Email practices

The email we send

Last updated: 2026-07-08

Well Rhythm only sends email that you asked for. We never send promotional email. This page discloses exactly what we send, to whom, and how it is handled — including the full text of the actual messages.

1We send only three kinds of email

  • Sign-in codes — sent only when you enter your own email address on the sign-in screen and tap "Send sign-in link". Valid for 15 minutes, one-time use.
  • Account deletion confirmation codes — sent only when you request deletion yourself on our account deletion page. Valid for 10 minutes.
  • Replies to your inquiries — sent only after you contact us first.

What we never send: advertising, promotions, newsletters, or bulk mail. We never send to purchased, rented, or scraped lists.

2Recipients are only addresses you entered yourself

We send only to an address that the person themselves typed in and requested delivery to at that moment. The first email is the verification step — the account is not activated until the code is confirmed — so unwanted recipients cannot be reached. Volume is about one email per sign-in.

3You can always reply

Both our From and Reply-To address is support@well-rhythm.com. You can reply directly to any email we send. We do not use unattended no-reply addresses, and we read every reply.

4If you do not want our email

Because every email is triggered by your own action, there is no subscription to unsubscribe from. However, if you mark our email as spam (a complaint), we stop sending to that address immediately and permanently. Deleting your account removes your address entirely.

5Bounce and complaint handling

Hard bounces and complaints are detected automatically and the address is added to our suppression list at once. Every send is checked against that list beforehand. Soft bounces are suppressed after three occurrences. This runs automatically off Amazon SES notifications, and the account-level suppression list is also enabled.

6Authentication

SPF, DKIM (2048-bit) and DMARC (p=quarantine) are all in place, and we ingest and monitor DMARC aggregate reports so that any spoofing of our domain is detected.

7The exact messages we send

Sign-in code:

Subject: Your WellRhythm sign-in code Thanks for using WellRhythm. You requested to sign in to WellRhythm. You can sign in either way below (valid for 15 minutes, one-time use). ▼ Open in the app (tap) pressurecycle://auth?token=(one-time token) ▼ If the link won't open, copy the sign-in code below and paste it into the app's "Sign-in code" field: -------------------------------- (one-time code) -------------------------------- If you didn't request this, you can safely ignore this email — your account won't be accessed unless the code is used. — WellRhythm

Account deletion confirmation code:

Subject: WellRhythm account deletion code We received a request to delete a WellRhythm account associated with this email. Enter the confirmation code below on the deletion page (valid for 10 minutes): -------------------------------- (confirmation code) -------------------------------- Nothing is deleted just by receiving this email. After you confirm, our team verifies the request and deletion is scheduled 14 days later, so it can be stopped if it was a mistake. If you didn't request this, you can safely ignore this email. — WellRhythm