privacy policy

who we are

honeybear llc is a connecticut limited liability company located at 39 mill plain rd, danbury, ct 06811, united states. for any privacy question, contact us at support@wakeupapp.io. honeybear is the data controller for personal data processed under this policy.

information we collect

1. a.account information. when you sign in (with apple, email, or another supported method), we receive your email address, a unique apple user id (if you use sign in with apple), display name, and any profile photo you upload.
2. b.alarm and wake-up data. your goal wake time, alarm history, streaks, completed challenges, journal entries, and notification preferences.
3. c.sleep and health data (healthkit). if you grant permission, we read sleep, bedtime, and wake-time data from apple health to compute your wind-down grade and sleep summaries. this data stays on your device and in your private icloud account when synced.
4. d.subscription information. whether you have an active subscription, plan type, renewal status, and a revenuecat anonymous user id. apple processes your payment. we never see or store your payment card details.
5. e.device and diagnostic data. ios version, device model, app version, language, time zone, and crash and performance logs.
6. f.support communications. when you email us, we receive your email address, message, and any attachments you send.
7. g.website analytics. if you visit wakeupapp.io, we may receive standard server logs (ip address, browser type, pages viewed, referrer). we do not use third-party advertising cookies.

how we use your information

we use your information to:

1. a.operate the service, including running alarms, scheduling notifications, syncing your data across your devices, and computing your stats and wind-down grade;
2. b.verify your subscription and apply the right entitlements;
3. c.respond to your support requests;
4. d.fix bugs, prevent abuse, and improve the service;
5. e.send service-related messages (for example, important changes to the app or to this policy);
6. f.comply with legal obligations.

legal bases (eu and uk users)

we rely on the following legal bases under the gdpr and uk gdpr:

1. a.performance of a contract, to provide the service you requested;
2. b.legitimate interests, to keep the service secure, fix bugs, and prevent abuse;
3. c.consent, for healthkit access, push notifications, and any optional data you choose to provide (you can withdraw consent at any time in ios settings or inside the app);
4. d.legal obligation, where we must process data to comply with the law.

healthkit privacy (apple guideline 5.1.3)

we do not sell healthkit data. we do not use healthkit data for advertising or any similar service. we do not share healthkit data with third parties for marketing, advertising, or data brokerage. we do not use healthkit data for any purpose other than improving health, fitness, or sleep features inside the wake up app.

sharing your information

we do not sell your personal information. we do not share your personal information for cross-context behavioral advertising. we share information only with:

1. a.service providers that help us run the service, including:
   • supabase (account, profile, and app data storage, hosted in the united states),
   • revenuecat (subscription entitlement management),
   • apple (sign in with apple, app store payments, push notifications, healthkit, icloud);
2. b.legal and safety, when required by law, subpoena, court order, or to protect the rights, property, or safety of honeybear, our users, or others;
3. c.business transfers, if we are involved in a merger, acquisition, or sale of assets, in which case we will notify you and any new owner will be bound by this policy.

these providers are contractually required to protect your data and use it only to provide services to us.

data retention

we keep your information for as long as your account is active. when you delete your account, we delete or anonymize your personal information within 30 days, except where we must retain it for legal, accounting, or fraud-prevention reasons. crash logs and aggregated analytics may be kept for up to 12 months.

your rights

depending on where you live, you may have the right to:

1. a.access the personal information we hold about you;
2. b.correct inaccurate information;
3. c.delete your information;
4. d.export your information in a portable format;
5. e.object to or restrict certain processing;
6. f.withdraw consent (where processing is based on consent);
7. g.lodge a complaint with a data protection authority.

to exercise any of these rights, email support@wakeupapp.io. we will respond within the timeframes required by law (generally 30 days under gdpr, 45 days under ccpa). you can also delete your account directly inside the app under settings.

california residents (ccpa and cpra)

if you are a california resident, you have the right to:

1. a.know what personal information we collect, use, disclose, and retain;
2. b.delete personal information we collected from you;
3. c.correct inaccurate personal information;
4. d.opt out of the sale or sharing of personal information (note: we do not sell or share personal information as those terms are defined under the cpra);
5. e.limit the use of sensitive personal information (we use sensitive information only for permitted purposes);
6. f.be free from discrimination for exercising these rights.

to make a verifiable consumer request, email support@wakeupapp.io with the subject "california privacy request". we will verify your identity using information you have already provided, such as your account email.

children's privacy

the service is not directed to children under 13. we do not knowingly collect personal information from children under 13. if you believe a child under 13 has provided us with personal information, contact us at support@wakeupapp.io and we will delete it.

international data transfers

we are based in the united states. if you use the service from outside the united states, your information will be transferred to and processed in the united states and other countries that may have different data protection laws than your country. where required, we use appropriate safeguards such as the european commission's standard contractual clauses.

security

we use industry-standard administrative, technical, and physical safeguards (including encryption in transit and at rest, access controls, and supabase row-level security) to protect your information. no system is perfectly secure, so we cannot guarantee absolute security.

third-party links

the service may contain links to third-party sites or services. we are not responsible for their privacy practices. please review their policies before sharing information with them.

changes to this policy

we may update this policy from time to time. if changes are material, we will let you know by email, in-app notice, or by updating the "last updated" date above. continued use of the service after the change takes effect means you accept the updated policy.

contact us