Privacy Policy

1. Scope and controller

This policy covers the Wake Friends app for iOS, iPadOS and Android, its home screen widget and these support pages. The controller of your personal data is Emre Şahin. Contact: mre.sahinn@gmail.com.

Wake Friends is a social alarm app. You don't need an account to set alarms, do missions or use Mystery sounds. For friends, Secret Wake and wake-up groups you sign in with Apple (iPhone and iPad) or Google.

2. Data that stays on your device

Your alarms and their names, times, sounds, mission settings, your wake history, step counts, Mystery preferences and app settings are stored on your device. The QR code you scan for the QR mission is not stored; only a one-way digest (hash) is kept on the device for comparison. Camera images and step data never leave the device.

This data is removed when you delete the app. On Android, if device backup is on, some of it may go into your own Google backup; your friends' encrypted audio files and the encryption key are excluded from backup.

3. Account and profile

When you sign in, Google's Firebase Authentication receives your account identifier and the email address the sign-in provider shares (with Sign in with Apple you can hide your email). The app does not use your email address and never shows it to anyone.

For your profile we store your display name, username, the avatar you pick from a preset set, your language, and how many mornings in a row you made it (streak). Your friends and group members see your name, username, avatar and streak; you can hide your streak in Settings. Others can find you only by typing your exact username. No photos are uploaded.

4. Friends, groups and morning status

We store your friendships, friend requests (up to 30 days), invite links (7 days) and the people you block. Someone you block can't find you or send you requests or voice wake-ups.

When you create a wake-up group we store its name, the alarm time and the creator's time zone, the mission rules and the members. When your group alarm rings, your phone writes only your status (ringing, snoozed, up, missed, skipping today) and your wake-up time to the group; these are deleted automatically after 7 days. Counters kept for "Wake" nudges are deleted after 2 days. When you leave a group your morning statuses are deleted too.

5. Secret Wake voice wake-ups

When you send a friend a voice wake-up, your 3–28 second recording is uploaded to our servers. The server checks the friendship, blocks and the recipient's "who can wake me" setting, computes a digest to verify the file's integrity, and stores the audio. The audio is not end-to-end encrypted; it is stored encrypted by default on Google's servers and only our server code can access it.

Only the recipient can download the audio, and only after accepting the wake-up. It is stored encrypted on the recipient's phone and plays only on the alarm they choose; it can't be heard before they wake up. If you choose to hide your name, the recipient sees it after the audio plays.

Deletion: declined or revoked audio is deleted immediately. Audio not accepted within 7 days, and accepted audio that hasn't played within 29 days, is deleted. Played audio is deleted 7 days after it plays. Reported audio is kept for review for up to 30 days. The record of who sent it to whom, when, and how long it was is deleted automatically no later than 3 days after these periods; as an extra safeguard, audio files older than 60 days are also deleted from the server.

6. Backup of your wake history

If you are signed in, your wake-ups on the phone where you signed in are backed up to your account: when the alarm rang, the outcome (up, missed, etc.), snooze and ring counts, and when the mission was finished. Alarm names and mission details are not sent. This backup powers your streak and weekly summary; it is kept while your account exists and deleted with it.

7. World Wake

If you are signed in and World Wake is on (you can turn it off in Settings), finishing your mission adds you to an anonymous world count. Only the minute and the country code from your device's language/region setting (for example US) are counted; your location and IP address are not used. Count data is deleted after 2 days. The count is shown only when the total exceeds 100 and a country exceeds 50.

8. Notifications

If you allow notifications, we store your phone's push token, platform, operating system version and language/region setting. A random identifier generated by the app is used to recognize your device; no hardware identifier is used. Notifications may include a friend's name or a group name and are delivered through Apple (APNs) and Google (Firebase Cloud Messaging). Your push token is removed when you sign out.

9. Usage analytics and crash reports

Usage analytics (Firebase Analytics) is turned on only if you allow it, and you can turn it off at any time in Settings. When it is on, the app logs events such as: alarm created, wake-up finished (outcome, snooze count, whether there was a mission), voice wake-up sent or accepted, group created, paywall opened. Events never contain audio, names, usernames or message content. Firebase also receives a random app-instance identifier, device model, operating system, app version and an approximate country derived from your IP address. The advertising identifier (IDFA/AAID) and the iPhone identifier for vendor (IDFV) are not collected.

Crash reports (Firebase Crashlytics) are on by default and can be turned off in Settings. Reports contain error details, device model and operating system; they are not linked to your name or account.

10. Purchases

Payments are processed by Apple and Google; your card details never reach us. We use RevenueCat to manage subscription status: RevenueCat receives your account identifier as its customer ID, and your purchase and subscription records. We store in your account whether Premium is active, the product, the store and the expiry date.

11. Reports and safety

When you report a person or a voice wake-up, we record who reported, who was reported, the reason and, if applicable, the wake-up concerned. Reports are reviewed to prevent abuse and deleted automatically after 1 year.

12. Support

"Write to us" opens your own email app and adds a short summary such as the app version, platform, operating system, time zone and number of alarms. "Share diagnostic report" goes only to the person you choose; it contains permissions, alarm times and recent alarm events, but not alarm names. We use what you send to support only to answer your request.

13. Device permissions

Microphone: only while you record a voice wake-up. Camera: only for the QR mission and when scanning an invite code; images are processed on the device, never stored or sent. Motion and fitness: only for the steps mission; steps never leave the device. Notifications and alarms: so the alarm can ring and for social notifications. Location, contacts and your photo library are not used.

14. Service providers and international transfers

We process data with these service providers: Google Firebase (Firestore database, storage and server code in the European Union, europe-west1 region; authentication, notifications, analytics and crash reporting on Google's global infrastructure), Apple (sign-in, notifications and alarm system), RevenueCat (subscription management, United States) and Netlify (this website). These providers may process data outside Türkiye and Europe; transfers take place under the providers' agreements and the safeguards they offer.

We don't sell your data, use it for advertising, or track you across other companies' apps and websites. There are no ads in the app.

15. Purposes and legal bases

We process data to provide the service (alarms, friends, voice wake-ups, groups), verify purchases, keep the service safe and prevent abuse, fix crashes and, if you allowed it, improve the app. Legal bases under KVKK and the GDPR: performance of a contract, our legitimate interests (safety, crash reports) and your consent (usage analytics).

16. Your rights and deleting your account

Under Article 11 of Türkiye's KVKK and under the GDPR you have the right to access your data, ask for it to be corrected, deleted or restricted, object, data portability and to withdraw consent. Write to mre.sahinn@gmail.com; you may also complain to Türkiye's Personal Data Protection Authority or the data protection authority where you live.

You can delete your account in the app under Settings → Delete account; if you can't access the app, follow the steps on the account deletion page. Deleting your account removes your profile, username, friendships, requests, the voice wake-ups you sent and received, your group memberships and morning statuses, your wake backup, device records and settings.

Some information may remain for a while: report records (up to 1 year), your name and username in the block lists of people who blocked you (until they remove it), your name shown in your friends' history on their phones, voice wake-up records (up to 33 days), purchase records at Apple, Google and RevenueCat (under their policies) and analytics and crash data not linked to you. The alarms on your device remain until you delete the app.

17. Retention periods (summary)

• Profile, friends, groups, wake backup: while your account exists
• Voice wake-up: at most 7 days (not accepted), 29 days (not played), 7 days after playing; reported 30 days; safeguard 60 days
• Friend request: 30 days · Invite: 7 days · "Wake me" request: 2 days
• Group morning status: 7 days · "Wake" counter: 2 days · World Wake count: 2 days
• Report: 1 year

18. Children

Wake Friends is not intended for children under 13; you must be at least 13 to create an account. If we learn that we have collected data from a child under 13, we delete it; you can write to us.

19. Security and changes

Connections are encrypted (TLS); the database and storage are protected by rules that let people access only their own data. No system is completely secure; if a breach occurs we will notify as the law requires. We update this policy and its date as the app changes and announce significant changes separately. These pages are hosted on Netlify, which may process IP addresses and connection logs.