like event, with a timestamp and a confidence value). No raw audio.
• Personal baselines and multi-night trend values computed from the above
• Haptic intervention events and your responses to them
• Alarm, wake-gate, and override events

3.3 Information collected automatically

• Device and technical data: device model, operating system version, App version, language, time zone, locale, watch pairing state, battery and power state relevant to session admission
• Product analytics: feature usage, screen views, session counts, subscription funnel events, crash and error diagnostics, performance metrics
• Identifiers: a Drifty-generated pseudonymous installation identifier, Apple's vendor identifier (IDFV), and account identifier. We do not use the Advertising Identifier (IDFA) and do not operate an advertising SDK.
• Site data: IP address, browser type, referring URL, pages viewed, and cookie or similar identifiers (see Section 10)

3.4 Information from third parties

• Apple, for subscription entitlement, receipt validation, and refund status
• Our payment processor, for transaction status
• Our support, email, and analytics providers, for the interactions they handle on our behalf
• Supported third-party wearables or platforms you choose to connect

3.5 Information we do not collect

We do not knowingly collect: government identifiers; precise geolocation; biometric identifiers used for identification (such as faceprints or voiceprints); racial or ethnic origin; religious or philosophical beliefs; political opinions; union membership; sexual orientation or sex life data; genetic data; or information from anyone under 18.

4. HOW WE USE INFORMATION

We do not use your data to make any decision that produces legal or similarly significant effects about you, and we do not conduct profiling for advertising purposes. Detection and classification are automated, but they are informational only, produce no diagnosis, and you can disable them at any time.

5. LEGAL BASES (EEA, UK, SWITZERLAND)

See Annex A for the full legal basis table and additional GDPR disclosures.

6. WHEN WE SHARE INFORMATION

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have never done so.

6.1 Service providers / processors. We disclose personal information to vendors who process it only on our documented instructions under a written data processing agreement, for: cloud hosting and storage; crash reporting and diagnostics; product analytics; customer support tooling; transactional email; subscription and payment management; and security monitoring. A current list of subprocessors is maintained in the Drifty Data and Compliance Manual and is available on request at driftyteam1@gmail.com.

6.2 Platform providers. Apple processes purchases, entitlements, and, where you use them, iCloud backups, under its own privacy policy.

6.3 Legal and safety. We may disclose information if required by law, subpoena, court order, or other legal process, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Drifty, our users, or the public, or to investigate fraud or a security incident. Where legally permitted, we will notify you before disclosing your data in response to a government request and will challenge requests we believe to be overbroad or unlawful.

6.4 Corporate transactions. If Drifty is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred. Any acquirer will be bound to honor the commitments in this Policy with respect to previously collected data, and material changes will be notified in advance with an opportunity to delete your data.

6.5 Aggregated and de-identified data. We may create and use aggregated or de-identified data for research, model development, and reporting. We maintain that data in de-identified form, do not attempt to re-identify it, and contractually require recipients not to re-identify it.

6.6 With your direction. We share information with third parties you explicitly authorize, such as a clinician or a connected service you link.

7. HOW LONG WE KEEP INFORMATION

We retain information longer where required to comply with a legal obligation, resolve a dispute, or enforce our agreements, and we isolate such data from active use.

8. SECURITY

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including: encryption in transit (TLS 1.2 or higher) and at rest (AES-256); an on-device-first architecture that minimizes server-side sensitive data; role-based access control and least privilege; multi-factor authentication for all administrative access; secrets management; audit logging; a secure software development lifecycle with dependency and vulnerability scanning; vendor security review; and an incident response plan with defined notification timelines. Details are documented in the Drifty Data and Compliance Manual.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law, including the EU and UK GDPR, United States state breach notification statutes, and the FTC Health Breach Notification Rule where it applies.

9. INTERNATIONAL TRANSFERS

Drifty is based in the United States, and information we process may be stored and processed there or in other countries where our service providers operate. Where we transfer personal data from the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with supplementary technical measures including encryption and data minimization. You may request a copy of the relevant safeguards at driftyteam1@gmail.com.

10. COOKIES AND SIMILAR TECHNOLOGIES

The App does not use advertising cookies or third-party advertising SDKs. driftysleep.com uses strictly necessary cookies and, where you consent, analytics cookies. In the EEA and UK, non-essential cookies are set only after opt-in consent through our cookie banner, and you may withdraw consent at any time through the cookie preferences link. We honor the Global Privacy Control (GPC) signal as a valid opt-out of sale and sharing for browsers that transmit it.

11. YOUR RIGHTS AND CHOICES

11.1 In-product controls. You can revoke health, motion, microphone, or notification permissions in device settings; disable any feature in App settings; export or delete on-device data; and delete your account from within the App, which is the fastest route to erasure.

11.2 Requests. Depending on your jurisdiction, you may have rights to access, correct, delete, port, restrict, or object to processing, to withdraw consent, and to opt out of sale, sharing, targeted advertising, profiling, or the use of sensitive personal information. Submit a request at driftyteam1@gmail.com or through the App's Privacy settings.

11.3 Verification. We verify requests by confirming control of the account email and, for sensitive requests, by requesting additional matching information. We do not require you to create an account in order to submit a request. An authorized agent may submit a request with written permission signed by you, and we may require you to verify your identity directly.

11.4 Timing. We respond within 45 days for United States state law requests (extendable by 45 days with notice) and within one month for GDPR requests (extendable by two months with notice). Requests are free unless manifestly unfounded or excessive.

11.5 No retaliation. We will not deny you goods or services, charge you a different price, or provide a different level of quality because you exercised a privacy right.

11.6 Appeals. If we decline a request, you may appeal by replying to our decision with the subject line "Privacy Appeal." We will respond within 45 days (or the shorter period required by your state law). If the appeal is denied, we will provide the contact details of your state attorney general or supervisory authority.

11.7 Marketing. Unsubscribe using the link in any marketing email or by contacting us. We will still send transactional and service messages.

12. CHILDREN

The Services are for users 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact driftyteam1@gmail.com and we will delete it promptly.

13. CHANGES TO THIS POLICY

We will post any revised Policy with a new "Last Updated" date. For material changes, we will provide at least 30 days' advance notice in the App or by email, and, where a change requires it, obtain your renewed consent before applying the change to previously collected data.

14. CONTACT

Drifty, Inc., TO BE COMPLETED: registered business address
Privacy contact: driftyteam1@gmail.com
Privacy lead: Akshar Patel, CTO, driftyteam1@gmail.com
EU representative (Art. 27 GDPR): TO BE COMPLETED: EU Article 27 representative
UK representative (Art. 27 UK GDPR): TO BE COMPLETED: UK Article 27 representative

---

ANNEX A: EU / UK / SWISS GDPR NOTICE

This Annex applies to individuals in the European Economic Area, the United Kingdom, and Switzerland, and supplements the Policy above. Where this Annex conflicts with the main Policy, this Annex controls for those individuals.

A.1 Controller and Representative

Drifty, Inc. is the controller of the personal data described in this Policy. Our Article 27 representative in the EU is TO BE COMPLETED: EU Article 27 representative and in the UK is TO BE COMPLETED: UK Article 27 representative. Our privacy lead is Akshar Patel, CTO, driftyteam1@gmail.com. Drifty has assessed the requirement to appoint a Data Protection Officer under Article 37 and will appoint one if our processing of special category data becomes large scale as defined in EDPB guidance; that assessment is documented and reviewed annually.

A.2 Legal Bases for Processing

Consent for health data is separate, granular, unbundled, and freely withdrawable. Withdrawal does not affect the lawfulness of prior processing. You can withdraw at any time in App settings or by revoking the permission at the operating system level. A record of each consent (version, timestamp, scope, method) is maintained.

A.3 Legitimate Interests Assessment

Where we rely on Article 6(1)(f), we have conducted and documented a balancing test recording the interest pursued, necessity, and the impact on data subjects, together with the mitigations applied (pseudonymization, aggregation, retention limits, opt-out). A summary is available on request.

A.4 Your Rights

You have the right to: access your personal data and obtain a copy; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability in a structured, commonly used, machine-readable format; object to processing based on legitimate interests, including direct marketing at any time; withdraw consent at any time; and not be subject to a decision based solely on automated processing producing legal or similarly significant effects (Drifty makes no such decisions).

To exercise these rights, contact driftyteam1@gmail.com. We respond within one month, extendable by two further months for complex requests, with notice.

A.5 Complaints

You may lodge a complaint with your national supervisory authority. In Ireland, the Data Protection Commission (dataprotection.ie). In the UK, the Information Commissioner's Office (ico.org.uk). In Switzerland, the FDPIC. You may also seek a judicial remedy.

A.6 Automated Processing (Art. 22)

The Services apply automated on-device signal classification and scoring. These operations inform notifications and insights only. They do not produce legal effects or similarly significant effects, do not constitute a diagnosis, and are subject to your control (any feature may be disabled). You may contact us at driftyteam1@gmail.com to request an explanation of the logic involved at a general level, subject to our trade secret and intellectual property rights.

A.7 Data Protection Impact Assessment

Because the Services process special category data at scale using new technology, we maintain a Data Protection Impact Assessment under Article 35, reviewed at least annually and upon any material change to processing. It is documented in the Drifty Data and Compliance Manual.

A.8 Records of Processing

We maintain records of processing activities under Article 30. Processors engaged by Drifty are bound by Article 28 data processing agreements, including confidentiality, security, subprocessor authorization, assistance, deletion, and audit obligations.

A.9 International Transfers

See Section 9. Transfers rely on the EU Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, or an applicable adequacy decision, with a documented transfer impact assessment.

A.10 Statutory or Contractual Requirement

Providing account data is necessary to create an account. Providing health data is entirely optional; if you decline, the corresponding features will not function, but you may continue to use the remainder of the Services.

---

ANNEX B: CALIFORNIA PRIVACY NOTICE (CCPA / CPRA)

This Annex applies to California residents and serves as our Notice at Collection and Privacy Policy under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations.

B.1 Categories of Personal Information Collected (Last 12 Months)

B.2 Sources

Directly from you; automatically from your device and the App; from Apple and our payment processor; from our service providers; and from third-party services you elect to connect.

B.3 Business and Commercial Purposes

Providing the Services; performing services on our behalf (hosting, analytics, support, payments); security, integrity, and fraud prevention; debugging and repair; internal research and product development; quality assurance; legal compliance; and the additional purposes listed in Section 4.

B.4 Disclosures for a Business Purpose

In the preceding 12 months we disclosed categories A, B, D, F, and L to service providers and contractors for the business purposes above, under contracts that prohibit retention, use, or disclosure for any purpose other than performing those services.

B.5 No Sale, No Sharing, No Targeted Advertising

We have not sold or shared (as those terms are defined under the CCPA/CPRA) personal information, including sensitive personal information, in the preceding 12 months, and we do not do so today. We do not sell or share the personal information of consumers we know to be under 16 (and we do not permit users under 18 at all). We do not engage in cross-context behavioral advertising.

B.6 Use and Disclosure of Sensitive Personal Information

We use sensitive personal information only for purposes permitted by Civil Code 1798.121 and its regulations: to perform the Services you request, to ensure security and integrity, for short-term transient use, to perform services on our behalf, and for quality and safety verification. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you. As a result, the "Limit the Use of My Sensitive Personal Information" right does not create an additional restriction, but you may nonetheless disable any health feature at any time and we will honor any request as though the right applied.

B.7 Retention

We retain each category for the periods described in Section 7 and do not retain personal information for longer than reasonably necessary for the disclosed purpose.

B.8 Your California Rights

• Right to know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of recipients (covering the preceding 12 months, and beyond 12 months upon request where technically feasible and not disproportionately burdensome)
• Right to delete personal information, subject to statutory exceptions
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing (we do neither; a request will be honored as a matter of policy, and we honor Global Privacy Control signals)
• Right to limit the use and disclosure of sensitive personal information
• Right to opt out of automated decision-making technology and to obtain meaningful information about the logic involved, as those rights take effect under CPPA regulations. Drifty does not use ADMT to make significant decisions about consumers
• Right to non-discrimination for exercising any right

How to submit: email driftyteam1@gmail.com, or use the Privacy section in the App. TO BE COMPLETED: toll-free number Authorized agents may submit requests with written authorization; we may require you to verify your identity directly and confirm the agent's authority.

B.9 Notice of Financial Incentive

If we offer a referral credit, promotional discount, or research participation incentive, we will publish a separate Notice of Financial Incentive describing the material terms, the good-faith estimate of the value of the data, the method of calculation, and how to opt in and withdraw. Participation is always voluntary and requires opt-in consent.

B.10 Shine the Light

California Civil Code 1798.83 permits residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

B.11 California Minors

We do not permit users under 18. California Business and Professions Code 22581 removal requests may be sent to driftyteam1@gmail.com.

---

ANNEX C: OTHER UNITED STATES STATE PRIVACY NOTICES

This Annex applies to residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws in effect.

C.1 Rights

Subject to your state's law, you may: confirm whether we process your personal data and access it; correct inaccuracies; delete personal data; obtain a portable copy; opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects; and appeal a denial.

Drifty does not sell personal data, does not process personal data for targeted advertising, and does not profile consumers in furtherance of decisions producing legal or similarly significant effects.

C.2 Sensitive Data Consent

Health-related data is "sensitive data" under these laws. We process it only with your prior opt-in consent, obtained separately from other consents, and you may withdraw consent at any time, after which we will stop processing within 15 days.

C.3 Data Protection Assessments

We conduct and document data protection assessments for processing that presents a heightened risk of harm, including the processing of sensitive data, as required by Colorado, Connecticut, Virginia, and other state laws.

C.4 Universal Opt-Out Mechanisms

We recognize Global Privacy Control and other universal opt-out mechanisms required by Colorado, Connecticut, Texas, Montana, and other states.

C.5 Appeals

Submit an appeal to driftyteam1@gmail.com with the subject "Privacy Appeal." We will respond within 45 days (60 days in Colorado). If denied, we will provide a method to contact your state attorney general.

C.6 State-Specific Notes

• Nevada (SB 220 / SB 370): Nevada residents may submit a verified request that we not sell covered information. We do not sell covered information. Nevada's consumer health data provisions are addressed in the Consumer Health Data Privacy Policy.
• Washington and Nevada consumer health data: See the separate Consumer Health Data Privacy Policy, which is required by, and drafted to comply with, the My Health My Data Act and Nevada SB 370.
• Texas (DPSA): Drifty does not sell personal data or sensitive data. If that changes, we will post the notices required by Sections 541.102(b) and (c).
• Oregon: You may request a list of the specific third parties to which we have disclosed personal data.
• Colorado and Connecticut: Consent obtained through dark patterns is not valid consent; Drifty does not use dark patterns in its consent flows.

Drifty is a general wellness product. It does not diagnose, treat, cure, or prevent any disease or condition, and it is not a substitute for professional medical advice. If you have concerns about your sleep or breathing, talk to a qualified healthcare provider.