Wakify Privacy Policy

1. The short version

Wakify is an alarm app that gets you out of bed. To do that it holds some personal information about you. Here is the honest summary, and the rest of this policy is the detail behind it.

• Your night stays on your phone. When you track a night of sleep, Wakify listens with the microphone and analyses the sound on your device. Raw audio, and the short night clips you can play back, are never uploaded to us or to anyone else. Only the summary (how long each sleep stage lasted, your sleep score) is saved to your account.
• Your camera and your voice never leave your phone either. Camera missions, from Object Hunt and Sky Photo to Scan Barcode and the exercise missions, are processed live on your device, and no image or video frame is stored or transmitted. We never create a face template or any other biometric identifier. The missions that ask you to speak use your iPhone's own on-device speech recognition. If your iPhone cannot do that on-device, Wakify refuses to run the mission and gives you the Math one instead rather than send your voice to a server.
• We do not sell your data and the App shows no ads. We do buy ads for Wakify, and since version 1.1 we measure which of them work. That measurement runs from the first launch. Apple asks you separately whether Wakify may use your device's advertising identifier, which is cross-app tracking as Apple and United States state privacy laws define it; say no and the measurement continues without that identifier, and Meta, where we buy the ads, still receives it in that form for its aggregated measurement. Section 5.15 sets out exactly what is involved and how to object. Earlier versions of Wakify did none of this, and this policy changed the day 1.1 shipped rather than before or after.
• Product analytics are off unless you turn them on. We ask you once, the answer starts at "no", and you can change it any time in Settings. If you say yes, the events are linked to your account rather than anonymous, they are also sent to PostHog in Frankfurt, and section 5.8 lists exactly what they contain. Separately, a small set of reliability events records whether your alarm actually rang; that is not behavioural profiling and section 5.8 explains it. We also count, per day and without knowing who, how often the Wakify+ offer is seen; section 5.8 explains that too.
• You can delete everything from inside the app. Settings contains a Delete Account button. It deletes your account and the data in it straight away and clears that data from your phone. There is no waiting period, so it cannot be undone.
• The leaderboard is real. If you set a username, other users see your name, your username, your photo, your streak, your milestones and whether you have Wakify+, plus your bio and social handles if you added them. Nothing about your sleep is ever shown to anyone, and one switch takes you off the board.
• Your account data is stored in the European Union (Frankfurt, Germany).

2. Who we are

Wakify is made and run by one person:

Mats Hoogerwerf, trading as Core Creatives
Nieuwstraat 87, 3311 XR Dordrecht, the Netherlands
Chamber of Commerce (KvK): 95438416
VAT identification number: NL005153269B38
Email: info@core-creatives.com

Core Creatives is a trade name, not a separate company. A Dutch sole proprietorship has no legal personality of its own, so there is exactly one party behind Wakify. He develops the App, publishes it on the App Store, runs the servers it talks to, and decides what Wakify collects, why, how long it is kept and which providers are used. Where this policy says "we", "us" or "Wakify", it means Mats Hoogerwerf, and "you" means you. For the purposes of the EU General Data Protection Regulation (GDPR) he is the controller of the personal data described here.

We have assessed whether we must appoint a Data Protection Officer. At our current scale, and because the most sensitive processing happens on your device as described in section 4, we are not required to appoint one. We will revisit this as Wakify grows. All privacy questions go to info@core-creatives.com and are handled by us directly.

3. What this policy covers

This policy covers the Wakify iOS app, the backend services that support it, and the web pages where we publish this policy and the Terms of Use (section 17 of this policy describes those pages). It does not cover:

• Apple. Your App Store purchases, your Apple Account, Sign in with Apple, Apple Health and the iOS alarm system are governed by Apple's own privacy policy. Apple sells you every Wakify subscription, charges you and holds the financial record, and we never see your payment details.
• Google. If you choose Sign in with Google, Google's privacy policy applies to that sign-in.
• Other apps and devices. If your Apple Watch, Whoop, Oura or another wearable writes sleep data into Apple Health, the maker of that device decides what it collects. Wakify only reads what Apple Health makes available to it, and only if you allow it.

4. The principle behind the app: on-device by default

Wakify is built so that the most intimate data it touches never reaches a server. This is an architectural choice, not just a promise:

If you fall asleep to Wakify's own ambient sounds through AirPods or another Bluetooth output, the recording still happens on the phone's own microphone, so the night is still measured. When another app is playing out loud through the phone's speaker, Wakify stops attributing what it hears to you, because it cannot tell your voice from a podcast.

5. What we collect, why, and on what legal basis

Everything below is stored in your personal account so that it survives a reinstall, a new phone or a re-login. Every table that holds your data is protected by row-level security, which means the database itself refuses to return one user's rows to another user. Two tables everybody can read hold no personal data at all: the configuration row described in section 5.14, and the catalogue of analytics event names described in section 5.8.

5.1 Account data

Legal basis: performance of our contract with you (GDPR Article 6(1)(b)).

Wakify has no passwords for its users. You sign in with Apple, with Google, or by asking us to email you a sign-in link. There is no password of yours for us to store, hash or lose. The only password-protected account is a demonstration account we give Apple's App Review team so they can test the App; it is not a real person's account. Because the link is emailed to you, anyone who can read that mailbox can sign in to your Wakify account, so keep it secure.

If you use Sign in with Apple you may choose Apple's private relay address. Wakify works perfectly with a relay address, and we never attempt to unmask it.

5.2 Profile and onboarding answers

During onboarding we ask a small set of questions so the app can be set up for you.

Earlier versions of the App asked four questions it no longer asks: what makes your mornings hard, the year you were born, the first thing you think when the alarm rings, and whether you used an alarm app before. We stopped asking them, we do not add to those answers, and nothing in the App reads them. If you answered them, the answers stay with your profile until you delete your account, and you can ask us to delete them sooner.

Legal basis: performance of our contract (Article 6(1)(b)) for the settings that drive the app. For the answers that say something about your sleep health, we rely on your explicit consent (Articles 6(1)(a) and 9(2)(a)). You give it by answering those questions and confirming on the account screen, where this policy is linked, and you withdraw it by deleting your account. For the photo, the bio and the handles we rely on your consent, given by choosing to set them (Article 6(1)(a)); clearing the field withdraws it. For marketing email we rely on your consent (Article 6(1)(a)), which you can withdraw at any time; every marketing email we send contains an unsubscribe link, and using it stops marketing email immediately without changing anything else about your account. For the question about where you heard about Wakify we rely on our legitimate interest in understanding how people find the app (Article 6(1)(f)), and you can object to it at any time.

Most of these questions have to be answered to finish setting up the app. Where a neutral answer exists you can pick it, for example "Other or prefer not to say" for sex, and deleting your account removes everything you answered.

The commitment screen is not a contract. Near the end of setup the App asks you to sign a commitment to your wake-up time. It is a motivational exercise and nothing more: it creates no obligation for you or for us, and the signature is never stored.

5.3 Alarms and app settings

Legal basis: performance of our contract (Article 6(1)(b)).

Two things stay on your phone and are never synced. The name of a custom alarm sound is stored on your account, but the sound file itself stays on your device. And the apps you choose to let through an app block never leave your phone at all: iOS gives Wakify opaque tokens rather than app names, and we store them locally and nowhere else.

5.4 Sleep and wake-up data

The number of sound events is stored, never the sound. The stage breakdown is a duration per stage, never a recording. One of the eight night tags records that you were ill. Like the rest of the night it is health data, it is entirely your choice to add it, and the explicit consent described below is what allows us to store it.

Which mission you use can say something about you. The Bible Verse mission suggests a religious practice, and the Pills mission that you take pills or vitamins. We record the mission type with your alarm and your wake-ups only to run the alarm, count your streak and measure whether the alarm works. We never use it to work out, record or share anything about your beliefs or your health, and you can pick any other mission instead.

Legal basis: your explicit consent (Articles 6(1)(a) and 9(2)(a)), because sleep sessions are data concerning your health. We ask for that consent on a separate consent screen the first time you start sleep tracking or import sleep from Apple Health. You can withdraw it at any time: turning tracking off stops new collection, and deleting the stored nights or your account removes what was collected. The wake-up log and your streak are not health data; for those we rely on performance of our contract (Article 6(1)(b)).

5.5 Health data from Apple Health

If you allow it, Wakify reads the following types from Apple Health:

• Sleep analysis (in bed, asleep, and the sleep stages your wearable recorded)
• Heart rate and heart rate variability during the night, used only to estimate sleep stages for wearables that do not write stages themselves

If you allow it, Wakify writes back:

• Sleep analysis for the nights that Wakify itself tracked, so all your sleep lives in one place: when you were in bed and when you were asleep. Wakify does not write sleep stages (core, deep or REM) into Apple Health, because for a night the phone tracked those are estimates, and Apple Health would show them next to measured data from a watch. The stages stay in Wakify, labelled as estimates. If an Apple Watch or another wearable later records the same night, Wakify removes what it wrote

Those three types are the whole of what Wakify reads from Apple Health. We do not read your respiratory rate, your steps, your weight, your workouts or anything else Health holds, and the App never asks Health for them.

Heart data is read into memory, used on your device to estimate your sleep stages, and then discarded. We never send heart rate, heart rate variability or raw Apple Health samples to our servers. Only the resulting sleep summary described in 5.4 is synced.

Legal basis: your explicit consent (Articles 6(1)(a) and 9(2)(a)), given twice over: once in Apple's own Health permission sheet and once through the Health toggles in Wakify's Settings. You can withdraw it in either place at any time.

In line with Apple's rules, health and fitness data is never used for advertising, marketing or use-based data mining, and we never store it in iCloud. We never disclose it to any third party for that party's own purposes. The only copy that leaves your device is the sleep summary described in 5.4, which our EU hosting provider stores for us under the safeguards in section 7.

5.6 Badges and referrals

Legal basis: performance of our contract (Article 6(1)(b)) and our legitimate interest in preventing fraud in the referral programme (Article 6(1)(f)).

5.7 Subscription and purchase data

Wakify+ is sold by Apple, not by us. Apple processes the payment and we never receive your card details, billing address or full payment record.

To know whether your subscription is active we use RevenueCat, which receives your random Wakify account identifier and the purchase receipt from Apple, and returns whether you have an active entitlement. We store on your profile:

• subscription status, plan, store, start date, expiry date, whether it will renew, and the timestamp of the last subscription event.

We also keep an append-only log of the subscription events our provider sends us: the event type, store, product, environment, trial, promotional or normal period, purchase and expiry times, and the event as it was sent, which can include the price, the currency and the country of the store account. Only our server can read it. We use it to support you, to reconstruct billing disputes and for our accounting records.

Legal basis: performance of our contract (Article 6(1)(b)). Apple, as the seller, holds the financial record of your purchase. The records we keep for tax and accounting law are Apple's payout reports, which are addressed to the Apple Developer Program account named in section 2 and are aggregated, so they do not identify you. If such a record ever contains personal data, we keep only what the law requires, for as long as it requires (Article 6(1)(c)).

5.8 Product analytics and reliability events

The app records two separate kinds of event, on two different legal bases. Nothing here is sold, shared with advertisers, or used to track you across other apps.

Tier 1, reliability. Eight events that record whether the alarm service did its job: alarm_fired, ring_presented, alarm_ring_missed, alarm_schedule_failed, emergency_dismiss, mission_asset_missing, mission_fallback_used, sync_push_failed. These exist because an alarm app that silently fails to ring is worthless, and we cannot find such failures without knowing they happened. They carry no behavioural profile, only what happened and when, and they never leave our own database.

Legal basis: our legitimate interest in delivering and debugging the service you signed up for (Article 6(1)(f)), balanced against your privacy: the set is deliberately tiny, describes the app's own behaviour rather than yours, and is kept only as long as section 9 allows. You can object to it under section 11.

Tier 2, product analytics, only with your consent. Twenty events, and this is all of them:

app_opened, onboarding_started, onboarding_step_viewed, onboarding_completed, onboarding_skipped, signup_completed, offer_step_viewed, paywall_shown, purchase_started, purchase_completed, purchase_cancelled, purchase_restored, mission_completed, snooze_pressed, sleep_tracking_started, sleep_tracking_ended, sleep_sound_played, bedtime_reminder_scheduled, weekly_recap_viewed, feature_toggled.

Each event carries at most a few short properties: which mission type was used, how many seconds a mission took and whether you snoozed first, which onboarding step or which of the screens leading into the subscription offer was on screen, which plan was shown, which sleep sound was played, which setting you toggled, how many minutes before bedtime the reminder is set, how you signed in, or a sleep score. Every event also carries the app version, the build, the platform, whether the build came from TestFlight, a random identifier for this app run, and the installation identifier described below, so we can tell a bug in one release from a bug in another. This list is the whole catalogue: there is no event in the App that is not named above, and when we add one we update this section first and section 15 applies. We also keep the same list of names in a table in our database, which anybody may read because it holds nothing but the names.

Where the tier-2 events go. They are stored in our own database and, only once you have agreed, also sent to PostHog, our product-analytics provider, on servers in Frankfurt (section 7). Five limits apply to what PostHog receives, and they are enforced in the app rather than promised:

• the tier-1 reliability events above are never sent there. They stay with us;
• your sleep score is not sent there, even though the sleep_tracking_ended event is. A sleep score is health data and the separate permission in section 5.4 governs it, so it may not travel on the weaker one you gave here;
• nothing at all is sent before you agree. The analytics software is not started, not merely muted, so no request of any kind reaches PostHog until you say yes;
• nothing recorded before you agree is sent afterwards either. Events captured while the question was still open are held on your own phone. If you say yes they are written only to our own database, never to PostHog; if you say no they are thrown away unread. In practice this means your onboarding, your sign-up and your first purchase never reach PostHog at all, because we ask the analytics question only after your first completed wake-up;
• each event carries only the properties on a fixed list. The list lives in the app, not in a dashboard setting, and a test checks it on every build. An event that is not on the list is counted by name with no properties at all.

What PostHog receives besides the event itself. PostHog's software attaches a standard technical context to everything it sends, and we would rather you read it here than discover it: your iPhone model and device type, your iOS version, your screen size, your language, your time zone, whether you are on Wi-Fi or cellular, the app's name, version, build and bundle identifier, whether the build came from TestFlight, and an identifier PostHog's own software creates and stores for this installation of the app. Each event also carries the same random event number as the copy in our own database, so a finding in PostHog can be traced back to the exact row it came from. We do not send your email address, your name, your username, your profile photo, your alarm labels or anything about your sleep, and we do not give PostHog our own installation identifier.

What PostHog is not allowed to do. Its screen recording, surveys, feature flags, rage click detection, push tracking and crash reporting are switched off in the app's own code rather than in a dashboard, so they cannot be switched back on without shipping a new version of Wakify. Separately, and this one is a setting in PostHog rather than something the app can enforce: PostHog Cloud EU discards the IP address your device connects from instead of storing it or deriving a location from it. Your IP still travels as far as PostHog's network, because that is how any request reaches any server.

These events are linked to your account. They are not anonymous: each one is stored with your user id, which is what lets us delete them when you delete your account.

The installation identifier. Every event we store, including the tier-1 reliability events, carries a random identifier for your installation of the App. It exists because the onboarding funnel happens before you sign up, and without it the stretch where most people leave cannot be measured at all. If you create an account, that identifier is attached to it so your own funnel becomes part of your history; if you never create an account, it is never connected to a person. It is created on your device, it stays inside our own database, we never give it to PostHog, and deleting the App removes it.

Legal basis: your consent (Article 6(1)(a)). The switch starts off, we ask you once, and Settings lets you withdraw as easily as you agreed. Withdrawing takes effect at once: no new event is written, the analytics software is stopped and told to forget you, and anything still waiting on your device is thrown away rather than sent. Withdrawing does not by itself erase what was already recorded. If you want that erased too, ask us at info@core-creatives.com or use the routes in section 11, and we will delete those events from our database and have PostHog delete its copy. We keep a record of when you agreed or withdrew, and to which version of this policy, because Article 7(1) requires us to be able to demonstrate it. Analytics are never a condition for any feature or for your subscription.

Anonymous daily totals of the Wakify+ offer. Separately from both tiers, the App adds one to a daily total when one of these things happens: the first time on your account that you see the Wakify+ offer (with where it was opened from, such as the end of setup or the switch of an alarm that needs Wakify+), that you tap such a switch, that a notice from section 5.16 is scheduled (which one), or that a free trial starts (with where the offer was opened from); and every time you tap one of our notifications (which one: the bedtime reminder, the streak reminder, the trial reminder or a notice from section 5.16). What our database keeps is only the day, the step, that short label and a number. It holds no user id, no installation or device identifier, no time of day and nothing else about you, so a total cannot be traced back to anyone, and it is never sent to PostHog or anyone else. It tells us whether the offer works; without it we cannot see that at all, because the tier-2 question is only asked after a first wake-up. Because it identifies no one it is not personal data under the GDPR; the counting itself falls under the exception in article 11.7a(3)(b) of the Dutch Telecommunications Act for measuring how a service performs with little or no effect on your privacy.

5.9 Technical and device data

Written once each time you open the app:

Legal basis: performance of our contract (Article 6(1)(b)) for your time zone, language and region, which the app needs to ring your alarms at the right local time and display itself correctly. Our legitimate interest in operating, securing and debugging the service (Article 6(1)(f)) for the app version, build, platform and last active timestamp, balanced against your privacy.

This set is deliberately minimal: your Wakify profile holds no device identifier, no advertising identifier and no IP-based profiling. Four exceptions, all of them elsewhere in this policy, and the last is the one that matters most. If you turn on product analytics, our analytics provider does receive your device model and an identifier for that installation, as section 5.8 sets out. A bug report you choose to send carries your iPhone model and iOS version, as section 5.13 describes. Our subscription provider uses an identifier that is specific to Wakify, as described in section 7. And if you allow Apple's tracking prompt, your device's advertising identifier does leave the App, to the provider named in section 5.15. That one is not stored on your Wakify profile either, but it is the only identifier here that can follow you between apps, which is why it has a section of its own and a question from Apple of its own.

When the App opens it also asks our server for its own settings, such as which missions are free this week. That request carries no information about you, and it happens whether or not you have an account. Section 5.14 describes it.

Our hosting provider records standard server logs, including IP addresses, for security and abuse prevention, and deletes them on a short rolling schedule.

5.10 If you email us

If you contact support at info@core-creatives.com we keep your message, your email address and our reply so we can help you and so we can prove what was agreed.

Legal basis: our legitimate interest in handling your request (Article 6(1)(f)).

5.11 Your public profile and the leaderboard

The App has a leaderboard that ranks users by their current streak. It is real. When you are on it, other Wakify users can see:

They see nothing else. No email address, no sleep data, no sleep score, no wake times, no alarms, no onboarding answers, no location and no age. Opening someone's profile does hand your phone their random account identifier, because that is what a block or a report has to point at, and it unlocks nothing on its own: every other table stays scoped to its owner. The database refuses everything else, and the board never returns more than a hundred rows.

When you appear, and for how long. There are two moments, and they are not the same one. You appear on the leaderboard once all of these are true: you have set a username, you have a name on your profile, your current streak is above zero, and you have woken up recently enough for that streak to still count. If you stop using the App your streak stops counting and you drop off the board. Separately, your profile page can be opened by anyone who has its link for as long as you have a username and Private profile is off, and that stays true after your streak has run out and you no longer appear on any board. If you never set a username you appear nowhere, although you can still look at the board.

Private profile. Settings has a Private profile switch, and it closes both at once. Turning it on writes a flag to your account, and the server leaves you out of every board it builds for anyone else and refuses to hand anyone your profile. It takes effect the next time anybody loads the board. The switch starts off, which means an account that has set a username is visible by default. Deleting your account takes you off every board at once.

If you picked your username while we said it was private. An earlier version of this policy wrongly said that other users never see your username. They do, on your profile page. Settings lets you change it, and Private profile takes your whole profile out of view.

Blocking and reporting. Tapping someone on the board opens their profile, where you can block or report them. Blocking works in both directions: neither of you appears on the other's board again, and we do not tell the other person, so a block cannot be detected. Reporting sends us the profile, the reason you picked and anything you wrote. If three different people report the same profile it is hidden from every board automatically while we look at it, because Wakify is run by one person who cannot promise to read the inbox at four in the morning. We tell that person it happened, why, and that the first step was automatic, and they keep their account and all their data while a human reviews it. When we hide or reset something, we record why.

Before a photo is published. Names, usernames and bios are checked against a word list on our server when you set them. Profile photos are not screened automatically: they are published as you upload them, and reporting is what catches a photo that should not be there. If we ever add automatic screening we will update this policy first, and the image would be checked on your own device rather than sent anywhere.

Legal basis: our legitimate interest in running a social feature that motivates people to get up (Article 6(1)(f)), balanced against your privacy by keeping the shared set small, by never sharing anything about your sleep, and by giving you a switch that removes you completely. For blocking and reporting we rely on our legitimate interest in keeping the App safe for the people using it (Article 6(1)(f)). You can object at any time under section 11, and the Private profile switch is the fastest way to do it.

5.12 Reports and blocks

We keep a report after it is dealt with, because it is the record of a decision we made about someone's account and we may need to show why we made it. A block is kept until you undo it or delete your account.

Legal basis: our legitimate interest in keeping the App usable and safe (Article 6(1)(f)), and in being able to account for a moderation decision.

5.13 Bug reports

The App contains a bug reporter for testing. It is switched off, including in the App Store version at launch, and we only switch it on from our configuration (section 5.14) while we are testing a release. When it is off there is no reporter in the App at all: if you have a problem you email us, and section 5.10 covers that. When it is on, you reach it under Settings, then Preferences, then Report a bug, or by shaking the phone. Sending is always the tester's choice: opening the form sends nothing, and nothing leaves the phone until they write a description and tap Send.

When you send a report, we receive:

A screenshot shows whatever was on your screen. If you report from the sleep statistics screen, the image contains your sleep data. If you report from the morning screen it can contain your agenda. That is why we always show it to you first and why you can remove it.

You must be signed in to send a report, and only we can read it. The database refuses to return a bug report to any app, including yours, and screenshots are held in private storage that no link reaches.

Legal basis: our legitimate interest in finding and fixing faults (Article 6(1)(f)), balanced against your privacy: you decide whether to send anything, you see the screenshot first, and we ask for no more context than a bug needs. You can object at any time under section 11, and not sending reports has the same effect. If you choose to write something about your health in a report, you are giving us that yourself and we rely on your explicit consent for it (Article 9(2)(a)).

How long we keep it, and what happens when you delete your account. A bug report is our engineering record of a fault, so unlike the rest of section 5 it is not erased with your account. What happens instead is that we remove your account identifier, delete the screenshot, and clear the description and the log, leaving only the technical context of the fault. Every report is deleted twelve months after you sent it, whether or not you still have an account.

5.14 Remote configuration

When the App starts it reads one row from our database that says which missions, alarm sounds and sleep sounds are free, and which features are switched on. It is the same row for everybody. It contains no personal data, the App only reads it, and nothing about you is sent in order to fetch it. No app can write it: only we can, from our own console, which is what stops anyone switching their own paid features on.

We use it so we can change what is free, or turn a feature off, without shipping an App update.

Because it is read when the App starts, it is read whether or not you have an account and whether or not you agreed to analytics. Like any request to our server it appears in our hosting provider's standard server logs, including your IP address, which section 5.9 describes.

Legal basis: our legitimate interest in operating and configuring the service (Article 6(1)(f)). Nothing in it is decided about you personally: everyone receives the same row, which is why section 13 can say we run no experiments on you.

5.15 Advertising measurement

We buy ads on Meta (Facebook and Instagram) to reach people who sleep through their alarms. This section is about the one thing that costs you something: finding out which of those ads actually brought somebody here, instead of paying for ads that do nothing.

How it works, plainly. From the first launch the App contains measurement software from AppsFlyer. During setup iOS asks you whether Wakify may track you across apps and websites. That question is Apple's, and it decides one thing: whether the measurement may use your device's advertising identifier. Refuse it and the measurement still records that an install came from one of our campaigns, without that identifier. There is no separate question from us; this section, and the iOS setting, are how you know and how you object.

What is collected:

• the installation, the campaign and the ad it came from, plus our app version and the standard technical details the software sends about the device it is running on. Those include Apple's vendor identifier (a code that is the same only across one developer's apps, so it cannot follow you into other companies' apps) and your IP address, whatever your answer to Apple's prompt;
• your device's advertising identifier (IDFA), but only if you allowed Apple's prompt. Refuse it and iOS hands over nothing but zeros;
• two moments, and only the first time each happens: finishing setup, and completing your first wake-up. They are sent as bare facts with no properties attached at all: not which mission, not how long it took, not what time it was.

What is never collected for this, under any circumstance: anything about your sleep, your sleep score, your recordings, which missions you do, your alarm times, your email address or your name. There is nowhere for it to go even if we wanted to send it: the measurement Apple allows here is a single number between 0 and 63.

Who receives it. AppsFlyer measures it for us and passes it on to Meta, so Meta knows which of its ads worked. That includes the technical details above: the IP address, the vendor identifier and the device type that come with an install, with the two moments and with a purchase. Meta receives them also if you refused Apple's prompt, and also if you did not come through an ad at all, because its measurement only works when it can compare both groups. Meta uses them for its own aggregated measurement (Aggregated Event Measurement), which reports results per campaign rather than per person; your advertising identifier only reaches Meta if you allowed the prompt. RevenueCat is part of this too: so that a subscription can be counted against the ad that led to it without your iPhone having to send purchases to an advertising company, the App hands RevenueCat the AppsFlyer installation identifier as a join key, and RevenueCat reports the purchase to AppsFlyer from its servers. That join key always goes, and with it RevenueCat's software records the device's vendor identifier and IP address, which Meta needs to match a purchase to an ad. Your advertising identifier (IDFA) is only real if you allowed Apple's prompt; otherwise it is zeros. Section 7 sets out all three.

Apple measures some of this without us. Independently of your answer, Apple's own SKAdNetwork tells an advertising network that an install happened, in a form that is aggregated and cannot be traced back to you. That is built into iOS, it needs no permission, and it happens for every app that runs ads.

Legal basis. For the advertising identifier: your consent, given through Apple's prompt (Article 6(1)(a)). You can change that answer at any time in iOS Settings, under Privacy and Security, then Tracking. For the install and the campaign it came from, which carry no advertising identifier, and for passing those technical details to Meta for its aggregated measurement: our legitimate interest in knowing which of the ads we pay for actually work (Article 6(1)(f)), weighed against your privacy by keeping the set this small, by never joining it to anything about your sleep, and by naming it here rather than burying it.

How to object, and what it does. Email info@core-creatives.com and we will ask AppsFlyer to delete what it holds about your installation, to stop processing it for us and to stop passing it to Meta, and RevenueCat to remove the identifiers it keeps for it. Deleting the App stops the measurement on your iPhone; switching tracking off in iOS Settings stops the advertising identifier at once. We say this plainly rather than pointing you at a switch in Settings: there is not one, because the measurement is not run on a consent we ask you for.

5.16 Notifications about your alarm

These notifications are scheduled on your iPhone itself. Nothing is sent to a push service, and they never contain anything about your sleep.

If an alarm you set is switched off because it uses a Wakify+ mission, sound or setting, you get a notice the evening before it would have rung ("Your 7:30 alarm is off"), at most twice. On the evening a free trial starts, if your alarm rings the next morning, you get one notice that it is set. And, if you asked for it on the offer screen, a reminder before your trial ends; it is only scheduled when you have already allowed notifications. These tell you something true about your own alarm or subscription and offer nothing, so they run on the same basis as the alarm service itself: performance of our contract with you (Article 6(1)(b)). We send no notifications that advertise an offer or a price.

Once, on one of the first days after you set up an alarm that uses a Wakify+ mission, and only while you do not have Wakify+, you also get a notice about that mission ("See Object Hunt in action"). A tap opens the list of missions with their previews, and you can close it. The nightly bedtime reminder suggests starting sleep tracking; a tap opens the App. These two are part of the App you set up rather than a service you asked for separately, so they rest on our legitimate interest in helping you use it (Article 6(1)(f)). Turning off notifications for Wakify in iOS Settings stops them; the bedtime reminder also has its own switch in the App.

6. Permissions the app asks for, and what happens if you say no

Wakify asks for each permission separately, at a moment where it makes sense, and never as one wall of dialogs. Three are asked while you are setting the app up, each on a screen that explains it first: permission to ring alarms, right after you have picked the days your alarm rings; permission to send notifications, for the bedtime reminder and streak reminders; and access to Apple Health. If you ask to be reminded before a free trial ends, the reminder is only scheduled when you have already allowed notifications; we do not ask again there. Setup also raises Apple's own tracking question, which is the one permission that serves us rather than you; section 5.15 explains it and a refusal changes nothing about the App. Everything else is asked the first time you choose the mission or the feature that needs it. Every permission is optional except the alarm permission, and refusing one only disables the feature that depends on it. You can change any of them later in iOS Settings.

Calendar content is read on your device, shown to you, and never transmitted or stored by us. Wakify does not ask for your location.

What the Screen Time permission gives us, and what it does not. It gives Wakify two abilities and no information. The first is app blocking. If you switch it on for an alarm, the block starts the moment that alarm rings, which is the point of it, and lifts a set number of minutes after you dismiss the alarm, between 5 and 60 as you chose. Snoozing does not end it. The apps you let through are picked in iOS's own picker, which hands Wakify opaque tokens instead of a list: we cannot read which apps you chose, we get no usage figures, and the tokens never leave your phone. The block is lifted at its deadline by a small system extension that iOS runs even when the App is closed, and again by the App itself whenever it runs. A deadline is stamped before the shield goes on and a hard ceiling of 80 minutes applies whatever else happens, so a block cannot quietly become permanent. If iOS does not run the extension and the App stays closed, the shield can stand until you next open Wakify, and revoking Screen Time access for Wakify in iOS Settings ends it at once. The second ability is the optional "Can't be deleted" setting, which switches off app deletion while a wake-up is unfinished. iOS has no way to protect one app only, so while that setting is on, no app on the phone can be deleted. It is off unless you turn it on, and turning it off releases it at once.

7. Who we share your data with

We do not sell personal data and we do not disclose it for anyone else's purposes. One provider does receive data for advertising measurement: the measurement described in section 5.15. The two rows at the bottom of this table are that exception, and it is deliberately the narrowest one we could build. We use a small number of service providers ("processors") who handle data only on our documented instructions and under a data processing agreement that requires the same level of protection this policy promises.

Other Wakify users are also recipients, of the items listed in section 5.11 and of nothing else. As that section explains, there are two moments: the board while your streak is live, and your profile page for as long as you have a username and Private profile is off.

We will also disclose data where we are legally obliged to, for example to comply with a valid court order, or where it is necessary to establish, exercise or defend a legal claim. If Wakify is ever sold or transferred, your data may transfer to the acquirer, who will be bound by this policy until they lawfully replace it. You will be told before your data is transferred, and you can delete your account before the transfer takes effect so that your data does not move.

8. Where your data is stored, and international transfers

Your account data is stored in the European Union, on servers in Frankfurt, Germany. Your mailbox with us is hosted in the Netherlands.

Several of our providers are established in the United States: RevenueCat, Google, PostHog, Resend and Vercel. Supabase Inc. is also a United States company. Supabase and PostHog both keep your data on servers in the European Union but may access it from the United States for support and maintenance. For those transfers we rely on:

• the European Commission's Standard Contractual Clauses, combined with technical measures such as encryption in transit and at rest and strict access control, and where applicable
• the provider's certification under the EU-US Data Privacy Framework.

AppsFlyer Ltd. is in Israel, which the European Commission has decided offers an adequate level of protection, so our transfer to them needs no separate safeguard. AppsFlyer may in turn process data outside Israel, including in the United States; its own privacy policy states that transfers to the United States are governed by the Standard Contractual Clauses in its agreements with its providers. Meta Platforms Ireland Ltd. is in the European Union.

You can ask us for a copy of the relevant safeguards at info@core-creatives.com.

9. How long we keep your data

10. How we protect your data

• Transport encryption. All traffic between the app and our backend uses TLS.
• Encryption at rest. The database and its backups are encrypted at rest.
• Row-level security. Every table is scoped to its owner at the database level, so a request authenticated as one user cannot return another user's rows even if the app had a bug. A few database functions deliberately reach across that line, and only these: one builds the leaderboard, one returns a single public profile, one returns the names of the people you have blocked so that you can unblock them, one answers whether a username is still free, and one answers whether a referral code exists. The last two answer only yes or no and never say whose it is. The first three return a fixed list of columns and nothing else, and section 5.11 says what that list is. Two tables are readable by everyone because they hold no personal data at all: the configuration row in section 5.14, and the catalogue of analytics event names in section 5.8.
• Server-only fields. Your premium status, and whether a reported profile is hidden, can only be written by our server, never by the app, so the app cannot alter them. The Sign in with Apple token in section 5.1 cannot be read by any app at all, including yours.
• On-device processing. The most sensitive signals, audio, camera, voice and heart data, are processed on your phone and never transmitted.
• Credential handling. Your session token is stored in the iOS Keychain. Users have no Wakify password, and we never see your Apple or Google password. The one demonstration account for App Review has a password that is stored only by our authentication service, and sign-in attempts are rate limited.

No system is perfectly secure. If a personal data breach is likely to result in a risk to you, we will notify the Dutch Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we will also inform you directly without undue delay.

11. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Rectify data that is wrong or incomplete. You can change your name, username, bio, handles and profile photo in the app, and your alarms and settings sync automatically. For anything else you told us during onboarding, email info@core-creatives.com and we will correct it.
• Erase your data ("right to be forgotten").
• Restrict processing while a dispute about accuracy or legitimacy is resolved.
• Object to processing based on legitimate interest, on grounds relating to your situation.
• Data portability: receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
• Withdraw consent at any time, without affecting processing that already happened. The Health toggles in Settings are consent withdrawals, and so is revoking a permission in iOS Settings.
• Complain to a supervisory authority.

How to use them. The fastest routes are built into the app:

• Delete everything: Settings, then Delete Account. After you confirm, your account and every row attached to it are erased straight away, Apple is told to end your Sign in with Apple link if you used it, and the App clears your data and recordings from the phone. This cannot be undone. The only records kept are the two described in section 9, with your account identifier removed: the subscription event log, and any bug report you sent us. Deleting your account does not cancel a subscription; cancel that with Apple.
• Get a copy of your data: Settings, then Preferences, then Export my data. This produces a single JSON file containing your profile, settings, alarms, sleep summaries, wake-ups, streak, badges, referral state and consent history, the Article 20 format, straight from the server. It does not include your missed alarms, your blocks, any report you sent, or your analytics and reliability events, because the export is built for the data you gave us rather than the data we observed. Email us and we will send those too.
• Stop analytics: Settings, then Preferences, then the analytics switch under Privacy. That withdraws your consent for the tier-2 events in section 5.8 and takes effect immediately. It stops new events; if you also want the events already recorded erased, email us and we will delete them here and have PostHog delete its copy. To object to the tier-1 reliability events, email us.
• Stop health processing: Settings, then Preferences, then the Apple Health switches, or revoke access in the iOS Health app.

For anything else, email info@core-creatives.com. We answer within one month, and will tell you if we need up to two further months for a complex request. We may ask you to confirm the email address on your account before we act, so we do not hand your data to someone else. Using your rights is free, unless a request is manifestly unfounded or excessive.

Complaints. You can lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag, the Netherlands
autoriteitpersoonsgegevens.nl

If you live elsewhere in the EEA you may complain to your own national authority instead. We would appreciate the chance to fix it first.

12. Children

Wakify is a general-audience app. It is not directed at children, and we do not knowingly collect personal data from anyone below the minimum age.

You must be at least 16 to use Wakify. One number, everywhere. Article 8 of the GDPR lets each member state set the age at which someone can agree to an online service for themselves anywhere between 13 and 16, and the Netherlands picked 16. Wakify stores sleep, which is data concerning health, and it publishes a name, a photo and a bio to a leaderboard other people read, so we take the higher line rather than build parental consent machinery we could not run properly.

There is a real gate, and this is exactly what it does. Setting up the App asks how old you are. The first answer is "Under 16", followed by age ranges starting at 16-17. If you choose "Under 16", setup stops there, the screen tells you why, and that answer is not saved anywhere. On the normal route this happens before any account exists, so nothing is created. If you had already signed in with Apple or Google, an account exists by then, and the same screen offers to delete it immediately along with everything in it. Once you have an account we keep only your age range, never your date of birth. We cannot check that your answer is true, so please answer honestly. Nothing else in the App estimates anyone's age, and we do not screen for it in any other way.

One thing to know if you are a parent: if the account has a username, the person's name, username, photo, streak and milestones are shown to other users (section 5.11). The Private profile switch in Settings takes them off it, and not setting a username keeps them off it from the start.

If you believe a child below this age has given us personal data, email info@core-creatives.com and we will delete the account.

13. No ads in the App, no experiments on you, and what changed about tracking

This section used to be called "No tracking, no advertising, no experiments on you". Version 1.1 of the App made one of those three untrue, so the heading changed with it rather than the sentence underneath being quietly softened. Here is the whole of it.

• The App still shows no ads. There is no ad space in Wakify, there never has been, and nothing you do in it is used to choose an advertisement to show you.
• We do buy ads, and we measure them. Since version 1.1 Wakify includes measurement software from AppsFlyer that tells us which advertisement brought somebody here, and that, if you allow Apple's prompt, reads your device's advertising identifier. Apple and United States state privacy laws both call that tracking, so we say so plainly: on this one narrow point, Wakify tracks. Section 5.15 sets out what is collected, what never is, what refusing Apple's prompt does and does not stop, and how to object to the rest.
• What that measurement never touches: your sleep, your sleep score, your recordings, your missions, your alarms, your email address or your name. The on-device principle in section 4 is unchanged: the night still never leaves your phone.
• We do not sell personal data, and we never have. Under United States state privacy laws, sending an advertising identifier to a measurement provider so that an advertising network can be told which of its ads worked can count as "sharing" for cross-context behavioural advertising. So rather than claim it does not, we tell you how to stop it: refusing Apple's tracking prompt takes the identifier out of it, and an email to us stops the measurement altogether. Section 14 explains why those are the opt-outs those laws ask for.
• Wakify uses no third-party feature flags and no third-party experiments. What is free, what is paid and which features are switched on is decided by the single configuration row in section 5.14. Every copy of the App reads the same row, and reading it sends nothing about you. Nobody is shown a different app because of who they are.
• Our analytics provider's own feature flag, survey, screen recording and crash reporting features are switched off in the App's own code rather than in a dashboard, so they cannot be switched back on without shipping a new version.
• The leaderboard shows real users, and when you are on it other users see the small set of things listed in section 5.11, including your milestones. That section explains it in full, including how to stay off it. Nothing about your sleep is ever shown to anyone.
• We make one decision automatically, and it is not about your data: if three different people report the same profile, that profile is hidden from every board while we look at it, because Wakify is run by one person who cannot promise to read the inbox at four in the morning. We tell the person it happened and why, they keep their account and all their data, and a human reviews it.
• Otherwise we use no automated decision-making that produces legal or similarly significant effects on you. Your sleep score and streak are calculated automatically. Your score is only ever shown back to you; your streak is also the number the leaderboard ranks you on if you appear there.

14. Region-specific information

European Economic Area, United Kingdom, Switzerland. This whole policy is written to GDPR standards. The controller is named in section 2, and complaint routes are in section 11.

California. If you are a California resident you have the right to know what personal information is collected, disclosed or sold, to delete it, to correct it, to opt out of its sale or sharing, and not to be discriminated against for exercising those rights. The categories we collect are set out in section 5, and you can exercise your rights through the routes in section 11.

We never sell personal information. Advertising measurement (section 5.15) is the only thing Wakify does that could be argued to be "sharing" for cross-context behavioural advertising, and we treat it as though it is.

How to opt out. Two routes, and they do different things. Refusing Apple's tracking prompt, or turning Wakify off under iOS Settings, Privacy and Security, Tracking, stops the advertising identifier being used, which is the part that makes this "sharing" at all. To stop the measurement entirely, email info@core-creatives.com; we stop it for your installation and ask AppsFlyer to delete what is held about it. That email address is what a "Do Not Sell or Share My Personal Information" link would lead to, and we would rather give you the address than a page that only repeats it.

To be straightforward about the law rather than sound grander than we are: Wakify is one person's business and does not currently meet the revenue or volume thresholds that make these statutes binding on us. We wrote this section as though they do, because the rights they describe are reasonable ones and we would rather already be doing it when they start to apply than discover it afterwards.

Other United States states. Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah and Texas) have comparable rights of access, correction, deletion and portability. Use the same routes in section 11.

United States consumer health data. Your sleep data is health data and we treat it that way in every US state: we collect and process it only with your consent, we never sell it, we never share it for advertising, and you can delete it at any time through the routes in section 11. Residents of Washington, Nevada, Connecticut and other states with consumer health data laws have a separate notice, the Consumer Health Data Privacy Policy, which sets out those rights, including how to appeal a decision we make about a request.

Biometric information. Wakify does not collect, capture, store or share biometric identifiers or biometric information, as those terms are used in laws such as the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act and the Washington biometric privacy law. Some camera missions check, one frame at a time and on your device, whether a face or a body is in view or how your posture moves during a repetition. No face geometry, template or other identifier is created, nothing is used to identify you, and every frame is discarded as soon as it has been checked.

Everywhere else. Wherever you live, we honour the rights described in section 11: access, correction, deletion, portability, objection and withdrawal of consent. If the privacy law of your country gives you more, for example the LGPD in Brazil or PIPEDA in Canada, we honour requests under it through the same routes. We never sell personal data, wherever you live.

15. Changes to this policy

We will update this policy when the App, our website or our service providers change what happens to your data. The version number and date at the top always show which version is current, and the App links to this page from Settings, from the sign-in screens and from the paywall. When a change matters to you we will say so in the App before it takes effect, and where the law requires it we will ask for your consent again. Previous versions are available on request.

16. Contact

Mats Hoogerwerf, trading as Core Creatives
Nieuwstraat 87, 3311 XR Dordrecht, the Netherlands
Email: info@core-creatives.com
Chamber of Commerce (KvK): 95438416
VAT identification number: NL005153269B38

One address, and it reaches the one person behind Wakify. Support questions, privacy requests, moderation appeals and anything else all go to info@core-creatives.com. We aim to answer every privacy question within five working days, and always within the statutory deadlines described in section 11.

17. Our website

This policy and the Terms of Use are published as ordinary web pages on wakify.co, so you can read, save and print them without the App. The site is hosted by Vercel (section 7), which keeps standard web server logs, including your IP address and the page you asked for, to keep the site running and secure, and deletes them on a short rolling schedule.

• The pages set no cookies and ask for no consent, because they need none.
• They run no advertising, analytics or tracking scripts, and load no third-party scripts at all. Fonts are served from the same domain as the page.
• The only thing they store in your browser is your light or dark theme choice, and only after you press the theme button. Before the page paints, a small script reads that stored choice, or a ?theme= value in the address, or your browser's own light or dark setting, so the page does not flash white. It reads only; it stores nothing until you press the button.
• We do advertise Wakify on social platforms, including Meta. Those campaigns are targeted by the platform using the platform's own data. We place no measurement code on these pages and we give those platforms no data from your Wakify account.

If we ever add a tracking or measurement script to these pages, we will ask for your consent before it loads and we will update this policy first.