プライバシーポリシー

Who we are

WakeSharp is published by KineticBit Inc., a small independent studio. For anything in this policy, write to support@wakesharp.app. For data-protection purposes, that is also the controller for the limited processing described below.

What WakeSharp does not do

• It does not require an account, except for group alarms. Sign-in supports backup, restoration, purchase continuity and group alarms.
• It does not collect your phone number or contacts. It holds your name only if you create the optional account: the first name your sign-in provider shares, or the name you give the Lark to call you by. The Lark greets you by it, and our emails and notifications use it. Your email address is held if you create the optional account, because your sign-in provider discloses it (Apple can hide it behind a relay address), or if you enter it in a support form.
• It does not collect a location route. On iPhone, optional weather uses a chosen city or a location fix rounded to two decimal places before transmission. Approximate location inferred from IP addresses is described below.
• Marketing measurement connects campaign interactions to app opens and subscription outcomes using AppsFlyer. Advertising identifiers are used only when available and permitted by your privacy choices. On iPhone, from version 2.10, the advertising identifier is read only after you allow tracking through Apple's prompt; before that version, and after a refusal, it is not read at all.
• We do not sell customer lists. Advertising and measurement may involve sharing with the providers and enabled advertising partners described below; regional privacy choices apply to that processing.

What stays on your device

Your morning data is written to a local database on your phone (SwiftData on iOS, Room on Android). The following data stays local unless you create the optional account and cloud backup described next:

• Your alarms, their times, repeat days and settings.
• Your calendar-alarm rules and the wake times computed from them.
• A journal of alarms scheduled, fired, snoozed, missed or silenced by a completed mission.
• Your mission results, personal baseline, daily Sharpness scores, streaks and freeze tokens.
• Your app preferences.

On Android the app declares android:allowBackup="false", so this data is not copied into Android's cloud backup. Deleting the app removes all of it. The only copy that can exist anywhere else is the one you create yourself with the optional account, described next.

The optional account and cloud backup

You can sign in with Apple or Google (those are the only options; there is no email-and-password login) to back up your WakeSharp data and restore it on a new phone. This is entirely optional, off by default, and alarms never depend on it: backup runs quietly after your data changes and can fail or be offline without affecting anything you rely on at 6am.

If you create an account, this is stored in your private backup:

• Your sign-in identity: a random account ID, the email your provider discloses (with Sign in with Apple you can hide your real address behind Apple's relay), and your first name, as described under Emails and notifications.
• Your alarms and settings: times, repeat days, labels, missions, snooze rules, calendar-alarm rules, shift rotations and the group a group alarm belongs to, and your app preferences, including badge reminders and your answers to the onboarding questions that pick your missions.
• Your progress: daily Sharpness scores, streak and freeze tokens, badges, game results and personal baselines, a record of each morning your alarms rang and how it ended, your recent missions and wake-up times, and the journal of past alarms (only completed history; never diagnostics about your device, and never the calendar event a calendar alarm woke you for).
• Your Lark: its stage, the items it has found, its outfit and decorations, and the name you asked it to call you by. That name is personal information: it is stored in your backup, linked to your account, and deleted with it.
• Your profile photo, if you add one: a small copy, 256 pixels on its longest side.
• Your mission references: the small thumbnail and on-device fingerprint of a spot or photo target you enrolled. The full photographs are never stored, on your device or in the cloud.

Deliberately not in the backup: your calendar events (calendar-alarm rules are backed up, the events they read are not), camera frames, step counts, your finger-signature, and device diagnostics.

The backup is hosted for us by Supabase, Inc. on infrastructure in theUnited States, as our processor under their data processing terms, including standard contractual clauses where required for transfers from the UK or the EEA. Every row is protected by database-level rules that make it readable by your account and no other. Supabase's privacy policy is at supabase.com/privacy.

Your random account ID can also become your RevenueCat customer ID, linking purchase and measurement records across your devices. Your email address is used for the emails described underEmails and notifications, which Resend delivers. Your email is not sent by WakeSharp to PostHog or AppsFlyer as a marketing attribute. Signing out keeps your local data and stops account backups. Deleting the account (in the app at Settings → Account → Delete account, or as described at wakesharp.app/account/delete) permanently removes the backup and the login itself (for Sign in with Apple, the sign-in token is revoked with Apple), while the data on your phone is kept.

Calendar access: optional, read-only, and it never leaves your phone

WakeSharp can wake you a set number of minutes before your first meeting. To do that it needs to read your calendar. This is how that works:

• It is entirely optional. Decline it and every other feature still works. You just set your alarm times yourself.
• Access is read-only. WakeSharp never creates, edits or deletes an event.
• Events are read on your device, and used for one purpose: to compute the time your alarm should ring.
• Event titles, attendees, locations, notes and times are never transmitted to us or to anyone else. They are not written to any server, and they are not included in any diagnostic report.
• You can revoke calendar access at any time in your phone's system settings. The calendar alarm stops adjusting; nothing else changes.

Optional weather on iPhone

From version 2.14, you can choose a city manually or allow location access to show local weather. Location permission is optional; declining it does not affect alarms, and you can use a chosen city instead. When using your location, WakeSharp requests an approximate fix and rounds latitude and longitude to two decimal places on your device before making the weather request. A chosen city uses that city's coordinates instead.

These rounded coordinates are sent to WakeSharp's weather service, hosted through Supabase, which requests the forecast from Apple Weather. Network providers also receive the IP address associated with the request. Weather location is not included in product analytics, advertising measurement, or your account backup. City and weather preferences are stored locally. You can turn weather off in the app and revoke location permission in iOS Settings. Apple's privacy policy is at apple.com/legal/privacy.

Permissions, and why each one exists

On iPhone, WakeSharp asks for:

• Alarms: so the alarm can ring loudly and reliably through Silent mode and Focus, using Apple's system alarm framework.
• Calendar: optional, read-only, for calendar alarms only.
• Location: optional on iPhone for local weather. A manually selected city works without location permission. Coordinates are rounded before transmission, as described above.
• Camera: optional, only for an alarm you have set to Scan an Object, Fetch, Photo Proof, First Light, Face Check or Fruit Slash, when you enrol a target and while that mission runs. Face Check and Fruit Slash use the front camera. See the next section.
• Motion & Fitness: optional, only for an alarm you have set to a walking mission, to count the steps it asks for. See the next section.
• Microphone and Speech Recognition: optional on iPhone for spoken missions such as Name Five. Recognition is restricted to on-device processing. Audio buffers and transcripts are used only to check your answer, then discarded; they are not recorded to a file, logged, backed up or uploaded. If on-device recognition is unavailable or permission is declined, the mission offers a fallback.
• Notifications: for the optional pre-bed wind-down reminder, the reliability warning that rides with it, the report shown when an alarm did not ring, and the setup reminders, trial reminder, alarm notices and messages from our server described under Emails and notifications.
• Tracking: optional, from version 2.10, to measure which advert or link brought you to WakeSharp and whether it led to a trial or a subscription. It is never used to show you adverts inside WakeSharp, because there are none. Declining does not prevent alarm use or purchasing a plan.

On Android, the app's permissions include:

• INTERNET: for the subscription and analytics services described below. No alarm needs it.
• com.google.android.gms.permission.AD_ID: for permitted advertising and attribution. Deleting or restricting your advertising ID does not prevent purchasing a plan.
• USE_EXACT_ALARM: to schedule an alarm that fires at the exact minute you asked for.
• SCHEDULE_EXACT_ALARM: the same thing on Android 12 and 12L only, which predate the permission above. It is dropped from the build on Android 13 and later.
• USE_FULL_SCREEN_INTENT: to show the ringing screen over the lock screen.
• POST_NOTIFICATIONS: for the ring notification, the optional bedtime reminder, the missed-alarm report, and the setup reminders, trial reminder and alarm notices described under Emails and notifications.
• FOREGROUND_SERVICE and FOREGROUND_SERVICE_MEDIA_PLAYBACK: to keep the alarm tone playing while the alarm is ringing.
• RECEIVE_BOOT_COMPLETED: to restore your alarms after a restart, because Android discards scheduled alarms on reboot.
• READ_CALENDAR: optional, read-only, for calendar alarms only.
• CAMERA: optional, for the Scan an Object, Fetch, Photo Proof, First Light, Face Check and Fruit Slash missions only. The last two use the front camera. See the next section.
• ACTIVITY_RECOGNITION: optional, for walking missions only. See the next section.
• WAKE_LOCK and VIBRATE: to wake the screen and vibrate while ringing.

The camera, its autofocus and the step counter are all declared not required, so WakeSharp still installs on a phone that has none of them. The missions that need them simply are not offered there.

The camera and your physical activity

Seven of the missions read a sensor. All of them are optional, all of them ask for permission when you set the alarm rather than at 6am, and sensor processing happens on your device. Live camera frames and step counts are not uploaded; enrolled reference thumbnails may be backed up with an optional account. Two of them, Face Check and Fruit Slash, use the front camera, which is a different thing to agree to, so they are described on their own below.

• The Scan an Object mission asks you to point the camera at one of a fixed list of everyday objects. Recognition runs entirely on your device: Apple's Vision framework on iPhone, a small model bundled with the app on Android. Frames are analysed in memory and discarded. Nothing is photographed, written to storage, added to your photo library, or transmitted to us or to anyone else. Only the names of the objects an alarm asks for are saved, on your phone, like any other alarm setting.
• The Photo Proof mission asks for one photograph. If you have enrolled a target for that alarm it asks you to retake it; otherwise it asks for the day's rotating prompt: the sky, your bed made, a glass of water, the view out a window, your kitchen counter or your front door, one prompt per morning and the same one for everyone. The photographs are not stored. Enrolling keeps a feature print, a few kilobytes of numbers that can be compared but never looked at, plus a small thumbnail for the picker row, and discards the frame itself. The morning's retake is judged against that print on your device: Apple's Vision framework on iPhone, a small bundled model on Android, held in memory for the comparison and then discarded. The morning retake is not written to your photo library or transmitted. The enrolled print and thumbnail are the mission referencesincluded in your private cloud backup if you create an optional account. Full camera frames are not backed up.
• The Fetch mission works the same way as Scan an Object, from a different pool: it names something to go and find (something blue, something you drink from) and checks it with the same on-device recognition. Frames are analysed in memory and discarded.
• The First Light mission uses the camera as a light meter. It reads how bright the scene is, nothing else: no frame is recognised, kept, written to storage or transmitted, and the only thing the mission learns is a number.
• The Face Check mission points the front camera at your own face and asks you to open your eyes, then to turn your head or lean in. It asks whether a face is present and awake, never whose. No face template is built, no frame is kept, and nothing is uploaded. The analysis runs entirely on your device (Apple's Vision framework on iPhone, a bundled model on Android), each frame is held in memory only long enough to be measured and is then discarded, and WakeSharp cannot recognise you or tell one person from another. Nothing about your face is written to storage or included in a backup. The mission records only that it was completed, the same as every other mission.
• The Fruit Slash mission also uses the front camera, pointed at yourhand rather than your face: it tracks a fingertip so you can slice at what is on screen. Hand tracking runs on your device, frames are discarded as they are measured, and nothing is photographed, stored or transmitted. If the room is too dark to see a hand, the mission says so and moves to slicing on the glass instead.
• The Walk It Off mission reads your device's own step counter, and only while that mission is running, to check that the steps it asked for actually happened. It is a count, not a route: this mission never requests your location.
• Decline any of these permissions and nothing breaks. The mission falls back to Math Problems at full credit, rather than leaving you with an alarm you cannot silence.

Purchases and WakeSharp Unlimited

WakeSharp is sold as a subscription, WakeSharp Unlimited. Trials and introductory offers can vary with the paywall shown to you, and your paywall displays the current price, trial terms and renewal period before purchase. Lifetime, a one-time purchase that does not renew, is no longer sold, and existing Lifetime purchases stay valid. Marketing measurement uses the same privacy controls regardless of which paywall is displayed.

If you buy it, the purchase itself is handled entirely by Apple or Google. We never see your card, your billing address, or your Apple or Google account details.

To know whether WakeSharp Unlimited is unlocked, WakeSharp uses RevenueCat, Inc., a subscription-management service. When you open the paywall or restore a purchase, the RevenueCat SDK sends:

RevenueCat processes this in the United States, as our processor and under their data processing terms, including standard contractual clauses where they are required for transfers from the UK or the EEA. Their own privacy policy is at revenuecat.com/privacy.

RevenueCat provides customer purchase histories and aggregate subscription reports. It forwards verified trial, purchase, renewal, cancellation, expiration and refund events to PostHog and, when an eligible AppsFlyer identifier is available, to AppsFlyer. Delivery can continue while the app is closed. Cancelling a subscription is different from receiving a refund. Payment card details are not included.

RevenueCat also sends its verified subscription events (including plan changes, billing problems and transfers of a purchase between customer IDs) to a private part of our own database, hosted for us by Supabase in the United States under the same terms as the backup, so that our own services know when a trial was cancelled or a plan renewed while the app is closed, and so we can measure subscription outcomes by paywall. Each event holds its type and time, the store, product and plan, trial and renewal state and dates, the price, currency and country RevenueCat reports, the store's reason for a cancellation or expiry, which paywall was shown, and your RevenueCat customer IDs. From them we keep one summary of each RevenueCat customer's current subscription state. These records are linked to your account when one of those customer IDs is your random account ID. They hold no card details, receipts, name or email address, and nothing in the app can read them.

Usage analytics and session replay (PostHog)

WakeSharp uses PostHog, Inc., a product-analytics service, to understand how the app is used: which screens people visit, where onboarding is abandoned, whether the paywall is confusing. Records use pseudonymous identifiers and can be joined to subscription and campaign measurement:

What a session recording does and does not show. A recording is a series of screenshots of WakeSharp's own interface, so we can see the screens you moved through, the buttons and prices you were shown, and where you tapped. Before any frame leaves your device, these are blanked out:

• the camera viewfinder in the photo and scan missions;
• the photos you take to complete a mission, and the reference photos you save;
• anything you typed or named yourself: alarm labels, activity names, profile names, rotation and shift names, the names you give scanned spots and photo references, the name you enter for a group alarm, your alarm search text, and what you write in a support form or in the note when you cancel;
• your email address, and the whole Account screen where it appears;
• the titles of your calendar events, everywhere they appear;
• your invite code, and any code you type, paste or receive from an invite link.

One exception: on iPhone, the profile menu in the alarm editor is drawn by iOS rather than by WakeSharp and cannot be blanked, so the profile names it lists can appear in a recording while that menu is open.

Fields the operating system marks as a password or as sensitive autofill are blanked automatically as well; in practice WakeSharp has no password field at all, because signing in uses Apple or Google and happens on their screens rather than ours. Recordings are deleted after 30 days.

If you would rather send none of this, turn it off in Settings → Privacy → Product analytics in the app. Everything else works exactly the same with it off.

PostHog processes this in the United States, as our processor and under their data processing agreement, including standard contractual clauses where required for transfers from the UK or the EEA. Their privacy policy is at posthog.com/privacy.

We use PostHog to analyze product behavior, subscription outcomes and campaign performance. Session recordings are for diagnosing product problems. We do not send the recordings to advertising partners.

Marketing measurement (AppsFlyer)

AppsFlyer helps us understand which campaigns lead to a first app open, trial or payment. It receives app and SDK identifiers, permitted advertising identifiers, device and network information including IP-derived approximate location, campaign and deep-link context, and selected app events: a paywall view, the end of setup, and the first and third mornings you complete a mission. RevenueCat sends verified subscription events associated with the AppsFlyer ID. AppsFlyer counts first opens; a store download that is never opened is a separate measure.

Enabled advertising partners may receive conversion information under the applicable consent and platform restrictions. Apple's aggregate attribution can provide limited campaign results without an advertising identifier. AppsFlyer's processing is described in its services privacy policy. We do not send alarm content, calendar events, camera frames, contact lists or payment card details to AppsFlyer.

The optional source question records where you say you heard about WakeSharp: TikTok, Instagram, YouTube, the App Store, a friend or family member, Google search, or somewhere else. Your answer is stored on your device and attached to PostHog and RevenueCat measurement. It does not change your price or grant rewards, and it does not replace AppsFlyer's attributed campaign. Skipping it never prevents setup. Earlier versions of the app also offered an optional creator-code field; a code entered there was checked against a public, read-only creator catalog hosted by Supabase and stored the same way.

Turn off Settings → Privacy → Product analytics to stop new PostHog and AppsFlyer collection from the app and clear the RevenueCat attribution identifiers used for future AppsFlyer delivery. This does not erase already delivered events or cancel billing; essential purchase validation continues. Updates made offline take effect on connected services after synchronization. You can also change Apple's tracking permission in iOS Settings and reopen the regional privacy form in WakeSharp Settings.

Advertising

WakeSharp shows no ads. Earlier versions could show banners supplied by Google AdMob on a free tier; that tier and the ad SDK were both removed in September 2026, and nothing in the app requests, loads or displays an advert. This section is about the other direction: we buy ads elsewhere, and we measure whether they work.

• What we measure. When an advert or a link brings someone to the App Store or Google Play and they install WakeSharp, our measurement provider AppsFlyer reports which campaign that install came from, and whether it later led to a trial or a subscription. That is the whole purpose: to spend less on adverts that do not work.
• What an advertising network receives. Where a network is enabled, it can receive the fact of an install and of those subscription events, with the identifiers your privacy choices permit. It never receives your alarms, your missions, your calendar, your camera frames, your Sharpness scores or anything you typed into the app.
• On iPhone, from version 2.10. Early in setup, WakeSharp explains what this measures and then iOS asks you to allow or refuse tracking. Refuse, and the advertising identifier is never read and advertising networks receive only aggregated campaign results. Either answer continues setup, and nothing about the app, its price or its features depends on your choice. You can change it at any time in Settings, Privacy & Security, Tracking. Versions before 2.10 do not ask, and do not read the identifier.
• On Android, the advertising ID is used for the same measurement where your regional privacy choices permit it. Deleting or restricting it does not prevent using or buying anything.
• In the EEA, the UK and Switzerland, and in the US states with their own privacy laws, a consent form appears before that measurement begins and records your choice. You can reopen it at any time from Settings → Privacy → Privacy options inside the app. If you refuse there, iPhone does not additionally ask you about tracking.

Your setup answers

When you first set up WakeSharp it asks a handful of questions (how many alarms you set, whether you turn the alarm off and go back to sleep, how long it takes you to feel awake, how you feel right after waking) and records the choices you make on the way to your first alarm: wake time, bedtime, mission, difficulty, sound, wallpaper, and whether you allowed alarms. These answers reach our analytics service as part of the usage events described above. On iPhone and Android they are also stored in a small table of our own, hosted for us by Supabase in the United States under the same terms as the backup.

• Each row is keyed by a random ID created on your device for our own records: these answers and the installation record described under Emails and notifications. It is not the analytics ID, not the subscription ID, and not anything derived from your name, email or device.
• It holds only answers from that fixed list of setup questions, sent through a write-only channel that accepts nothing else. Never the content of your alarms, your calendar, or anything you typed.
• Why we keep our own copy: so that if you later create the optional account, your first-day answers can be connected to it, and we can learn how the way people start relates to what they go on to do. Until you sign in (and most people never do) the row is linked to no account, only to that installation's record, and nothing in the app can read it back.
• To keep out automated fake installs, the channel counts new installs per network using keyed hashes of the network address, never the address itself. These counters are deleted within two days.
• Rows are deleted 180 days after the last answer. Deleting the optional account deletes them at once. Turning off Settings → Privacy → Product analytics in the app stops them being sent at all.

Inviting friends

From version 2.16 you can invite friends to WakeSharp with a personal code. When a friend you invited starts a free trial or a paid plan of WakeSharp Unlimited, an extra mission unlocks in your app, permanently. The friend gets nothing for using your code and pays the normal price. Inviting is optional: none of the data below exists unless you open the invite screen, follow an invite link or enter a code. On Android, installing WakeSharp from the Google Play button on an invite page counts as following the link: Google Play hands the code to the app, which applies it the first time you open WakeSharp. Sharing uses your phone's own share sheet, and WakeSharp never reads your contacts or, unless you tap Paste, your clipboard. To know whether invites are available, the app also asks the service every few hours; that request names only your platform.

Our invite service stores only this, in its own private section of our database:

• An anonymous installation key. Your phone creates a random key pair for this installation of WakeSharp and registers the public half, an identifier derived from it, your platform, app version, the time WakeSharp first recorded being opened on this installation, whether this is a new installation (one with no alarms or settings yet) and, where your phone's region setting provides it, a two-letter country code. The service also keeps a keyed hash of a random secret it gives your phone to sign its later requests, and when the record was created and last used. None of this is your account, your email address, your advertising ID or your RevenueCat ID, and a reinstall creates a new key. To keep out automated fake installs, Apple's App Attest or Google Play Integrity confirms that the request comes from a genuine copy of WakeSharp on a genuine phone. On Android, Play Integrity also checks that the app came from Google Play and that the phone is not asking for these checks unusually often, and Google decodes that verdict for us. The invite records keep a hash of the App Attest key's identifier, never the attestation itself or Google's verdict. Our verification service, also hosted by Supabase, keeps that App Attest key's identifier, public half and counter, a hash of your installation's public key, and when the key was created and last used, for a year after the key's last use so that it cannot be replayed. Deleting your invite records does not remove them.
• Your invite code, and who claimed it. Your ten-character code and when it was created, and, when a friend uses it by entering it or by following your invite link, a record that their installation claimed your code and when. A code can only be used on a new installation of WakeSharp, within 24 hours of first opening it.
• Whether an invited friend started a plan. If you used a friend's code and start a free trial or a paid plan on this installation, in either order, your phone tells the service. It tries again until the report gets through, and only the first report counts. A plan bought before you used a code waits on your phone, during your first 24 hours only, until a code is accepted. We record when the report arrived, whether it was a trial or a paid plan, which store it came from, and whether it was a real or a test purchase. The purchase date is checked, so that restoring an older purchase does not count, and is not stored. To stop one purchase counting twice, your phone turns the store's transaction ID, when the store provides one, into a one-way hash before sending it, and we keep only a keyed hash of that. The plan's product identifier is checked to be a WakeSharp plan and is not stored. We never receive the transaction ID itself, the price, your receipt or your RevenueCat ID.
• The unlock. Which mission your invite unlocked, when, and which of your invites unlocked it.
• Security records. A log of registrations, claims, conversions, unlocks and deletions for investigating abuse. Each entry holds the time, the anonymous record numbers involved, what happened and, for a started plan, whether it was a trial or a paid plan, the store, and whether it was a real or a test purchase. Also: single-use request numbers and registration challenges, which expire after ten minutes and are deleted within a day; the verification service's note of each challenge it checked, kept for two days; and per-network rate-limit counters, keyed by a hash of your network address rather than the address itself and deleted within three days.

What the person who invited you sees. In their app, a list of their invites showing, for each one, that someone joined with their code and whether that person has started WakeSharp Unlimited. Until an invite unlocks the mission, they also see how many friends who joined have not started a plan yet; a friend whose invite record has been deleted no longer counts there. They never see your name, account or device, or whether you started with a free trial or a paid plan. Because they know whom they sent the invite to, they may be able to guess which entry is you.

The invite service does not share its records with anyone, and they are not used for advertising. Two things do reach our measurement and analytics services, and only while Settings → Privacy → Product analytics is on. AppsFlyer learns that the app was opened from an invite link, without the code; and on Android, an install from an invite page's Google Play button carries the code and an invite campaign tag in Google Play's install details, which AppsFlyer reads. The app also reports usage events such as an invite code being copied or applied, a friend's plan being reported (with whether it was a trial or a paid plan) or a mission unlocking, as described under usage analytics above. These events never include a code, and invite codes are blanked out of session recordings. We rely on our legitimate interest in running a feature you chose to use and in preventing its abuse.

The service runs on Vercel, Inc. and its database is hosted by Supabase, Inc., in the United States, as our processors, including standard contractual clauses where required for transfers from the UK or the EEA. Their privacy policies are at vercel.com/legal/privacy-policy and supabase.com/privacy.

How long it is kept. An installation's record is deleted 180 days after it was last used, whether by the app or by a friend using its code or starting a plan. Two things outlive that, so that an invite that worked stays worked: a record that has unlocked a mission is kept with no time limit, until you ask us to delete it; and when an invited friend's record is deleted, the claim and the record of any plan it led to, including the purchase's keyed hash, stay with the inviter's record, no longer linked to the friend's installation. The security log is kept for 180 days.

Deleting it. When an installation's invite record is deleted, its keys are replaced with random values so it can never be linked to the device again, its code stops working, and its purchase hash is erased; the anonymized record is removed 180 days later. Any mission your own invites unlocked is removed from your record. The fact that your claim was used, and the mission it unlocked for the person who invited you, stay: they earned it before you asked to leave. Uninstalling WakeSharp means your phone can never use the record again, although your code keeps working for friends; the record is then removed 180 days after its last use, unless it has unlocked a mission, in which case it is kept until you ask us to delete it. There is no delete control in the app yet. Because the record is not linked to your name, email or account, email us if you want it deleted and we will explain how to identify your installation.

Group alarms

A group alarm (iPhone, from version 2.24; not yet in the Google Play version) rings at the same time on every member's phone and lets the group see who is up. It is the one feature that needs the optional account: you sign in before creating or joining one, so that the people you wake with can see your status. Everything else in this policy about the account applies to it.

When you create or join a group, this is stored in a small set of tables of our own, hosted for us by Supabase in the United States under the same terms as the backup:

• The group: the name the organizer gave it, the alarm's time, repeat days, mission, difficulty and, for Squats or Push-ups, the rep count, an invite code, and when it was created and last changed.
• Each member: the display name you typed when you created or joined the group, whether you are the organizer, when you joined, and a random key that stands for you within that group.
• Each morning: one record per member and day holding the day, when your alarm rang, when you finished the mission, how many times you snoozed, and your status: asleep, snoozed or up. Your phone sends these as the morning unfolds, and they are what the other members see.

The other members of a group see your display name and your morning status, and nothing else: not your account ID, your email address or anything from your backup. Database rules let only a group's members read its rows, and the columns that identify your account are never readable by another member; the app tells members apart by the random per-group key. Anyone who has the invite link can join the group until the organizer removes a member or makes a new link, which retires the old one. While a group's screen is open, the app keeps a live connection to the database so the status line updates as people get up. Group alarms send no push notifications.

The invite link carries the invite code and, optionally, the alarm's time and repeat days in the part of the link after the #, which browsers never send to a server, ours included. It never carries a name. The link opens the app on an iPhone that has it, and otherwise a page on this site that only reads the code and shows the schedule; the page asks nothing of our database.

If you create or join a group alarm, we keep a record that you have been in a group, who organized the group when you joined it, and whether your first morning together earned a reward. To decide that, we compare the times your group's alarms rang and were finished, check that you are new to WakeSharp using your account, morning, setup-answer and subscription dates, and check that the two accounts do not belong to the same person using your subscription record. To keep one household from earning the reward repeatedly, we keep a keyed hash of the network each "I'm up" post came from for about 14 days at most. It is not your IP address. If you delete your account, these records are deleted, and the other person keeps any reward they earned with no link back to you.

Each morning's record is deleted after 14 days. A group that has had a single member and no change for 30 days is deleted. Leaving a group removes your membership at once, and when the last member leaves, the group is deleted; if the organizer leaves, the earliest remaining member becomes the organizer. Deleting the optional account removes every membership and morning record of yours, and hands over or deletes the groups you organized, before the account itself goes. SeeHow long data is kept.

Why you cancelled

From version 2.22 on iPhone and 2.17 on Android, WakeSharp asks why when you tap Cancel subscription in the app. If it notices that you turned off renewal in your App Store or Google Play settings instead, it may ask once on a later open, at most once per billing period. You pick one of six reasons and can add a note of your own; if the reason is cost, you may be offered a discounted yearly plan. Answering is optional: the question always offers Skip or Not now, which sends nothing. Apart from the discounted plan you may be offered when you choose cost, and, during a free trial, the app no longer showing you its other reminders of that offer once you turn it down, nothing about your subscription, your price or the app depends on whether or how you answer.

When you pick a reason, the app sends your answer to a small table of our own, hosted for us by Supabase in the United States under the same terms as the backup, and updates the same answer if you then add a note or respond to the offer. The app can only add to this table, never read from it; only we can read it. Each answer holds:

• the reason you picked, from the six on screen, and your note if you write one (up to 2,000 characters);
• what happened to the discounted plan if it was offered: shown, accepted, still waiting for the store, declined, or failed;
• which screen asked (the cancel button or the renewal check), your platform, app version and language;
• your subscription's store and plan, whether it is in a free trial or introductory period, and whether it was set to renew;
• your RevenueCat customer ID: the generated app user ID before you sign in, or your random account ID once you are signed in;
• a random ID for this one answer, and when it was sent and last updated.

So your answer is linked to you: to your account if you are signed in, and otherwise to your RevenueCat customer ID, which RevenueCat and our own copy of your purchase records connect to your account if you sign in later. When you finish, the app also emails a copy (the reason, your note, what happened to the offer, which screen asked, your platform and language, and the same random answer ID, but not your customer ID) to our support mailbox through Resend, as described underSupport and feedback messages.

We use the answers to learn why people cancel, what to fix, and whether the offer helps; we rely on our legitimate interest in understanding why people leave and improving the app. Our analytics service receives which reason you picked, which screen asked and what happened to the offer, never your note, and the note box is blanked out of session recordings. Please do not put personal details, such as your name, email address or phone number, in the note.

How long it is kept. Your note is erased 180 days after you answered, and the rest of the answer is deleted after 365 days. Deleting the optional account in the app deletes at once every answer linked to it, together with the answers that phone sent before you signed in, as long as the app on it still remembers the customer IDs they were sent with (it keeps up to 16, and forgets them if the app is reinstalled). For any other answers sent while not signed in, email us. The email copy is not deleted with the account or on that schedule: it stays in our support mailbox like any other support message, and Resend keeps delivery data under its own policy. To keep out automated abuse, we also count new answers per network using keyed hashes of the network address, never the address itself, and those counters are deleted within two hours.

Because sending an answer is your choice each time, turning off Settings → Privacy → Product analytics does not stop it. That switch does stop the analytics event; to send nothing at all, choose Skip or Not now.

Emails and notifications

WakeSharp can reach you outside the app in two ways: by email, if you created the optional account (we write to the address your sign-in provider shared), and by notifications on your phone, if you allowed them. Messages come in two kinds:

• Service messages are about your own subscription: a payment that did not go through, a free trial or plan that is ending after you turned off renewal, and a notice shortly before a free trial turns into a paid plan, with the date and how to cancel. They need no consent, because they are part of the service you bought, and they stop once the payment goes through or the plan has ended.
• Offer messages are the Lark's: an offer to come back after you cancel a trial or a plan, a reminder that your plan is waiting if you signed up but never started one, and a check-in when you have not set an alarm for a while. An offer can include a discount; the app shows the real price before you buy.

Your choice for offer emails. Where you sign in, and in Settings → Emails from Lark, a switch reads "Email me tips and offers from Lark". If your App Store or Google Play account is in the European Union or the rest of the EEA, the United Kingdom, Switzerland, Canada or Australia, or we cannot tell its country, the switch starts off and you get offer emails only if you turn it on. Everywhere else it starts on, with the notice "Lark may email you now and then. Unsubscribe any time." An account created before the switch existed is treated by the same rule: outside those countries it may receive offer emails, which this policy announces, and inside them it receives none until you turn the switch on. We record your choice, when and where in the app you made it, the wording you saw, and your store country.

Notifications. On iPhone, WakeSharp can also receive notifications from our server. Service notifications, such as a payment that did not go through, need only your permission for notifications. Offer notifications also need the agreement to offers you gave when you allowed notifications during setup, and stop when you turn off Setup reminders and offers in WakeSharp's Settings. Android does not receive notifications from our server yet. These reminders are scheduled by the app itself, on both platforms, and need no server:

• Setup reminders: if you allowed notifications during setup but did not finish it, a morning reminder on days 1 to 7, 10 and 14, a quarter of an hour after the wake time you chose (or at 08:00). The one on day 7 can carry an offer for the yearly plan, only if you agreed to offers when you allowed notifications. They stop when you finish setup or buy a plan, and the reminder's Stop button or the Setup reminders and offers switch in Settings turns them off.
• The trial reminder: one notification about two days before a free trial turns into a paid plan, withdrawn if you cancel first.
• Alarm notices: when your access is ending, a notification the evening before your last alarm, and another when your alarms are off, saying how to fix a payment or subscribe to turn them back on.

Your name. When you sign in, WakeSharp keeps the first name your Apple or Google account shares (Apple shares a name only the first time you sign in with it, and only if you allow it), or the name you type when the Lark asks what to call you. It is stored with your account. The Lark greets you by it in the app, and our emails and notifications use it. You can change or clear it in Settings → Account → Your name; without a name, messages simply leave it out.

What your phone tells our server. So that a message reaches the right phone at a sensible hour and stops when it no longer applies, the app keeps a small record of each installation on our server, hosted by Supabase in the United States under the same terms as the backup. It holds a random installation ID (the one your setup answers use), your RevenueCat customer ID, your platform and app version, on iPhone the push token Apple issues for notifications, whether notifications are allowed and whether you agreed to offers (and under which wording), the app's language, your time zone, the country of your App Store or Google Play account, your wake time, how far you got in setup, whether an alarm is set (and since when none has been), whether you subscribe, your account ID while you are signed in, and when the app last reported. It holds no name and no email address. To keep out automated fake installs, new records are counted per network using keyed hashes of the network address, never the address itself, and these counters are deleted within two days.

Who delivers them. Emails are sent by Resend, Inc., in the United States, as our processor. For each email it receives your address and the message, which can include your first name, the date your trial or plan ends and, in a trial summary, your mornings and streak, and it tells us whether the email was delivered, bounced or reported as spam. A bounce or a spam report stops further email to that address, and so does turning off forwarding for an Apple private relay address in your Apple account. Before sending anything, our server asks RevenueCat for your current subscription, so that nothing goes out that no longer applies. Notifications to an iPhone go through the Apple Push Notification service, which receives the push token and the notification's text. Your email address and your push token are not sent to PostHog or AppsFlyer. Resend's privacy policy is atresend.com/legal/privacy-policy.

Links in these messages open the app, or a page on this site that hands the link to the app, and they say which message they came from: the kind of message, which one in its series, email or notification, and a random message ID. When you open one, the app's usage analytics record the first three, never the message ID or your address, and the page on this site records none of them.

Stopping them. Every email ends with an unsubscribe or email preferences link that opens wakesharp.app/unsubscribe, a page that shows whether you get offer emails and turns them off, or back on, with one tap. The page sends our server only the random code in the link, which stands for your email choice, and it has no analytics. Mail apps that show their own unsubscribe button next to our emails use the standard one-click unsubscribe, which turns offer emails off at once. Settings → Emails from Lark turns them off and on as well. Service emails keep coming while a payment or the end of your plan needs your attention. To stop notifications, turn them off for WakeSharp in your phone's settings, or turn off Setup reminders and offers to stop only the offers.

We rely on our contract with you for service messages; on your consent for offer emails in the countries named above and wherever you turned the switch on yourself; and elsewhere on our legitimate interest in telling customers about our own app, with a way out in every offer email.

How long it is kept. The log of messages (which message, by email or notification, to which account, installation or RevenueCat customer ID, when, and whether it was sent) is kept for 400 days. An installation's record is deleted 400 days after the app last reported. Deleting the optional account deletes your email choices and the log of messages sent to it at once, and unlinks your installations' records from it.

AI features

Some Lark features, called Lark AI in the app, can use Claude, an AI made byAnthropic. They areoff unless you turn them on. The app asks once, and you can change your answer any time in Settings under Lark AI. Your answer is kept on your phone only, so a restored backup or a new phone asks again. With them off, nothing goes to Anthropic and the Lark uses its own scripts and templates. Screens written by Lark AI say so, and the Lark says it is an AI if you ask.

Here is what each feature sends when it is on:

• Ask the Lark (help with the app): what you type and, when the Lark needs them, the last 14 days of your mornings (when the alarm rang, how long you took, snoozes, the mission and how it ended), your alarms' times, days and missions, and the status of the app's reliability checks.
• Your trial letter, weekly report and morning briefing: numbers your phone works out, such as mornings finished, your fastest finish, snoozes, your streak and your Sharpness trend, and the names of missions and badges.
• Talking to the Lark: what you type, up to your last eight messages each time, the notes you kept in its notebook, and how your Lark is doing in the Nest. On Android and on iPhones without Apple Intelligence, Claude can also rephrase the Lark's scripted lines.
• Describe it (setting up an alarm from a sentence): the sentence, today's date and your time zone, the missions your phone can run, and the settings of the alarm you are editing.
• Second look at close photos, which has its own switch and is off until you turn it on: when Photo Proof is a close call, the photo you just took and your saved thumbnail, both small and with their metadata removed.

What is never sent: your alarm labels, your location, your calendar events, the weather where you are, your name and your friends' names. Where the Lark mentions one of these, Claude writes a placeholder and your phone fills it in.

Requests go through our server, which checks that you have a subscription, counts your daily allowance and passes the request on. We do not store or log what is sent or what comes back. We keep counters under keyed hashes for at most 35 days, and daily usage totals with no person attached. Anthropic receives a keyed hash that changes each month, for abuse tracking, and not your subscription ID. If you ask us for help with a reply, usingReport this reply, that reply goes to us in your message, and only when you tap Send.

Anthropic handles this data as our service provider under itsCommercial Terms and does not use it to train its models. It deletes inputs and outputs within 30 days, unless it must keep them longer to enforce itsUsage Policy (a conversation its systems flag can be kept for up to 2 years) or to comply with the law. See itsretention page.

Your chat with the Lark and its notebook are stored on your phone only and are left out of backups. You can delete them in Settings under Lark AI, and deleting the optional account deletes them too. Turning the features off cancels anything in progress and deletes the letters, reports and briefings Claude wrote, and templates take their place. Replies can be wrong, so check anything that matters.

Support and feedback messages

The app offers Contact Support, Request Feature, Send Feedback and Report Bug forms. They send your selected category and written message tosupport@wakesharp.app throughResend. A reply email is required for Contact Support and optional for the other app forms. No account or name is required. The app also sends its platform, language and the screen the form was opened from. If you opt in, it includes app version, OS version and device model. It never attaches your alarms, photos, recordings or raw logs. The cancellation questions also send a copy of your answer through the same service, without a reply address; seeWhy you cancelled for that copy and for the one we keep in our own table. Delivery failure does not prevent you from continuing to the store's subscription settings.

App drafts stay on your device until successful submission or explicit discard. Written messages and email fields are masked from session replay and are never sent in analytics events. The website's contact form additionally asks for your name and sends a fixed confirmation email. Native app forms do not send that automatic email.

Message content is retained in our support mailbox while the correspondence is useful and then deleted; Resend retains delivery data under its own retention policy. Apart from the cancellation answers described above, we do not create a database of what you write to us. To prevent abuse and duplicate delivery, Supabase stores native submission IDs, keyed payload hashes, timestamps and delivery receipt IDs. Receipt metadata is retained to recognize future retries. Rate limits use keyed hashes of network addresses, never raw addresses, and these counters expire after two days. Neither of these delivery tables contains your message or email address. Please avoid sending sensitive information in ordinary support email.

How long data is kept, and how to delete it

• On-device data: kept until you delete it in the app or uninstall WakeSharp. Uninstalling removes all of it. Unless you created the optional account, we hold no copy, so there is nothing for us to delete.
• The optional account backup: kept until you delete the account, then removed immediately and permanently. Past history (the journal of past alarms, game results and the record of each morning your alarms rang) is deleted from the backup sooner, once it is 400 days old. To delete the account: Settings → Account → Delete account in the app, or the routes at wakesharp.app/account/delete if you no longer have it installed.
• Purchase records at RevenueCat: kept while the record exists, under RevenueCat's own retention policy.
• Our copy of purchase records: each subscription event RevenueCat sends us is kept for 400 days, including after an account deletion, and then deleted. The summary of each RevenueCat customer's current subscription state has no fixed expiry: it is deleted with the optional account when it is linked to it, and otherwise when you ask us.
• Your setup answers in our own table: deleted 180 days after the last answer, or at once when you delete the optional account. Turning off product analytics in the app stops new answers being sent. Their rate-limit counters are deleted within two days.
• Why you cancelled, in our own table: the note is erased 180 days after you answered and the answer is deleted after 365 days. Deleting the optional account in the app deletes the answers linked to it, and those that phone sent before you signed in and still remembers, at once. The email copy stays in our support mailbox, and rate-limit counters are deleted within two hours. See Why you cancelled.
• Invite records: deleted 180 days after their last use, by the app or by a friend using the code, except that a record which has unlocked a mission is kept until you ask us to delete it, and a used invite, with the record of any plan it led to, stays with the inviter's record. Request numbers and challenges are deleted within a day and rate-limit counters within three days. The security log is kept for 180 days, and the verification service keeps App Attest key records for a year after the key's last use. See Inviting friends.
• Group alarms, in our own tables: each morning's record is deleted after 14 days; a group with one member and no change for 30 days is deleted; leaving removes your membership at once, and deleting the optional account removes all of your memberships and records. See Group alarms.
• AI features: we keep no content. Counters under keyed hashes last at most 35 days. Anthropic's retention is described in AI features.
• Emails and notifications: the message log is kept for 400 days, and an installation's record until 400 days after the app last reported; your email choices go with the account. See Emails and notifications.
• Analytics data at PostHog: usage events are kept for as long as we analyse them; session recordings are deleted after 30 days. To have your analytics record deleted, email us. If you can send it from the app's device or tell us roughly when you used the app and on what device model, we can locate the random ID and delete everything attached to it.
• Marketing records at AppsFlyer: retained according to the service's applicable retention settings and our measurement needs. Contact us to request access or deletion. Turning analytics off stops future collection; it does not itself delete historical records.
• Subscription and analytics records are pseudonymous and may link to your account. For help locating a purchase record, contact us with the store transaction and purchase date. Do not send payment card details. Account deletion, analytics deletion and store subscription cancellation are separate actions.

Cancelling a subscription is separate and is done in your App Store or Google Play account. Deleting the app does not cancel a subscription. A Lifetime purchase is not a subscription and has nothing to cancel.

Children's privacy

WakeSharp is a general-audience app and is not directed at children. Using it without an account can still involve the pseudonymous analytics, purchase and advertising data described above. We do not knowingly let children under 13 (or the equivalent age in your country) create the optional account, and we do not knowingly collect personal data from them; if you believe a child has created one, email us and we will delete it.

The AI features are for people aged 13 and over, and the app is rated accordingly. Every screen written by Lark AI says so. Claude is told to stay away from romantic or sexual content and medical advice, replies are checked on our server and on your phone before you see them, and every reply has a Report this reply button that reaches us. If a message suggests someone is in distress, the app shows a fixed card about talking to someone.

Your rights

Depending on where you live, the GDPR, the UK GDPR, the CCPA/CPRA and similar laws give you rights to access, correct, delete, port or object to the processing of your personal data.

You can manage local data and your optional backup in the app. Contact us about access, correction, portability or deletion of subscription, product-analytics or marketing records. We may need enough information to locate the relevant pseudonymous identifiers and verify the request. Deleting a backup does not automatically remove records held by every measurement or billing provider.

Where we do process data, our legal basis is the performance of our contract with you (validating a subscription you bought), and our legitimate interest in understanding how the app is used and in preventing payment fraud. Where consent is required for analytics, marketing measurement or advertising, we request it and respect withdrawal. You have the right to complain to your local data-protection authority.

Website tools and optional website analytics

The free sleep, caffeine, alarm and timer tools calculate in your browser. Their inputs and results are not sent to PostHog or AppsFlyer. Browser alarms require an open page and an awake device; they are not a background alarm service.

If you allow optional website analytics, PostHog receives tool usage and download-click events, a separate random website analytics identifier, the page, language, button placement and limited campaign tags. It also receives technical connection information such as your IP address. We do not enable website session replay or automatic form capture. Your website analytics identity is not joined to your app identity. You can decline or withdraw through Analytics preferences in the footer; the tools and downloads still work. Your choice and, if enabled, the analytics identifier are stored locally in your browser.

Download links use AppsFlyer to route you to the appropriate store or installed app. Clicking a link sends AppsFlyer the website campaign, originating page, placement, language and technical connection information. Where attribution is available and permitted, app installs and verified RevenueCat subscription events are associated with that campaign. A desktop QR code carries the same campaign context to your phone. Attribution is not available for every visit or install.

Security

Your data stays inside your phone's app sandbox and is protected by your device's own encryption and passcode. Traffic to RevenueCat, PostHog, AppsFlyer, Resend, Apple's notification service and the backup service uses HTTPS. No system is perfectly secure. Alarm execution does not depend on a marketing server. Backups are isolated by account access rules; subscription, analytics, marketing, setup and cancellation records are held by the services described above.

Changes to this policy

If this policy changes we will update the date at the top of this page. Material changes will be described here rather than made quietly.

Contact

support@wakesharp.app, KineticBit Inc., publisher of WakeSharp.