The short version

  • Your raw biometrics stay on your phone. Heart rate, HRV, SpO₂, respiration and sleep data are read on-device to score your rest. The raw numbers are never uploaded.
  • Location is used only at the start of a session — to confirm which property you're resting at. We don't track your movements.
  • We never sell your data, and we don't use it to advertise to or track you across other apps or websites.
  • Rest Points are a loyalty balance, not money. They have no cash value and are not a financial account.
  • You're in control. Sharing is opt-in, you can revoke it in one tap, and deleting your account removes your data from our side within 30 days.

1. Who we are

RestReward is a consumer app that helps you find restful stays and earn Rest Points for resting well, operated by Citi Wave, Inc. ("Citi Wave," "we," "us"). This policy explains what the RestReward mobile app and this website collect, how we use it, and the choices you have. If anything here is unclear, contact us at our support page or privacy@restreward.com.

2. What we collect

Health & biometric data (on your device)

With your permission, RestReward reads rest-related signals from Apple Health (HealthKit) or Android Health Connect — heart rate, heart rate variability, blood oxygen (SpO₂), respiratory rate, and sleep. These raw readings are processed on your device to produce a rest score and a yes/no signal that you were genuinely resting. The raw biometric stream is not transmitted to our servers.

Precise location

When you start a rest session, the app takes a single location reading to confirm where the session is taking place. Location is used at that moment only — RestReward does not run background location tracking.

Room environment

During a session, your phone may measure ambient noise level using the microphone. It reads loudness (a decibel level) only — it does not record, store, or transmit audio.

Identity & account data

RestReward creates an account identifier for you so your Rest Points balance and rest history can be saved. We store that identifier, your balance, and your rest history. Your health readings are processed on your device and are not sent to us.

Device & usage data

Standard technical data — device type, app version, crash logs, and basic in-app events — to keep the app working and improve it.

3. What we do NOT collect or do

  • We do not upload your raw heart rate, HRV, SpO₂, or sleep data.
  • We do not record audio. The noise sensor produces a decibel number, nothing else.
  • We do not track your location in the background.
  • We do not sell your personal data, and we do not use it for cross-app or cross-site advertising/tracking.

4. How we use what we collect

We use your data solely to provide the app's functionality: verifying that a rest session happened, scoring rest quality, awarding Rest Points, showing your history, and operating fraud and abuse protections. If you opt in to contributing anonymized rest outcomes, we use that derived (non-raw) data to improve property rest scores for everyone.

5. What partners can see

We do not share your raw data with hotels, brands, or advertisers. When you book through the app, our booking partner receives only what's needed to complete that booking. Your biometrics and rest history are never shared.

6. Rest Points

Rest Points are a promotional loyalty balance. They are not currency, have no cash value, are not redeemable for cash, and do not constitute a financial account or stored-value instrument. Redeemable rewards are introduced over time as the RestReward network grows; availability is not guaranteed and may change.

7. Your choices and rights

  • Permissions: health, location, and microphone access are optional and requested in context. You can change them any time in your device settings.
  • Contribution: sharing anonymized rest outcomes is opt-in and off by default. You can turn it off at any time.
  • Access & deletion: you can request a copy of your data or delete your account from within the app. On deletion, we remove your personal data from our systems within 30 days, except where retention is legally required.
  • Region-specific rights: depending on where you live (e.g., the EEA/UK under GDPR, or California under the CCPA/CPRA), you may have additional rights to access, correct, port, or restrict processing of your data. Contact us to exercise them.

8. Data retention & security

We keep rest history and account data for as long as your account is active, and delete it within 30 days of account deletion. We use encryption in transit, custodial key protection for identity material, and access controls to safeguard data. No system is perfectly secure, but we design to minimize what we hold in the first place.

9. Children

RestReward is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect data from them.

10. Changes to this policy

We'll update this page when our practices change and revise the "last updated" date above. Material changes will be communicated in the app.

11. Contact

Questions or requests: privacy@restreward.com, or visit Support.