Privacy Policy
For the Rest Recovery Westminster iPhone app.
Last updated: October 19, 2026
Who we are
This app is published for clients of Rest Recovery Westminster, a recovery and wellness studio at 11265 Decatur St, Suite 200, Westminster, CO 80234. Phone: 720-372-8360.
What the app does
The app is for people who are already clients of the studio. You can sign in, see your membership, request an appointment, see your upcoming visits, cancel them, and optionally save a copy of a confirmed visit to your calendar. The app does not create accounts and does not take payments.
Information the app handles
- Email address. You type it in to sign in. It is used to look up your existing client record and to email you a one-time sign-in code.
- Your client details from the studio's booking system. Your name, membership and purchase records, and your appointments already exist in the studio's booking system (WellnessLiving). The app retrieves them to show to you; you do not enter them in the app.
- Appointment requests and cancellations. When you request or cancel a visit, that action is sent to the studio's booking system, the same as if you had called the front desk.
- Technical information. Our servers, hosted by Cloudflare, receive your device's IP address with each request. We use it, and a one-way hash of the email address being signed in, for short-lived counters that limit repeated sign-in attempts.
What the app does not do
- No advertising, no analytics, no crash-reporting service, and no third-party SDKs.
- No tracking across other companies' apps or websites, and no advertising identifier.
- No location, contacts, photos, camera, microphone or health data.
- No reading of your calendar. If you tap "Add to Calendar" on a confirmed visit, iOS shows its own event editor; the event is saved only if you tap Add, and the app cannot see your calendars. That event is a copy: it does not update or disappear if the visit is later changed or cancelled.
- No payment or card information. Nothing is sold in the app.
- We do not sell your personal information or share it for advertising.
Sign-in and security
When you enter your email address, we email you a 6-digit code. It expires after 10 minutes, works once, and is discarded after five wrong attempts. We store only a keyed hash of the code, and the code is not written to our logs.
After you sign in, your device receives a random session token, stored in the iOS Keychain on that device only. Our servers store a keyed hash of the token together with your client ID and email address. A session expires after 90 days without use, and signing out deletes it from our servers and from your device.
Optional Face ID / Touch ID lock: off by default, the setting is stored only on your device, and the app never receives biometric data.
All traffic between the app and our servers uses HTTPS.
How long we keep information on our servers
| What | How long |
|---|---|
| Sign-in code (hashed) | Up to 10 minutes, or until used |
| Sign-in rate-limit counters (hashed email, IP address) | About 15 minutes to 1 hour |
| Session record (client ID, email, created / last-used time) | Until you sign out, or 90 days without use |
| Booking retry record (client ID, request result), used to stop duplicate bookings | 24 hours |
| Error logs (may include visit identifiers and booking-system error details) | Kept by Cloudflare under its standard log retention |
| Your client record, memberships and visits | Held by the studio in WellnessLiving, independently of the app |
Service providers
- WellnessLiving: the studio's booking and membership system, where your client record and appointments live.
- Cloudflare: hosts the app's server and these web pages.
- Resend: delivers the sign-in email; it receives your email address and the message containing the code.
Your account and your data
Your client account is created and held by the studio, not by the app. Signing out only removes access from that device; it does not delete your account. To ask the studio to correct or delete your client account and personal information, call 720-372-8360 or visit the studio. Some records may need to be kept where the law requires it.
Children
The app is intended for existing clients of the studio and is not directed to children under 13.
Changes
If this policy changes, we will update this page and the date above.
Contact
Rest Recovery Westminster
11265 Decatur St, Suite 200
Westminster, CO 80234
720-372-8360