Your quiet stays yours.

Privacy notice · Updated 3 November 2026.

iPad and Apple TV media editions

These editions play stories, soundscapes, music and Visualscapes. They do not start sleep tracking, read or write Apple Health, use the microphone, create alarms or collect product diagnostics. Listening-language preferences, favourites and saved sound mixes are stored on that installation; the native media library does not sync these records to the customer account service. Apple handles subscription purchases and restoration through your Apple account. No separate Drift Off sign-in is required in these editions.

Free web edition

No account is required. Your favourites, preferences, up to 200 recent listening starts and self-reported journal are saved only in this browser on this device. They are not uploaded to us or synced with the iPhone app. You can delete journal entries in Sleep journal. Clearing this website’s browser data removes its local records. Use a personal browser profile on a shared laptop or iPad.

The website does not request microphone or Apple Health access and does not collect product diagnostics. It has no paid checkout. Our iPhone app has separate, optional permissions and sharing controls, described below.

Optional free iPhone account

In versions with free accounts enabled, you can choose email-code signup or Sign in with Apple after the app hints, or in Settings & help > Your account. You can close this screen and continue without an account. Local saving, listening, alarms and Apple purchases do not require signup.

If you choose an account, Clerk handles authentication, verification emails and protected sign-in sessions. Clerk’s Svix webhook service delivers signed account-deletion notices to our customer service, so deleting your Clerk identity also removes its listening backup. Those notices contain the account identifier; our listening backup, journal and Health records are not sent to Svix. Apple may provide a private relay email address. We request your email address, not your name, contacts or phone number. Our separate Drift Off customer database stores your account identifier, verified email address, interface language, account creation and last account-contact times, email preference and the version and time of your choices.

While signed in, your favourites, listening preferences and up to 200 recent listening starts are backed up and restored across your signed-in phones. A listening entry contains the catalogue item, story language, start time and a random entry identifier. Preferences include the sleep timer, wind-down time, narration speed, story language, narrator and display/motion choices. A listening start does not prove that you finished a story or fell asleep. Your journal, Apple Health records, microphone audio, sound measurements, night summaries and alarms are not included in this account backup. This customer service is separate from optional product diagnostics and does not link the two identities.

We use account data to provide login, recovery, listening backup and customer support. Verification and necessary account/security emails are separate from the optional, unchecked choice to receive new stories and occasional updates. You can change that choice in Your account. No marketing campaign is sent merely because you create an account. Any marketing emails we send must offer an unsubscribe option. We do not sell Health or journal data or share your account with Bside.

You can export your account profile, backup and choices as a JSON file, sign out, restore your backup or delete the account in Your account. Signing out keeps local listening data and the saved cloud backup. Deleting the account removes the live backup and contact/choice records, and requests deletion of the Clerk identity. If the provider is temporarily unavailable, the app reports that deletion is pending and our service retries hourly; new backup access is blocked. A minimal deleted-account identifier is kept for 30 days to prevent stale sessions from recreating deleted records. Provider recovery backups may retain earlier copies under their retention policies. Local data and Apple subscriptions are managed separately.

Cloudflare hosts the separate customer service; its D1 database is restricted to the European Union. Clerk and Cloudflare process connection and security information to operate their services, which may involve processing outside the EU. Do not treat this as EU-only processing. Our customer service does not store raw IP addresses or enable request logging; short-lived keyed rate-limit identifiers expire after their security window. Authentication telemetry is disabled in the app. See Clerk’s data processing terms and Cloudflare’s privacy information.

Earlier beta versions only stored an Apple sign-in identifier in the iPhone Keychain. That old local connection did not create a customer account or a backup. You must complete the new account flow before a cloud backup exists. Keep an account backup current before deleting the app or changing phones. If you continue as a guest, deleting the app can remove your local records.

Apple Health is your choice

drift off requests optional read access to steps, workouts, exercise minutes and sleep. Shared values are used to display your own sleep and activity context on this iPhone. You can separately review and save a tracking session as time in bed, or enable automatic saving for future completed tracking intervals, off by default. Saving requires Sleep write permission. Alarm-only nights and unclosed intervals after an app termination are not saved automatically. Tracking does not measure time asleep or produce sleep stages. Separately, you can review and confirm estimated or remembered sleep periods before saving them as unspecified sleep, marked as user entered. Estimated sleep is never exported automatically. No Core, REM or Deep stages are inferred or written. No Health data is uploaded or used for advertising. You can choose categories in the Health permission sheet, disconnect in drift off to stop reads and automatic saving, and revoke permissions in Apple Health.

Microphone monitoring

When you explicitly start experimental movement monitoring, microphone audio is processed in memory on the iPhone to estimate changes in movement sounds. drift off does not save or upload raw audio. Optional Phone sleep analysis is off by default. If enabled before a night, minute-level counts of usable input and sound changes are stored in protected local night history, excluded from backup. An exploratory, unvalidated heuristic identifies sustained quiet periods as possible sleep for your review, not as measured sleep. Quiet wakefulness, room noise and other people can mislead it. Playback, calibration, gaps and interrupted input are excluded. Removing night history deletes these local counts. No counts or estimates are sent to our servers. Monitoring stops when the night ends, an alarm triggers or an interruption prevents it. Saving an alarm leaves the microphone off. Tap Start sleep tracking when ready for bed. Stop sleep tracking switches the microphone off while keeping your latest-time alarm; ending the night cancels the first and early-wake alarms after confirmation. An optional independent backup remains armed until separately cancelled or stopped. The orange system microphone indicator remains visible when iOS shows it.

Local records

Favourite sounds, preferences, up to 200 recent listening starts and journal entries are stored in the app's WebKit storage. Listening history works without signing in and begins with the update that adds it. It records the catalogue item, story language and start time, not whether you finished listening. You can view it in Your library. An optional account can back up the listening records as described above. drift off night summaries include session times, wake window, evening tag and movement count. Night summaries are stored in a protected local file excluded from backup. Health query results are held in memory. Delete individual journal notes in Sleep journal and drift off night summaries in Sleep analysis. Removing the app removes its local records. Deleting drift off data never deletes Apple Health records.

Optional product improvement

Native membership access works without optional product sharing. The account-free sharing controls request separate, unchecked consent before uploading app/iOS versions, broad iPhone device family, monitoring events, observed alarm events and voluntary fixed-choice morning feedback. Events include the server receipt time and a random participant ID. These data can reveal sleep-tracking use and are pseudonymous, not guaranteed anonymous. No raw audio, sound measurements, Health records, sleep stages or journal text are uploaded.

Cloudflare Workers processes requests globally; the D1 database is restricted to the European Union. This is not UK-only storage or EU-only network processing. Cloudflare processes ordinary connection information to operate its services. Our service does not store raw IP addresses or enable Worker request logging; keyed rate-limit identifiers expire within two hours.

Events expire after 90 days with hourly cleanup. Consent history is retained while sharing is active and up to 90 days after withdrawal. Stop sharing stops new uploads locally; if offline, server withdrawal retries when you reopen online. Delete shared data removes your participant and linked events and consent records from the live database. Provider recovery backups may retain earlier data for up to 30 days. Keep your private recovery code if you want deletion access after replacing this iPhone. No clinical or sleep-stage study is active.

Full data-sharing notice and your rights

Alarms and purchases

Alarm permission lets iOS deliver the wake alarms you request. Current alarm IDs are stored locally so drift off can manage the night after reopening. Apple handles any App Store purchases and subscription information. The iPhone app requires an active subscription, including during an Apple-confirmed free trial. Subscriptions renew monthly or annually unless cancelled. An alarm that is already set is not removed when a subscription ends. Family membership uses Apple Family Sharing for up to six people. Apple displays the local price and billing period before purchase. Manage, cancel or restore your subscription through the app.

No ads or health-data sale

There is no advertising SDK or third-party analytics SDK in the iPhone app. Neural narration is generated before release; playback does not send your story listening or Health data to a TTS provider. The optional research/privacy links open hosted web pages. The public web edition is hosted by Cloudflare. The free web edition uses no sign-in, advertising SDK or third-party analytics SDK. Cloudflare processes ordinary network information, such as IP addresses, to deliver and protect the website. The web edition cannot read Apple Health, start sleep monitoring or set wake alarms. Fonts and audio are served from the same website, without a voice-provider or Google Fonts request. Browser playback during screen lock depends on your device.

Contact

Questions or deletion help: hello@designstudio13.com.