Nasty Alarm – Privacy Policy

DRAFT – not yet legal advice / not yet reviewed. Everything in [SQUARE BRACKETS] is a placeholder or a decision that must be filled in before publishing. Blocks marked "Drafting note" are for Ashka only and must be deleted before publishing. Sections marked (PLANNED) describe features that are not live yet: delete them until the feature ships, or keep them and clearly label them as future features. The policy must only describe what the published version of the app actually does.

• App: Nasty Alarm (Android, package com.nastyalarm.app)
• Developer / data controller: Ashka Po, individual developer, the Netherlands
• Contact: support@nastyalarm.com
• Postal address: [POSTAL ADDRESS – optional for a personal developer, but recommended; see Drafting note]
• Effective date: [EFFECTIVE DATE]
• Last updated: [LAST UPDATED DATE]

1. Who we are

Nasty Alarm ("the app", "we", "us") is an alarm clock app developed and operated by Ashka Po, an individual developer based in the Netherlands. For the purposes of the EU General Data Protection Regulation (GDPR), Ashka Po is the data controller for the personal data described in this policy.

If you have any question about this policy or your data, contact us at support@nastyalarm.com.

Drafting note: GDPR Art. 13 requires the controller's identity and contact details. An email address is usually enough for a small individual developer. If you become a "trader" on Google Play (see the Declarations checklist), Google will display your address publicly in the EU anyway, so consider whether to use a business address or register a business (eenmanszaak) with the KvK.

2. Summary

• Nasty Alarm is for users aged 16 and older.
• Alarms, tones, and challenge settings stay on your device. We do not upload them.
• You can use the alarm features [without signing in / only after signing in – CONFIRM].
• If you sign in with Google and use Crews, we store your display name, your account ID, your crew memberships, invite codes you create, and your awake/ringing/sleeping status in Google Firebase.
• We do not sell your personal data.
• You can delete your account and data at any time: see https://nastyalarm.com/delete-account.html.

3. Data processed only on your device (not collected)

The following stays on your device and is not sent to us or to any third party:

• Your alarms (times, repeat days, labels).
• Tone, volume, and vibration settings.
• Wake-challenge settings and results (math, typing, memory, sequence, and cartoon-video quiz).

If you uninstall the app or clear its storage, this data is deleted. [CONFIRM: is local data included in Android Auto Backup (android:allowBackup)? If yes, add: "If you have Android backup enabled, Android may back up this data to your own Google account under Google's terms. We cannot access that backup."]

4. Data we collect when you sign in and use Crews

Signing in with Google is [optional / required – CONFIRM] and is needed to use Crews (groups of friends who can see each other's morning status).

Who can see this data: your display name, [profile photo,] and morning status are visible to the members of your crews. [CONFIRM / FIX: the current Firestore rules let any signed-in user read any user profile document. Either restrict this to crew members (recommended) or change this sentence to: "...are visible to other signed-in users of the app, including your crew members."]

Technical data processed by Google Firebase: when the app connects to Firebase, Google processes technical data such as your IP address and device/request information in order to deliver the service and keep it secure. We do not use this data to track you.

[CONFIRM: Does the app include Firebase Analytics, Crashlytics, or any other analytics or crash-reporting SDK? If yes, add a section that describes it. If no, keep this sentence: "We do not use analytics or crash-reporting tools."]

5. (PLANNED) Features that will process extra data

Delete each subsection that is not live in the published version, and add it back when the feature ships.

5.1 Push notifications (Firebase Cloud Messaging)

So friends can wake each other, the app will store a push notification token (a device identifier issued by Firebase Cloud Messaging) in a private part of your account that only you and our server functions can access. We use it only to deliver wake requests and app notifications. You can turn off notifications in your Android settings at any time.

5.2 Advertising

The app may show ads provided by [AD NETWORK NAME, e.g. Google AdMob]. The ad network may collect your device's advertising ID, IP address (used to estimate your approximate location), and information about your interaction with ads, in order to show and measure ads and prevent fraud. The ad network processes this data under its own privacy policy: [AD NETWORK PRIVACY POLICY URL].

• EU/EEA/UK users: personalised ads are only shown if you give consent through the consent message shown in the app. You can change your choice at any time in [IN-APP PATH, e.g. Settings > Privacy > Ad choices].
• You can reset or delete your advertising ID in your Android settings (Settings > Privacy > Ads).

5.3 Paid features or subscriptions

If the app offers paid features, payments are handled by Google Play Billing. We do not receive your card or payment details. We receive from Google only the information needed to confirm your purchase (for example, a purchase token, the product purchased, and its status) and link it to your account.

6. Legal bases (GDPR)

7. Service providers and where data is stored

We do not sell or rent your personal data. We share it only with service providers who process it on our behalf:

• Google LLC / Google Ireland Ltd. – Firebase (Authentication, Cloud Firestore[, Cloud Messaging, Cloud Functions]). Firestore data is stored in the EU multi-region eur3 (data centres in Europe). Firebase Authentication and some other Firebase services may process data outside the EU, including in the United States. For those transfers Google relies on the EU–U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Firebase privacy information: https\://firebase.google.com/support/privacy
• Google Play (app distribution[, billing]).
• (PLANNED) [AD NETWORK NAME], as described in section 5.2.

We may also disclose data if the law requires it, or to protect our rights, our users, or the public.

8. How long we keep data

• Account and Crews data: until you delete your account. We then delete it from our live database within [30] days. [CONFIRM how deletion is implemented]
• Invite codes: [until the crew is deleted / for [X] days – CONFIRM]
• Wake requests: [X days – CONFIRM / until account deletion]
• Push token (PLANNED): until you sign out, delete your account, or the token expires.
• Purchase records (PLANNED): as long as tax and bookkeeping law requires (in the Netherlands generally 7 years).
• Local data: stays on your device until you delete it or uninstall the app.

9. Your rights

9.1 EU/EEA and UK users (GDPR)

You have the right to access, correct, delete, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time (this does not affect processing that took place before you withdrew). To use these rights, email support@nastyalarm.com. We will reply within one month. You also have the right to complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (https\://autoriteitpersoonsgegevens.nl), or you can contact the authority in your own country.

9.2 California residents (CCPA/CPRA)

• Categories collected: identifiers (account ID, display name, email[, push token, advertising ID]); internet or other electronic network activity (in-app status and crew activity); [commercial information (purchases) – PLANNED].
• Sources: you, your Google account, and your device.
• Purposes: as described in sections 4–6.
• Sale / sharing: we do not sell personal information. [Until ads ship:] We do not "share" personal information for cross-context behavioural advertising. [When ads ship, replace with: "If you allow personalised ads, the ad network may receive identifiers, which may count as 'sharing' under California law. You can opt out at [IN-APP PATH]."] The app is intended for users aged 16 and older, and we do not knowingly sell or share the personal information of consumers under 16.
• Your rights: to know, delete, and correct your data, to opt out of sale/sharing, and not to be discriminated against for exercising these rights. Send requests to support@nastyalarm.com. We may need to verify your identity, for example by asking you to send the request from within your signed-in account.

Drafting note: The CCPA formally applies only to businesses above certain thresholds (for example, more than USD 25 million in annual revenue), which a solo developer is unlikely to meet. Including this section voluntarily is harmless and helps with US users' expectations.

9.3 Other regions (Canada, Australia, other US states)

Wherever you live, you can ask for access to, correction of, or deletion of your personal data by emailing support@nastyalarm.com. Canadian users can also contact the Office of the Privacy Commissioner of Canada. Australian users can also contact the Office of the Australian Information Commissioner (OAIC).

10. Minimum age and children

Nasty Alarm is intended for users aged 16 and older. It is not directed at children, and it does not take part in Google Play's Designed for Families program. You must be at least 16 to use the app's online features (Google Sign-In and Crews).

We do not knowingly collect personal data from anyone under 16. If we learn that we have collected personal data from a person under 16, we will delete it. If you are a parent or guardian and believe your child has given us personal data, contact us at support@nastyalarm.com and we will delete it.

Drafting note: 16+ matches the Netherlands' GDPR age of digital consent (Art. 8 GDPR / UAVG) and keeps the app outside COPPA and the Families policy. The Play Console target audience, the store listing, the screenshots, and the in-app experience (including the cartoon-video quiz) must be consistent with a 16+ audience. Avoid marketing to "schoolchildren"; "students" is fine. Consider adding a simple age confirmation ("I am 16 or older") before sign-in.

11. Security

Data is encrypted in transit between the app and Firebase (HTTPS/TLS) and is stored on Google's infrastructure. Firestore security rules limit who can read and write each record. No system is perfectly secure, but we take reasonable measures to protect your data.

12. Permissions the app uses

None of these permissions are used to collect personal data.

13. Changes to this policy

We may update this policy. We will change the "Last updated" date and, for important changes, notify you in the app.

14. Contact

Ashka Po – support@nastyalarm.com – [POSTAL ADDRESS, optional]