For me buds 2 Privacy Policy

Effective Date: October 6, 2026

Sleepwave Inc. (the "Company") complies with applicable data protection laws, including Korea's Personal Information Protection Act. This Privacy Policy (the "Policy") explains how personal information is handled in connection with the For me buds 2 mobile app (the "App") and related services (the "Service").

Summary: How For me buds 2 Handles Your Data

• No sign-up or login. The Company does not require or collect identifying information such as your name, email address, or phone number.
• Sleep and biometric data stay on your device, in principle. Sleep stages, heart rate, movement, and snoring recordings measured by the PPG sensor and accelerometer are processed and stored only on your smartphone and earbuds, and are not sent to the Company's servers. However, if you use the data backup feature, the backup file can be opened with a separate key held by the Company for customer support purposes — see Article 2(7) for details.
• The AI sleep analysis feature also runs entirely on your device. The App's AI Sleep Report and chat feature downloads a publicly available AI model (based on Google Gemma) to your smartphone and runs it directly on-device. The sleep data and conversation content used in the analysis are never sent to the Company's servers. The only thing downloaded from the Company's servers (CDN) is the AI model file itself (approximately 2.6GB).
• We process a minimal set of technical information, described in Article 2 below, to operate and improve the App. This includes error reports, app usage statistics, earbud device information, and information related to delivering sound content, firmware, and the AI model. This information does not include your sleep data or information that directly identifies you, such as your name or contact details.

Article 1 (Information We Do Not Collect)

The Company does not collect the following information:

• Identifying information such as name, email address, phone number, or date of birth (except when you voluntarily send an email to make a customer inquiry — see Article 2(8))
• Account information (no account exists)
• Precise location information (e.g., GPS)
• Personal content on your smartphone, such as contacts or photos

Sleep data (sleep stages, sleep duration, tossing and turning, sleep posture, etc.), biometric data (heart rate and other biometric signals from the PPG sensor, movement data from the accelerometer), snoring recordings, and conversation content generated during AI analysis are processed and stored only on your device to provide the App's features, and are not transmitted to the Company or any other outside party in the course of ordinary use of the Service. However, if you create a backup file of your own data, that backup file will contain the above data in encrypted form, and a structure is in place that allows the Company to open it for customer support purposes — see Article 2(7).

Article 2 (Items and Purposes of Information Processed)

The Company processes the following minimal information to operate the Service.

1. App Error Information (Crash Reports)

• Items: Device model, OS type and version, app version, logs generated at the time of an error/crash (e.g., stack traces), a random installation identifier assigned by Firebase
• Purpose: Diagnosing and fixing app errors, improving app stability
• Method: Automatically collected via Google Firebase Crashlytics
• Characteristics: Not linked to your name or contact information, and does not include sleep or biometric data. Error reports are collected to keep the App running reliably; a separate opt-out feature is not currently available.

2. App Usage Statistics and Performance Information

• Items: Screen views, app launch/session information, device model and OS information, app version, app performance metrics such as network request response times, a random installation identifier assigned by Firebase
• Purpose: Monitoring and improving the App's performance (e.g., load times) reliably
• Method: Automatically collected via Google Firebase Analytics and Firebase Performance Monitoring
• Characteristics: The Company has not configured any custom events to track specific user actions beyond screen views, but the screen view, session, and device information automatically collected by these two tools by default is processed. Not linked to your name or contact information, and does not include sleep or biometric data.

3. Earbud (Device) Information

• Items: Earbud serial number, firmware version
• Purpose: Providing content suited to the connected earbud model/version, and quality management
• Method: Automatically included in ordinary communications sent to the Company's servers while the earbuds are connected, such as sound content lookups (excluded from the AI model download communication described in item 6 below).
• Characteristics: Not linked to identifying information such as your name or contact details, and does not include sleep or biometric data.

4. Information Related to Providing Sound Content

• Items: IP address, request date/time, requested content information, device model and OS information, app version, the earbud device information described in item 3, and other technical information incidental to communication
• Purpose: Providing streaming/download of sleep sounds and other content
• Characteristics: Processed only temporarily during the communication, and not used to build a user profile.

5. Information Related to Firmware Updates

• Items: Device model, current firmware version, IP address
• Purpose: Checking for and delivering earbud firmware updates

6. Information Related to Downloading the AI Sleep Report Model

• Items: IP address, request date/time, and other minimal technical information incidental to the file download
• Purpose: Transmitting the AI model file (approximately 2.6GB) used for on-device AI analysis
• Method: Transmitted via a CDN (content delivery network) operated by the Company
• Characteristics: Processed only temporarily during the download, and device-identifying information — including the earbud device information described in item 3 — is not included in this communication. All AI analysis and chat after the model is downloaded takes place entirely on your device, and that content is never sent to the Company.

7. Data Backup File (For Customer Support Purposes)

• Items: Sleep and biometric data, snoring recordings, and earbud connection/operation records (including the earbud serial number) contained in a backup file (.dbb) you create
• Purpose: To allow the Company to help you recover a backup file at your request, if you lose your password or are otherwise unable to open the file yourself
• Method: In addition to being encrypted with the password you set, the backup file is doubly encrypted so that it can also be opened using a key held only by the Company. Earbud connection/operation records (trace logs) can only be opened using this Company-held key.
• Characteristics: The backup file is created by you and stored only on your own device or in a location of your choosing (e.g., as an email attachment or shared file) — the Company does not collect it proactively. The Company only opens the file with the above key if you send it to customer support and request recovery assistance.

8. Customer Inquiry Information

• Items: The email address and content of inquiries you provide when contacting us, e.g., by email
• Purpose: Responding to inquiries and communicating the results
• Characteristics: Only arises when you voluntarily contact us. If you attach the backup file described in item 7 to an inquiry, that backup file is processed and retained separately from the inquiry content, in accordance with item 7 and Article 3.

The Company does not process information for purposes other than those stated above, and will take the necessary measures required by applicable law if the purpose changes.

Article 3 (Retention and Use Period)

• App error information, app usage statistics and performance information: Retained for up to 26 months from collection, then deleted or retained only as anonymized statistics (based on Google Firebase's standard data retention period)
• Communication records related to content delivery, firmware updates, and AI model downloads (e.g., access logs): Retained for up to 6 months from collection, then deleted
• Customer inquiry information (the inquiry email and its content): Retained for 3 years after the inquiry is resolved, then deleted (to comply with recordkeeping obligations for consumer complaints/dispute handling under laws such as the Act on Consumer Protection in Electronic Commerce)
• Backup files received for customer support purposes (Article 2(7)): Deleted without delay once recovery support is complete, and are not separately retained for 3 years along with inquiry content

Sleep and biometric data stored on your device is not held by the Company unless you create a backup file and send it to us, so no retention period applies to it; you may delete it yourself by clearing app data or uninstalling the App.

Article 4 (Provision to Third Parties)

The Company does not provide the information it processes to third parties, except in the following cases:

• When required by law pursuant to a lawful request from an investigative agency or similar authority
• When necessary to prevent imminent danger to the life or safety of a user or a third party

Article 5 (Outsourcing of Processing and Cross-Border Transfer)

The Company outsources the processing of information as follows to provide the Service, which may involve cross-border transfer of data.

When outsourcing, the Company sets out the matters required by applicable law to ensure information is handled securely, and will disclose any change of recipient through this Policy.

Article 6 (Your Rights and How to Exercise Them)

1. You may control your data at any time as follows:
   • Deleting sleep/biometric data and AI chat records: By uninstalling the App or clearing app data through your operating system's settings menu
   • Deleting the AI model file: Deleted from the device together with app data when you clear app data or uninstall the App
   • Whether to create a backup file, and how to store/share it: Entirely up to you to decide, and you may delete it yourself at any time
2. You may request access, correction, deletion, or suspension of processing of your personal information from the Company. The information the Company ordinarily processes (Article 2(1)–(6)) does not include information that directly identifies you, such as your name or contact details, although it does include identifiers that distinguish one device from another, such as the earbud serial number or the installation identifier assigned by Firebase. If you provide your earbud serial number or similar identifier when requesting access or deletion, the Company will check the records linked to that identifier and take appropriate action. However, because that identifier alone cannot reveal your actual identity (name, contact information, etc.), the Company may not be able to honor requests that otherwise require identity verification, as permitted by applicable law. You may request immediate deletion of a backup file you have sent to customer support (Article 2(7)) once processing is complete. In either case, the Company will explain the reason if it cannot fulfill your request.
3. You may exercise these rights by contacting us in writing, by email, or otherwise, using the contact information in Article 10, and the Company will act on your request without delay.

Article 7 (Children's Personal Information)

This Service is intended for individuals aged 16 or older (see Article 5 of the Terms of Use for details). Separately, and in accordance with applicable law, the Company does not knowingly collect personal information from children under the age of 14, and will delete any such information without delay if it is discovered.

Article 8 (Security Measures)

The Company takes the following measures to secure the information it processes:

• Encryption of data in transit (TLS)
• Minimizing and controlling access privileges
• Using statistical information in anonymized or pseudonymized form
• Managing and supervising outsourcing partners
• Dual encryption of backup files, and separate storage and access control for the decryption key used for customer support: decryption for customer support purposes only occurs when you directly request it

That said, protection of sleep data stored on your device depends on your smartphone's security settings (e.g., screen lock), so we recommend enabling your device's security features.

Article 9 (App Permissions)

The App uses the following permissions to provide the Service. Consent for each permission is requested through an operating system prompt the first time the related feature is used. You may decline optional permissions and still use the rest of the Service.

• Bluetooth (required): Connecting to and receiving data from the earbuds
• Location (required, Android): Required by the operating system to scan for Bluetooth devices; the Company does not collect or store actual location information. iOS does not request this permission.
• Microphone (optional): Recording and analyzing snoring during Deep Sleep care. Recorded audio is stored only on your device and is not sent to any server.
• Notifications (optional): Sleep-related alerts and AI model download progress notifications
• Ignore battery optimization (optional, Android): To prevent measurement from being interrupted in the background during Deep Sleep care
• Storage/media (optional, Android): Saving and sharing sleep data backup files. Depending on the OS version, this permission may not be required.

The App also includes the "display over other apps" permission, but no feature currently uses it.

Article 10 (Data Protection Officer and Contact Information)

• Data Protection Officer: Byungjun Moon
• Address (Korea HQ): 14, Magokjungang 8-ro, Gangseo-gu, Seoul, 07801, Republic of Korea, Sleepwave Inc.
• Address (USA): 880 S Coit Rd #1602, Prosper, TX, 75078, USA
• Phone: +82-2-1551-4024
• Email: contact@dbbeats.com

If you need to report or seek advice about a personal information breach, you may contact the Korea Personal Information Dispute Mediation Committee (1833-6972) or the Korea Internet & Security Agency's privacy infringement report center (118).

Article 11 (Notice to International Users)

Users in the European Economic Area (EEA), the United Kingdom, the United States, and regions outside of Korea may be entitled to additional rights (such as access, deletion, and objection to processing) under local law. The information the Company ordinarily processes (Article 2(1)–(6)) is minimal technical information that does not identify any specific individual; more detailed information is processed only if you choose to use the data backup feature and send a file to customer support (Article 2(7)). To exercise your rights, please contact us using the information in Article 10.

Article 12 (Changes to This Policy)

If this Policy changes, the Company will provide notice within the App starting at least 7 days before the effective date (at least 30 days before, for material changes affecting users), and will update the effective date shown at the top of this Policy.

Article 13 (Order of Precedence Between Languages)

This Policy is written in Korean and may be translated into other languages for your convenience. If a translation differs from the Korean version, or if translations differ from one another, the Korean version shall prevail unless otherwise required by applicable law.

Supplementary Provision

This Policy is effective as of October 6, 2026.