Privacy Policy

1. Who we are and how to contact us

Wakin is operated by its developer, established in the Republic of Türkiye (the “Company”). For the purposes of Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, the Company is the data controller of the personal information described in this Policy.

You can reach us about anything in this Policy, including requests to exercise your rights, at hello@wakin.app. We aim to answer every privacy enquiry within 30 days.

2. Definitions

• “Personal Information” means any information that relates to an identified or identifiable individual.
• “Device Data” means Personal Information that is stored only in the Wakin application’s private storage on your phone and is never transmitted to us.
• “Group Data” means the limited Personal Information transmitted to our servers when you use the Friend Groups feature, as described in Section 4.
• “Mission” means a task the application asks you to complete before an alarm is dismissed, such as solving a math problem, taking a photograph or shaking the phone.
• “Store” means the Apple App Store or Google Play, through which the application is distributed and subscriptions are billed.
• “Processor” or “Sub-processor” means a third party that processes Personal Information on our behalf and under our instructions.

3. Information that stays on your device

Wakin does not require you to create an account and does not ask for your email address, phone number, contacts or location. The information below is created by your use of the application and is stored exclusively in the application’s private storage on your device. We have no access to it, it is not backed up to our servers, and it is not shared with anyone. You may review it in the application and erase all of it at any time with the “Delete all my data” option in Settings.

4. Mission verification data (camera, microphone and motion)

Several Missions use your device’s camera, microphone or motion sensors to verify that you have completed the task. All of this processing happens in real time on your device. Wakin does not store photographs, video, audio or sensor recordings, and does not transmit them to our servers. The related permissions are requested only when you select a Mission that needs them, and you can revoke each permission at any time in your device settings; the Mission will then be unavailable until the permission is granted again.

We do not create or store biometric identifiers or facial-recognition templates. The smile Mission checks only whether a smiling face is present in the frame at that moment.

5. Information we process for Friend Groups

Friend Groups is an optional feature that lets a small circle of people see whether each of them got up on time. Unless you create or join a group, the application never contacts our servers. When you do, the following happens:

6. Information collected automatically

The Wakin application contains no analytics, crash-reporting, attribution or advertising software development kits and does not collect usage statistics, advertising identifiers or precise or approximate location. It does not use cookies or similar tracking technologies.

When the application communicates with our backend for Friend Groups, our hosting provider automatically receives technical connection data such as your IP address, request timestamps and the application version, which it processes to deliver the service, maintain security and diagnose faults. We do not use this data to identify or profile you.

The wakin.app website is served by Cloudflare, Inc., which processes standard connection logs (such as IP address, browser type and the pages requested) for a limited period in order to deliver the site and protect it from abuse. The website loads fonts and icons from Google Fonts; that request transmits your browser’s IP address to Google LLC. The website sets no cookies and contains no analytics or advertising.

7. Notifications

Alarms, bedtime reminders, the “Are you awake?” check, streak reminders and summary notifications are scheduled locally by the application using the operating system’s notification services. Wakin does not operate or use a push-notification server; the content of your notifications never leaves your device.

8. Subscriptions and payments

Wakin is offered as a paid subscription with a free trial. All purchases are made through the Store, which handles payment processing under its own terms and privacy policy. We never receive your card number, billing address or other payment details. The Store provides us only with the information needed to confirm your entitlement, such as the product purchased, the subscription status and an anonymised transaction identifier.

9. How we use information

We use the information described in this Policy only for the following purposes:

• To provide the Services, including ringing alarms, verifying Missions, calculating streaks and badges and operating Friend Groups.
• To confirm your subscription entitlement.
• To maintain the security, integrity and availability of our backend and website, including detecting and preventing abuse.
• To respond to your enquiries and requests.
• To comply with legal obligations and to establish, exercise or defend legal claims.

We do not use any information to serve advertising, to build marketing profiles, to train machine-learning models, or for any purpose incompatible with those listed above.

10. Legal bases for processing

Where KVKK, the GDPR or the UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)): to provide the Services you have requested, including Friend Groups when you choose to use them.
• Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)): to keep the Services secure and reliable and to prevent abuse, in ways that do not override your interests or rights.
• Legal obligation (KVKK Art. 5(2)(a) and (ç); GDPR Art. 6(1)(c)): where we must retain or disclose information under applicable law.
• Consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)): for device permissions such as camera and microphone access, which you grant through your operating system and may withdraw at any time.

11. How we share information

We do not sell Personal Information, and we do not share it with third parties for their own marketing purposes. We share information only as follows:

• With Processors that host and operate parts of the Services on our behalf, listed in the Sub-processors paragraph below, under agreements that restrict them to processing on our instructions.
• With other members of a Friend Group, limited to the Group Data described in Section 5.
• With the Store, in connection with your subscription, as described in Section 8.
• With competent authorities, courts or other third parties where disclosure is required by law, by a binding order, or is necessary to protect the rights, safety or property of Wakin, our users or others.
• With a successor in the event of a merger, acquisition or transfer of the Services, in which case this Policy will continue to apply to the information transferred and you will be notified of any material change.

We will update this list when a Sub-processor is added or replaced.

12. International transfers

Wakin is operated from Türkiye. Group Data is hosted by Supabase, Inc. and website logs by Cloudflare, Inc., whose servers may be located outside Türkiye, the European Economic Area and the United Kingdom, including in the United States. Where information is transferred from the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum entered into with those providers, together with their technical and organisational safeguards. Transfers from Türkiye are carried out in accordance with KVKK Article 9. Device Data is never transferred because it never leaves your device.

13. Data retention

We keep Personal Information only for as long as necessary for the purposes described in this Policy:

• Device Data: retained on your device until you delete it in the application, use “Delete all my data” or uninstall the application. Uninstalling removes all Device Data.
• Mission verification data (camera frames, audio, sensor readings): processed in memory and discarded immediately; never retained.
• Group Data: retained while you remain a member of the relevant group. When you leave a group, or use “Delete all my data” (which leaves every group), your membership record is deleted. A group, together with its invite code, debts and membership records, is deleted automatically when its last member leaves.
• Anonymous identity and any remaining Group Data: erased within 30 days of a deletion request made to the address in Section 1. Copies in our hosting provider’s backups expire with the provider’s normal backup rotation and are not used for any other purpose.
• Website and backend connection logs: retained by our hosting providers for a limited period for security and diagnostics, in accordance with their policies.
• Correspondence with us: retained for as long as needed to handle your request and, where applicable, to comply with legal obligations.

14. Security

We apply technical and organisational measures appropriate to the limited data we process, including:

• Keeping the vast majority of Personal Information on your device, protected by the operating system’s application sandbox, so that there is nothing for us to lose.
• Encrypting all communication between the application, the website and our servers in transit using TLS.
• Row-level security rules on the backend so that each installation can access only its own groups’ data, with all writes performed through server-side functions.
• Anonymous authentication for Friend Groups, so that no credentials of yours are stored with us.
• Restricting administrative access to our backend to authorised personnel.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your Personal Information, we will notify you and the competent authority as required by applicable law.

15. Your rights and choices

Depending on where you live, you may have the following rights in relation to your Personal Information:

• Access: to learn whether we process your Personal Information and to receive a copy of it.
• Rectification: to have inaccurate or incomplete information corrected.
• Erasure: to have your Personal Information deleted.
• Restriction and objection: to restrict or object to certain processing, including processing based on legitimate interests.
• Portability: to receive the information you provided in a structured, commonly used, machine-readable format.
• Withdrawal of consent: to withdraw consent at any time, for example by revoking a device permission, without affecting the lawfulness of processing before withdrawal.
• Complaint: to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, in the EEA or the UK, with your local supervisory authority.

16. Additional information for residents of the European Economic Area, the United Kingdom and Switzerland

If you are in the EEA, the UK or Switzerland, the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing. The legal bases we rely on are listed in Section 10 and the safeguards for international transfers in Section 12. We do not process special categories of personal data: the audio processed in the “Read aloud” Mission is not retained, and no biometric templates are created from camera frames. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

17. Additional information for California residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), may give you the rights to know, access, correct and delete Personal Information, to opt out of its sale or sharing, to limit the use of sensitive Personal Information and not to be discriminated against for exercising these rights. Wakin does not sell Personal Information, does not share it for cross-context behavioural advertising, and does not use sensitive Personal Information for purposes other than providing the Services. In the preceding twelve months we have collected only the categories of information described in Sections 3 to 8, for the purposes in Section 9, and disclosed them only to the recipients in Section 11. You may exercise your rights using the contact details in Section 1. We do not respond to browser “Do Not Track” signals, as the Services do not track users across third-party sites.

18. Children

The Services are not directed at children under the age of 13 (or under 16 where local law sets a higher threshold), and we do not knowingly collect Personal Information from them. Because the application requires no account, we rely on the age ratings and parental controls of the Store. If you believe a child has provided us with Personal Information through Friend Groups, please contact us and we will delete it promptly.

19. Third-party links and services

The Services may contain links to third-party websites and services, such as the Store pages of the application or the speech-recognition services of your operating system. We are not responsible for the privacy practices of those third parties, and we encourage you to review their policies.

20. Changes to this Policy

We may update this Policy from time to time to reflect changes in the Services, in the law or in our practices. The current version is always published at wakin.app/privacy together with its effective date. If a change materially affects how we use your Personal Information, we will give you notice in the application before the change takes effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

21. Contact

Wakin, operated from the Republic of Türkiye. Email: hello@wakin.app. Website: wakin.app. You may write to us in Turkish or English.