CheckAlarm — Privacy Policy

1. Who we are and scope

This policy covers the CheckAlarm Android and iOS apps, the app's group server, and the group account deletion web page.

Personal features such as alarms, personal checklists, and check history have no account and are not uploaded to a server. Groups are an optional feature you turn on yourself. They use an anonymous group identity created on your device that does not ask for an email address, phone number, or name (section 3).

The app does not ask for or store your age.

2. Information kept on the device

Alarm names and schedules, checklist text and photos, recorded alarm sounds, app settings, and check history are stored in the app's local storage. Photos you take with the camera or choose in the system picker are copied into the app's private storage. This content is not uploaded to sunlitwater.com, Firebase, or AdMob unless you share it with a group or post a result to a collaborative checklist.

Your Firebase collection choices, the advertising consent state managed by Google UMP, and extra-alarm reward credits are also stored on the device. If you use groups, your group identity's private keys, group keys, and copies of group content you received are kept in the device's protected storage.

Permissions and system services

• Alarms and notifications: used to schedule and show the alarms, reminders, and active checklists you create, and group update notifications if you turn them on.
• Camera/photos: used only when you add a checklist, profile, or result photo. Only photos you pick in the system picker or take with the camera are processed.
• Microphone: used only to record a custom alarm sound; recordings stay in app storage.

3. Groups

Groups let a small number of people (up to 20) share checklists. You join with an invite code and administrator approval.

3.1 End-to-end encrypted group content

Group names and descriptions, profiles (name, bio, photo), shared checklists and their photos, and collaborative checklist versions, edit proposals, results, and result photos are encrypted on the device before they are stored on the server. Decryption keys exist only on group members' devices, so neither we nor our service providers can read this content. Group members can see what they receive, and a checklist another member imported remains on that member's device as an independent copy.

3.2 Information the server processes

• Group identity and device: randomly generated identity and device IDs, hashes of the device credential and recovery code, platform (Android/iOS), last-used time, and an encrypted key vault that only your recovery code can open.
• Group metadata: group ID; member IDs, roles, numbers, and join times; member public keys and the signed roster; content IDs, authoring member, version, size, and ciphertext hash; join request and invite status; proposal status and result timing for collaborative checklists; and personal block lists.
• Terms consent: the group terms version you accepted and when.
• IP address: used only for rate limiting to prevent abuse. We keep a value hashed with a secret key only for the limit window (at most one hour) and do not store the address itself.

3.3 Push notifications

If you turn on group notifications, we store your device's push token, platform, and notification language and send notifications through Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iOS). A notification carries only fixed wording, the event type, and group and content IDs, never a group name or content. Turning group notifications off deletes the token.

3.4 Reports and evidence

You can report members, shared checklists, collaborative checklists, edit proposals, and results. A report records the reporter, target, reason, and time. Text and up to three photos that the reporter selects as evidence are encrypted to the operator's public key, and the operator decrypts and reviews that evidence to handle the report. Sending evidence requires a separate consent each time. The operator can remove violating content and warn, restrict, or suspend the poster.

3.5 Diagnostics you send

Group server error records are sent only when you review a preview in the group safety center, agree, and tap Send diagnostics. Nothing is sent automatically. The records contain request, operation, and attempt IDs, API route names, failure codes and HTTP status, duration and retry count, app version, platform, OS major version, and time; they do not include IP addresses, URLs, content, or device model. You can request deletion using the support code shown after sending.

4. Firebase Analytics and Crashlytics

Google Firebase may process an app instance or installation identifier, approximate device and operating system information, app interactions, performance and diagnostic information, and crash stacks. We do not intentionally include alarm names, checklist text, group content, photos, recordings, or precise location in Analytics events, user properties, or Crashlytics keys and logs.

Analytics stays off while the applicable regional requirement is being determined. It follows consent and your settings where required and is on by default elsewhere unless you turn it off. Crashlytics is on by default. You can turn either one on or off at any time in Settings › Advertising and privacy.

Firebase Analytics event-level retention is set to two months. Firebase generally keeps crash reports for up to 90 days. Aggregated or de-identified reports without event- or crash-level identifiers may be kept longer.

5. Advertising and consent

CheckAlarm uses Google AdMob for banner ads and rewarded interstitial ads, and the Google User Messaging Platform (UMP) to manage privacy choices. Google and advertising partners may process advertising and device identifiers, IP address and IP-based approximate location, ad and product interactions, and technical diagnostics to serve and measure ads, cap frequency, prevent fraud, and personalize ads where permitted. Group content and group identities are not used for advertising.

• Ads are not requested until UMP allows ad requests.
• Ad requests use Google's unspecified treatment, and ad content is limited to the T rating.
• Where required, the UMP choice screen is shown. On iOS, App Tracking Transparency permission may be requested only where applicable; if you decline, limited, technical, or non-personalized ads are served where supported.
• Where UMP requires an entry point, you can change your choices again in Settings › Advertising and privacy › Advertising privacy choices.

A banner ad may appear at the bottom of the home screen. When you add an extra alarm, the app first explains the reward (one more alarm) and how to decline, and shows a rewarded interstitial ad only if you choose it. No ad is shown after you finish a checklist.

6. Purposes and legal grounds

Local alarm, checklist, photo, and recording information is processed to provide the features you request. Group identity, metadata, encrypted content, and push tokens are processed to provide the group features you request (joining, sharing, sync, notifications, account recovery and deletion). Reports, evidence, sanction records, and rate limiting are processed to protect users, enforce the terms, and maintain security and prevent abuse. Required device settings and consent states are processed to operate the service and meet legal obligations. Where the law requires it, Analytics, personalized ads, tracking, and sending evidence or diagnostics rely on consent. Security, fraud prevention, limited ads, diagnostics you allow, and service improvement may rely on contract performance or legitimate interests where the applicable law permits.

7. Retention and deletion

• Check history is automatically kept for the most recent 90 days, and you can delete it in Settings.
• Alarms, checklists, photos, and recordings are kept until you edit or delete them, reset the app data, or uninstall the app. Copies may remain depending on operating system backups.
• Collaborative checklist results are deleted 30 days after their last update, and result photos within one day after that. An ended collaborative checklist is deleted after 30 days.
• A group with no activity for one year is closed after advance notice, and its content is deleted. A group identity unused for 400 days is deleted automatically.
• Report evidence is deleted 60 days after the operator's decision. A report left unhandled for 90 days closes automatically, and its evidence is deleted 30 days later. Operator action audit records are kept for 90 days.
• Diagnostics you send and server error records are deleted automatically after 30 days. Server operation logs are kept for no more than seven days.
• Deleting your group account removes your credentials, recovery information, key vault, sessions, push token, consent and block records, profile, and the group content you posted, and removes you from your groups. Report and sanction records are kept with your identity replaced by a pseudonym, and the public keys and deletion record needed to verify past signed group rosters are kept for up to 400 days after deletion completes. If an automatically deleted identity remains on a group roster, this cleanup may wait until an administrator removes it or the group closes.
• Turning Crashlytics off deletes unsent reports held by the app. Turning Analytics off stops future collection; data already processed follows Firebase retention settings.
• Advertising, consent, Analytics, push, and diagnostic information processed by Google is kept according to Google's terms and retention settings.

8. Service providers and international transfers

• Cloudflare, Inc. (United States): runs the group server, database, and file storage, and stores report evidence and diagnostics. It receives the group information in section 3 (content in encrypted form) over the network when you use groups and processes it in Cloudflare data centers, kept as described in section 7. The group database and file storage are set to the Asia-Pacific region, and requests are handled in a Cloudflare data center near you.
• Google LLC and affiliates (United States and elsewhere): Firebase Analytics and Crashlytics, AdMob, UMP, and Android push notifications (Firebase Cloud Messaging). They receive the identifiers, IP-based approximate location, app and ad interactions, and diagnostics described above, plus push tokens and notification metadata, for analytics, ad serving and measurement, consent management, security, crash diagnostics, and notification delivery.
• Apple Inc. (United States): iOS push notifications (Apple Push Notification service), processing the push token and the notification metadata in section 3.3.

Data is sent over encrypted connections and may be processed in the United States and in other countries where these providers or their subprocessors operate facilities. Safeguards follow each provider's service documentation and contracts. You can avoid group-related transfers by not using groups or by turning group notifications off, and you can refuse optional transfers by turning off Firebase collection in Settings and changing your UMP choices. Local alarms keep working either way. We do not sell personal information.

See how Google uses information from partner sites, the Google Privacy Policy, Firebase privacy and security, Google business data protection, the Cloudflare Privacy Policy, and the Apple Privacy Policy.

9. Your choices and regional rights

In Settings › Advertising and privacy you can change Analytics and crash diagnostics and open Advertising privacy choices. You can also decline iOS tracking permission, delete check history or local content, or uninstall the app.

You can delete your group account at the bottom of Settings › Group account management. If you lost your device or uninstalled the app, you can delete it with your recovery code on the group account deletion page. Because group content is end-to-end encrypted and we cannot view it, please view or correct it in the app.

• EEA, UK, and Switzerland: where applicable, you have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority.
• United States, including California: where applicable, you may request access, correction, or deletion and opt out of sale, sharing, targeted advertising, or profiling. sunlitwater.com does not sell personal information, and you can limit ad sharing in your UMP choices.
• Republic of Korea: you may request access, correction, deletion, suspension of processing, or withdrawal of consent and may contact the privacy team or the competent authority, such as the Personal Information Protection Commission.

We will not treat you differently for exercising your rights. We may ask for the minimum information needed to verify and answer a request (for example, a diagnostics support code), but please do not send alarm content, photos, your recovery code, or identity documents unless we specifically ask and it is necessary.

10. Security, changes, and contact

We use platform sandboxing, permission controls, encrypted connections, end-to-end encryption and signature verification for group content, separate encryption for report evidence, multi-factor authentication for operator access, rate limiting, and collection-off defaults while regional privacy requirements are being determined. No storage or transmission method is completely secure.

We may update this policy to reflect changes to the app, the law, or third-party services. Material changes are reflected in the effective date on this page and announced in advance in the app or on our support page.