Política de privacidad

DRAFT — owner review (not legal advice). No lawyer has reviewed this text. Every data claim below is mapped to code in docs/specs/upa-v1/section-12-legal-store.md (Implementation Log); the Section 17a / 17b / 17c claims (§3A and the account, group, clip and wake-up control rows) in legal/README.md "Section 17a / 17b / 17c changes". Fill every [BRACKET] and remove this banner before publishing. Keep it in sync with docs/store/privacy-label.md.

Upa Alarm Privacy Policy

Version 1.0 · Effective date: October 9, 2026

This policy explains what the Upa Alarm app (the "App") does with your information. Upa Alarm is operated by Ganavo LLC, a Massachusetts limited liability company ("Ganavo", "we", "us"), which is responsible for the information described here. See also our Terms of Service. We keep the App Store privacy label consistent with this policy.

1. The short version

• Accounts are optional. Alarms, missions and your subscription work without one, with an anonymous ID. Only the Friends features (friends, groups and wake-up control) need an account, made with Sign in with Apple. Then we keep the email address Apple shares (it can be a private relay address), your profile, your friends, your groups and the days you won or missed, and your friends and groups see part of it, including your time zone (Section 3A).
• Most of Upa Alarm runs on your phone. Your alarms, history, settings, imported sounds and mission videos stay there (if you sign in, we also keep which days you won or missed). Body tracking for camera missions and step counting for the walking mission happen on the phone, and nothing from the camera leaves it except the photo in a photo mission and a clip you choose to share with your groups.
• From your missions, only three things leave your phone, and only when you use them: the photo in a photo mission (checked by Anthropic's AI) and, only when the phone isn't sure it heard you, the recording of a Bible reading attempt (transcribed by ElevenLabs), which we don't store; and a clip of a mission you won that you choose to share with your groups (its last 20 seconds, checked first by Anthropic's AI), which we keep for 7 days for those groups (Section 3A).
• Friends can set an alarm for you only if you let them. You choose who, the missions they may pick (your Friend limits), and you can delete their alarms or turn access off at any time. A voice message a friend records for your alarm is transcribed by ElevenLabs and checked by Anthropic's AI before it reaches you; we never store the transcript and keep the recording at most about 3 days (Section 3A).
• Notifications are optional. If you allow them, we keep a push token for your phone so we can tell you about friend requests, new clips in your groups and alarms friends set for you (Section 3A).
• No ads, no tracking, no session replay, no analytics SDKs, and we don't sell or share your information for advertising. You can turn our basic usage counts off in Settings.
• A few setup questions. You can tell us your gender and age group (or skip them), and we ask how many alarms you set and how often you snooze. They reach us as short codes, and we only look at totals (Section 3).
• Delete my data (Settings; it reads Delete my account and data when you're signed in) deletes everything our servers hold about you, including your account.

2. What stays on your phone

These never reach our servers:

• Alarms and settings: alarm times, repeat days, the optional label you type, mission choices and difficulty, sound choices, theme, language, and whether you've seen the one-time notices.
• Your history: up to 365 wake-up records (alarm time, start and finish times, mission, result, time taken, reps, and a link to the video file if one was kept) and a log of up to 200 alarm times, used for your streak and stats.
• Camera missions: the camera image is analyzed on the phone (Apple's Vision framework) to find body points and count reps. Those body points and the camera frames are never sent anywhere.
• Walking mission: with your permission (Motion & Fitness), the phone's motion sensor (Apple's Core Motion) counts your steps while the mission runs. The step count stays on the phone (your history keeps the goal you reached) and is never sent anywhere.
• Mission videos: recorded on the phone without a sound track, up to 4 minutes, in a temporary folder, during live camera and photo missions. The App deletes its copy when you leave the "Watch it back" screen. A copy you saved to Photos (by tapping Save, or with "Auto-save mission videos" on) or shared to another app stays there. You can turn recording off in Settings ("Record my missions"). We upload a video only when you share it to a group, and then only its last 20 seconds (Section 3A).
• Imported sounds: files you import are copied into the App's storage on your phone and never uploaded.
• Alarms friends set for you (Section 3A) are saved on your phone like your own alarms, marked with the friend's name and picture. A friend's voice message is saved on your phone with its alarm and deleted 12 hours after the alarm rings, or when you delete the alarm.
• Bible mission: the list of verses you read in the last 14 days (so they don't repeat). Speech recognition runs on the phone when your iPhone supports it for your language (Section 5).
• Technical items: your sign-in token (for your anonymous ID, or your account once you sign in with Apple), your last known subscription status (so alarms work offline), the App's alarm schedule records and, if you use Friends, a copy of your profile, friends and groups so the Friends tab opens quickly, plus a clip waiting to be uploaded until its upload ends.

3. What reaches our servers

Our servers run on Supabase (database and server functions). Without an account they hold only these items, each tied to your anonymous ID. If you sign in with Apple, the same ID becomes your account's ID, so these items stay linked to it, and Section 3A adds the rest:

Usage events are limited to: onboarding_step, onboarding_answer, paywall_view, purchase_success, purchase_failed, alarm_created, mission_started, mission_completed, mission_switched_to_math, mission_emergency_stop and photo_check, plus, for the Friends features, social_intro_view, apple_link, profile_saved, friend_code_shared, friend_request_sent, friend_request_answered, push_permission, group_created, group_joined, group_invite_shared, clip_shared, post_reacted and content_reported (short codes such as where you opened the Friends tab, the sign-in result, the rooster you picked, whether you allowed notifications, how many groups you shared a clip to, a reaction, or a report's reason). Our server rejects any other event name. Each event carries at most 12 small values: short codes (letters, digits and _ . : - only, up to 40 characters), numbers or yes/no. The App drops anything else before sending, such as text with spaces, emails, file paths, lists or images. We don't put alarm labels, names, transcripts or device identifiers in events. Events never name the Bible mission: the App drops that value before sending, and our server drops it again if it ever arrives (Section 10).

Onboarding answers. If you skip "A bit about you", nothing about your gender or age is sent (the event just says skip). The codes are the buckets you tapped (for example 25_34 for 25–34, or 3_4 for 3–4 snoozes), never free text. The App keeps your answers on your phone too (until you use Delete my data), and your gender answer picks which motivational quote you see; that choice happens on your phone. We look at the answers only as totals (for example, how many people who use Upa Alarm are 25–34, or how many snooze 3–4 times), never one person at a time.

Turning usage events off. Settings → "Share anonymous usage counts" (on by default). When it's off, the App sends no usage events at all, including the onboarding answers; everything else keeps working. Events already sent stay until you use Delete my data.

Technical logs. When the App contacts our server, Supabase records standard request logs (such as the time, the function called and the IP address) and our functions log errors and timings. We never write photos, audio or transcripts to these logs. Supabase keeps its logs under its own policies.

3A. Optional account, friends, groups and wake-up control (Sign in with Apple)

You only need an account for the Friends tab (friends, groups and wake-up control). Alarms, missions and your subscription never need one. You can sign in from the Friends tab or from Settings → Account.

• What Apple shares. Sign in with Apple gives us a user ID that Apple creates for Upa Alarm and an email address: your real one or, if you choose Hide My Email, a private relay address that forwards to it. Supabase's sign-in service stores the Apple user ID and the email address with your account. We don't use the email address to contact you or for marketing, and other users never see it. Apple may also share your name the first time you sign in: the App uses only your first name, on your phone, to suggest a profile name, and doesn't send it to us.
• Your account keeps your ID. Signing in turns your anonymous ID into your account (the same ID). Your consent record, usage events (including the onboarding answers) and check logs, past and future, are then linked to your account. If you sign in on a phone where you already have an account (for example after reinstalling), the App switches to that account, deletes the new install's anonymous ID and its records, and moves your subscription status to the account (Section 6).
• Apple token. Our server exchanges a one-time code from Apple for a token, which we keep only so that we can ask Apple to end the link between your Apple Account and Upa Alarm when you delete your account (Section 9).

With an account, our servers also hold:

Sharing a clip to groups. After you win a camera or photo mission, "Watch it back" offers Share to groups. Nothing is shared until you pick the groups and confirm. Your phone then cuts the last 20 seconds of that mission's video (960 × 540, no sound), makes a thumbnail and 3 small still frames, and uploads them to our storage under your ID. Members of the groups you picked can watch the clip and react to it; nobody else can, and the App has no button to download it (but, like anything on a screen, someone could record it). A Bible reading never has a video, so it can't be shared.

The AI check of a clip. Before anyone sees a clip, our server sends its 3 still frames, with no ID or name, to Anthropic (Claude), which checks them for nudity or sexual content, violence, weapons, hate symbols, drugs, self-harm, or a minor in an unsafe situation. If the check doesn't give a clear "safe", the clip isn't posted (it is retried a few times if the AI is unavailable). We delete the frames once the clip is approved; if it's rejected, we delete the video, the thumbnail and the frames, and your inbox shows only the category (never anything the AI wrote). The AI can be wrong in both directions. What Anthropic says it does with what it receives is in Section 4. Before your first share, the App tells you that an AI checks a few frames and that they aren't kept.

How long clips last. A shared clip and its thumbnail are deleted 7 days after you share it, or earlier when you delete it (press and hold it), leave the group or are removed from it (your clips in that group go), the group is deleted, or the clip is taken down after reports or by us. A clip shared to several groups is stored once and removed when no group shows it any more.

Wake-up control (friends setting your alarms). Nobody can add an alarm to your phone unless you let that friend (Let … set my alarms, or Allow when they ask). Then they can add one-time alarms for you, 30 minutes to 24 hours ahead, ringing between 5:00 and 11:59 your time, with a mission allowed by your Friend limits (one list for all friends: Settings → Account → Wake-up control) and a sound. You can have at most 2 upcoming friend alarms. They can't see, change or delete your own alarms. You can delete any alarm a friend set, at any time (they get no notification, but their list shows it as removed), pause new ones, or turn access off for that friend; removing or blocking a friend also ends it and cancels their alarms that haven't rung. To deliver an alarm, our server tells your phone through a notification, and the App downloads it when it runs; if it can't, the alarm doesn't ring and the friend sees why. The friend who set an alarm sees whether it reached your phone and, afterwards, whether you won or missed it, with the mission, the count and how long it took.

Voice messages. A friend can record a voice message (3 to 30 seconds), or pick an audio file (we use its first 30 seconds), as the sound of an alarm for you. Before it's delivered, our server sends the audio to ElevenLabs, which transcribes it (the language is detected automatically), and sends the text to Anthropic (Claude), which checks it for harassment, threats, hate, sexual content, encouragement of self-harm, strong profanity and similar content. Neither receives an ID or a name. We never store the transcript, only the check's category, and a refused message is deleted at once. An approved message is stored under the sender's ID for at most 3 days after it was recorded (longer only while an alarm that uses it hasn't rung yet). Your phone downloads it with the alarm and plays it on the ring and mission screens inside the App; the Lock Screen plays one of our built-in loud sounds instead. You can listen to it before the alarm ("Play message (spoils the surprise)"). What ElevenLabs and Anthropic say they do with what they receive is in Sections 4 and 5. Before a friend sends their first voice message, the App tells them an AI checks it.

Your time zone. It comes from your phone's time-zone setting, not from location services. It's a region name such as America/Sao_Paulo, so it shows your friends and the people in your groups roughly where you are (a region, not your location). The App uses it to tell whether you won "today" in your own day and, if a friend may set your alarms, to make their alarm ring at your local time; it updates when you open the App. We don't collect your location.

What other users never see: your own alarms or their times, your missions (except on a clip you share, or the result of an alarm a friend set for you), your history details, videos you didn't share, your email address or your Support ID. A clip you share does show the time you finished that mission.

Notifications (optional). The App asks after a short explanation, never at launch, and nothing depends on allowing them (the inbox works either way). If you allow them, Apple's push service gives the App a device token, and Expo's push service turns it into an Expo push token, which we store as shown above. Our server sends notifications through Expo to Apple: a friend request, an accepted request, a new clip in one of your groups (at most one per group per hour), a note that your clip isn't visible, wake-up control news (an access request, access given or turned off), an alarm a friend set for you (a time-sensitive notification, which can show during a Focus, plus a silent one that lets the App set the alarm in the background), and, for alarms you set, whether they couldn't be set or didn't arrive and whether your friend won or missed. Their visible text contains at most another person's display name, a group name and an alarm time; their hidden data contains only IDs. Turn notifications off in the iPhone Settings app or with the switches in Settings → Notifications. If a different account signs in on your phone, the phone's token moves to that account, so it never gets your notifications.

Keeping it safe. Display names and group names pass a word filter when you save them, and clips pass the AI check. You can report or block someone from their profile, from a friend request in your inbox, or from a group's member list; report or hide a clip (press and hold it); report a group (in its settings); and report an alarm a friend set for you (its sheet). Reporting someone also declines their pending friend request. A report hides that clip from you at once; a clip reported by 2 people, or by the group's admin, is hidden from everyone and its author is told. Blocking someone hides their clips and reactions from you and yours from them (in a group you share, you still see each other's name in the member list). Unblock people in Settings → Account → Blocked people. We (Ganavo) look at reported content to decide, review every report within 24 hours, and may remove a clip, a name, a group or a voice message, end someone's wake-up control, or ban an account (Terms §12A). A banned account disappears from other people's apps.

4. AI photo checks (Anthropic)

• What is sent: after you take the photo, your phone shrinks it (longest side about 1,000 pixels) and saves a new JPEG copy, which leaves out the original's metadata, such as location and camera details. That copy goes to our server with the mission type, the object to find, the difficulty and your language. Our server sends the image and the mission instructions to Anthropic (Claude) for a one-time check. Anthropic doesn't receive your anonymous ID.
• What we keep: nothing of the photo. Our server handles it in memory for that one request and then discards it. Your phone deletes the photo and the resized copy right after the check, pass or fail. Only the photo-check log row in Section 3 remains.
• Photos of you. The "get dressed" mission asks for a head-to-toe photo of yourself, so it shows your face and body. We tell the AI to judge only the clothes and shoes (or the bed, or the object), and never to comment on anyone's body, face, looks, age or identity. We don't use photos to identify anyone or to build face or body templates. For other missions, keep other people out of the frame.
• What Anthropic says (our summary of its published terms for API customers as of October 8, 2026; its policies govern and may change): Anthropic's commercial terms say it doesn't train its models on content customers send through its API. Anthropic says it automatically deletes API inputs and outputs within 30 days, except that content its systems flag for a usage-policy violation may be kept for up to 2 years (and safety scores for up to 7 years), and data may be kept longer where the law requires. See Anthropic's commercial terms and privacy policy.
• Clips you share to groups are checked the same way, from 3 still frames, and so is the text of voice messages friends send for each other's alarms (Section 3A); the summary of Anthropic's terms above applies to them too.
• Before your first photo check, the App shows a short notice once: an AI checks your photo, we don't keep it, and it goes to Anthropic only for this check, with a link to this policy. Nothing is sent until you tap Continue, and you can use math instead.

5. Bible reading checks (Apple and ElevenLabs)

• On the phone first. The App uses Apple's speech recognition and asks for on-device recognition when your iPhone supports it for your language. If on-device recognition isn't available, Apple may process the audio on its servers under Apple's privacy policy. While you read, the phone records the attempt to a temporary file.
• Second opinion, only when the phone is unsure. If the on-device result doesn't match the verse well enough, the recording of that attempt (usually a few seconds; the App stops listening after about 40 seconds) goes to our server with your language, and our server sends the audio and the language code to ElevenLabs (Scribe speech-to-text). ElevenLabs doesn't receive your anonymous ID. We use the returned text only to score that attempt.
• What we keep: neither the audio nor the text. Our server handles them in memory for that one request. The phone deletes the recording right after every attempt, pass or fail. Only the speech-check log row in Section 3 remains.
• What ElevenLabs says (our summary as of October 8, 2026; its policies govern and may change): by default its API keeps request logs and transcripts (a zero-retention mode is offered to enterprise customers; our requests don't use it). Its privacy policy says it keeps data it generates about a person's voice for up to 3 years after the last interaction unless the law requires longer, and that personal data is transferred to the United States. [OWNER-CONFIRM: "We have turned off the ElevenLabs account setting that lets ElevenLabs use API data to improve its models."] See ElevenLabs' privacy policy and terms.
• Voice messages friends record for each other's alarms are transcribed by ElevenLabs too (Section 3A), without a language hint and without any ID; the summary of ElevenLabs' terms above applies to them.
• Before your first Bible mission, the App shows a short notice once: if your phone isn't sure it heard you, an AI double-checks a short clip, we don't keep it, and it goes to ElevenLabs only for this check. Nothing is sent until you tap Continue, and you can use math instead.

6. Purchases (Apple and RevenueCat)

• Apple handles payment. We never see your card or Apple Account details. Apple's privacy policy covers your purchase.
• RevenueCat tells the App whether your subscription is active. It receives your user ID as its app user ID (the anonymous ID, which stays the same when it becomes your account; before that ID exists, for example when you restore a purchase on the welcome screen, a random RevenueCat ID that is then linked to it; if you sign in to an account you already had, the App switches RevenueCat to that account's ID and restores your purchases there) and your purchase and subscription history from Apple (products, dates, prices, renewals, cancellations and refunds), plus basic technical information such as your country, currency and locale. RevenueCat says it uses purchase data to validate receipts, manage access and provide subscription analytics. See RevenueCat's privacy policy.

7. How we use information

Only to: run the features you use (AI photo check, Bible second opinion, subscription access, and, if you sign in, your account, profile, friends, groups, the clips you share, wake-up control and the alarms and voice messages friends send you, calendar restore and the notifications you allowed); keep the friends features safe (name filter, the AI checks of clips and voice messages, your Friend limits, reports, blocks and bans); prevent abuse and control costs (rate limits); keep a record of your consent to the Terms; count basic usage to fix problems and improve the App; look at totals of the onboarding answers to learn who uses Upa Alarm and to decide where to advertise Upa Alarm; and comply with the law or protect rights and safety. We don't use your information to show you ads or to target ads at you, we don't share it with advertisers or ad platforms, we don't build profiles about you, and we don't train AI models on it. Deciding where to advertise Upa Alarm uses only totals (for example, how many users are 25–34), never one person's answers or ID.

8. Who we share with

We share information only with the service providers that run the App, each for the job above, under their own terms, and, for the Friends features, with other users as Section 3A describes:

• Supabase: hosting of our database, sign-in service, server functions and the storage of clips and voice messages. Privacy policy
• Anthropic: AI photo checks (Section 4) and the AI checks of clips you share and of voice messages' text (Section 3A).
• ElevenLabs: speech-to-text second opinion (Section 5) and transcription of voice messages for friends' alarms (Section 3A).
• RevenueCat: subscription status (Section 6).
• Expo (650 Industries, Inc.): delivery of push notifications, if you allow them (Section 3A). Privacy policy
• Apple: App Store distribution, billing, alarms, Sign in with Apple, push notification delivery, and speech recognition when it isn't on-device.
• Other Upa Alarm users: only if you create a profile, and only what Section 3A says they see (your friends, the people in your groups, anyone you're in a friend request with, and a friend you let set your alarms).

We may also disclose information when the law requires it, or to protect the rights, property or safety of users, Ganavo or others. If Ganavo's business is sold or merged, information may move to the new owner under this policy. We don't sell personal information or share it for cross-context behavioral advertising. Our own marketing decisions (such as which age groups to reach with ads for Upa Alarm in other apps and sites) use only totals of the onboarding answers; we never give your answers or your ID to an advertiser or ad platform. The App has no ads, no ad or analytics SDKs, no session replay and no cross-app tracking, so it never asks for permission to track.

9. How long we keep information, and how to delete it

Delete my data (Settings → Legal & support; Delete my account and data when you're signed in with Apple) permanently deletes your ID on our servers, which deletes your consent record, usage events and check logs with it, and, if you have an account, your account, profile, friendships, friend requests, blocks, group memberships, the clips you shared (files included), your reactions and hides, your wake-up control access both ways, the voice messages you recorded, the friend alarms set for you (and the ones you set that hadn't rung are cancelled), won / missed days, notification devices and the reports you filed. Before that, our server asks Apple to revoke its token, which ends the link between your Apple Account and Upa Alarm. Your friends and groups stop seeing you. A group whose admin you were stays for its other members (the longest-standing member becomes the admin), or is deleted if nobody else is in it. On your phone it removes your alarms (and cancels them with iOS), history, settings, imported sounds, the App's copies of mission videos, clips waiting to be uploaded, alarms friends set for you and their voice messages, a copy of your profile, friends and groups, and a consent record still waiting to be sent, and signs the App out of your ID and out of RevenueCat (later purchases attach to a new ID; your past purchases come back with Restore purchases). It does not delete videos you saved to Photos or shared, cancel your subscription, or delete purchase records that Apple and RevenueCat hold; to ask RevenueCat to delete your purchase record, contact us (Section 15). Copies may remain in our providers' backups or logs until those expire.

Other ways to delete your account.

• Stop using Sign in with Apple for Upa Alarm in your Apple Account settings (Sign in with Apple → Upa Alarm → Stop Using). Apple tells our server, and we delete your account and its data the same way. The App on your phone then signs out, keeps your alarms and starts again with a new anonymous ID.
• If you can't use the App (for example, you lost your phone), sign in with Apple on another iPhone and use Delete my account and data, or write to [SUPPORT_EMAIL]. We'll ask for details that let us find your account (such as your friend code or display name), confirm through the email address linked to it, and delete it within 30 days.
• If Apple's token can't be revoked (for example, it was never stored), we still delete your account. You can end the link yourself in your Apple Account settings, as above.

If you delete the App without using Delete my data first, your records stay on our servers. With an account, sign in with Apple again to get your won / missed days back or to delete it. Without one, we may be unable to find your anonymous ID later. Use Delete my data before deleting the App.

10. Sensitive information

• Religion. Using the Bible-reading mission could suggest something about your religious beliefs. We don't ask about your beliefs. On our servers, the only record that can show you used that mission is the speech-check log (Section 3: the time, whether the check worked and how long it took; deleted after 30 days, Section 9). Usage events never name the Bible mission: the App removes that value before sending and our server removes it again. We use the speech-check log only as described in Section 7.
• Gender and age group. Optional (Section 3). We don't ask about sexual orientation, and we use these answers only as totals, never to decide anything about you. Other users never see them. If you sign in with Apple, they are linked to your account like every usage event (Section 3A). [COUNSEL: once linked, these answers sit next to an email address; confirm nothing else in this section or in §16 needs to change.] [COUNSEL: some U.S. state privacy laws (for example Oregon and Delaware) list "status as transgender or nonbinary" as sensitive data, and the gender answer "Other" could be read that way. Answering is opt-in (Skip is always there); confirm that is enough and whether this bullet needs more.]
• Health and body data. Rep counts and body tracking stay on your phone. We don't collect health data.
• Biometrics. We don't collect face geometry, voiceprints or other biometric identifiers, and we don't use photos, recordings or clips to identify anyone.
• Clips you share show you, and maybe your home and the people or things around you. Share only what you're comfortable with your group seeing. Shared clips never come from the Bible mission (it has no video, and our server refuses a Bible post).

11. Security

Our database uses row-level security: the App can add usage events only under its own ID and can't read them back; it can read its own consent record but not change it; and only our server functions can read or write the check logs and consent records. The App can't read the account and friends tables at all: it gets only what Section 3A allows, through server functions that check friendships, hide blocked people both ways and hide banned accounts. Your ID always comes from your sign-in token, never from what the App sends. Server keys stay on the server and are never in the App. Photos and audio travel over encrypted connections and are never written to our database or logs. Clips and voice messages are kept in private storage under the sender's ID; the App gets them through links that expire after 1 hour, and only for the members of the groups picked or the friend the message is for. No system is perfectly secure; if a breach affects your information, we will notify you and the authorities as the law requires.

12. Children

Upa Alarm is only for adults 18 and older. Creating a profile also asks you to confirm "I'm 18 or older". We don't knowingly collect information from anyone under 18. If you believe a minor is using the App, report them ("Someone under 18") or contact us, and we will delete what we hold. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), as U.S. law requires.

13. Your privacy rights

• Everyone can delete their data at any time with Delete my data. You can also ask us to access, correct or delete your information, or for a copy of it, by writing to [SUPPORT_EMAIL]. Include your Support ID (Settings → Legal & support → Support ID; the "Contact support" email adds it for you) so we can find your records; if you have an account, your friend code helps too. If we can't connect a request to any records, we will tell you. You can change your profile in the App at any time, stop usage events in Settings ("Share anonymous usage counts"), and turn notifications off (Section 3A).
• U.S. state rights (including California). Depending on where you live, you may have the right to know what we collect and how we use it, to access, correct and delete it, to get a portable copy, and to opt out of sale, sharing for targeted advertising, or profiling. We don't sell personal information or share it for cross-context behavioral advertising, we don't target ads at anyone or profile anyone, and we don't use sensitive information to infer characteristics about you. We use totals of the onboarding answers only for our own marketing decisions (Section 7). In the past 12 months we have collected these categories, from you, your device and Apple, for the purposes in Section 7: identifiers (the anonymous ID; the IP address in technical logs; and, if you sign in, the Apple user ID, the email address Apple shares, your display name, friend code and push token); characteristics of protected classifications (gender and age group, only if you answer them); commercial information (subscription history, via RevenueCat); internet or other electronic activity (usage events, including your alarm and snooze answers, and check logs; and, if you sign in, your streaks, won / missed days, friends, groups, reactions, blocks, reports, wake-up control settings and friend alarms); your time zone (a region, not precise geolocation); audio and visual information (photos and recordings, processed for the check and not kept by us; clips you share, kept for 7 days; voice messages for friends' alarms, kept at most about 3 days); and possibly sensitive information (Section 10).
• How we handle requests. We verify a request before acting on it. An authorized agent can ask for you with your signed permission. We answer within 45 days; if we need more time where the law allows, we tell you why and may take up to 45 more. If we decline, you can appeal by replying with "Appeal" in the subject; we answer within the time your state's law sets, and you can contact your state attorney general if you disagree. We won't treat you differently for using these rights.

14. Where information is processed

Upa Alarm is offered in the United States, Mexico, Brazil and other countries. Our database and server functions are hosted in [SUPABASE_REGION, e.g. the United States]. Our providers (including Expo, for notifications) may process information in the United States and other countries under their own policies. If you use the App outside the United States, your information is transferred to the United States. Brazilian users: see Section 16.

15. Changes and contact

We may update this policy. We post each version with its date and, for material changes, tell you in the App before they take effect. Questions or requests: [SUPPORT_EMAIL] · Ganavo LLC, [MAILING ADDRESS].

This policy is written in English, and the English version controls. Section 16 is written in Portuguese for users in Brazil.

16. Aviso de privacidade para usuários no Brasil (LGPD)

Esta seção complementa a política acima para quem usa o Upa Alarm no Brasil, conforme a Lei Geral de Proteção de Dados Pessoais (Lei nº 13.709/2018, "LGPD"). Em caso de conflito, prevalece o que for mais protetivo para você.

• Controlador: Ganavo LLC, [ENDEREÇO POSTAL], [SUPPORT_EMAIL].
• Encarregado / canal de contato: [NOME DO ENCARREGADO OU "canal de atendimento"] — [SUPPORT_EMAIL]. Pedidos sobre seus dados podem ser feitos por esse e-mail, em português.
• Dados tratados: um identificador anônimo; o registro do seu aceite dos Termos (versão, data e hora, idioma); eventos de uso de uma lista fechada, sem texto livre e que nunca indicam a missão bíblica; as respostas do onboarding, como códigos curtos (gênero e faixa etária, só se você responder em "Um pouco sobre você"; quantos alarmes você coloca e quantas vezes usa a soneca por manhã, em "Suas manhãs"); registros das verificações de foto e de fala (data, resultado, tempo de resposta); registros técnicos do servidor (como o endereço IP); e o histórico de assinatura (via RevenueCat). A foto da missão de foto e a gravação da leitura bíblica são processadas só durante a verificação e não são armazenadas por nós. Alarmes, histórico, vídeos e sons importados ficam apenas no seu celular (exceto os clipes que você decide compartilhar com seus grupos, abaixo).
• Conta opcional (Entrar com a Apple, Seção 3A): só para os recursos de Amigos (amigos, grupos e controle de despertar). Se você entrar, tratamos também: o ID de usuário que a Apple cria para o Upa Alarm e o e-mail que a Apple compartilha (pode ser um endereço de retransmissão privado, se você escolher Ocultar Meu E-mail); o perfil (nome de exibição, galo e a cor dele, código de amigo, idioma, fuso horário, preferências de notificação e a data em que você confirmou ter 18 anos ou mais); suas sequências e o horário da sua última vitória; os dias ganhos ou perdidos (até 400 dias); pedidos de amizade, amizades e bloqueios; seus grupos (nome, ícone, cor, código de convite, membros); os clipes que você compartilha (os últimos 20 segundos do vídeo da missão, sem som, uma miniatura e 3 quadros para a verificação, com a missão, a contagem, o dia da sequência e o horário em que você terminou); suas reações e os clipes que você ocultou; o controle de despertar (quem pode colocar alarmes para quem, seus limites para amigos e a pausa); os alarmes que amigos colocam para você (horário, missão, som, status de entrega e resultado: se você ganhou ou perdeu, com a missão, a contagem e o tempo); as mensagens de voz (3 a 30 segundos) gravadas para esses alarmes; denúncias; e, se você permitir notificações, o token de notificação (Expo), um ID aleatório da instalação e o idioma. Seu ID anônimo passa a ser o ID da sua conta, então os dados acima (aceite, eventos de uso e registros) ficam vinculados a ela. Seus amigos e as pessoas dos seus grupos veem seu nome, galo, cores, sequências, o dia da sua última vitória (nunca o horário) e seu fuso horário (um nome de região como America/Sao_Paulo, que indica aproximadamente onde você está; não usamos sua localização); só os amigos veem os últimos 14 dias. Os membros dos grupos que você escolher veem os clipes que você compartilha, por 7 dias. A pessoa com permissão para colocar alarmes para você vê seus limites, se você pausou, o status dos alarmes que colocou e se você ganhou ou perdeu. Ninguém vê seus próprios alarmes, os horários deles, vídeos que você não compartilhou ou seu e-mail. Ninguém pode colocar um alarme no seu celular sem a sua permissão, dada a cada amigo e revogável a qualquer momento; você pode apagar qualquer alarme de um amigo.
• Finalidades e bases legais (art. 7º): prestar o serviço que você contratou, inclusive as verificações por IA e a assinatura (execução de contrato, art. 7º, V); limitar o uso para evitar abuso e custos, manter a segurança e medir o uso básico do app (legítimo interesse, art. 7º, IX, sempre com dados mínimos e sem publicidade; você pode se opor aos eventos de uso desativando "Compartilhar estatísticas de uso anônimas" em Configurações); guardar o registro do seu aceite e atender obrigações legais (art. 7º, II e VI); usar as respostas de "Um pouco sobre você" (gênero e faixa etária) só em totais, para entender quem usa o Upa Alarm e decidir onde anunciar o app (consentimento, art. 7º, I, dado ao responder: as perguntas são opcionais e têm "Pular"; você revoga desativando "Compartilhar estatísticas de uso anônimas" ou usando Apagar meus dados) [ADVOGADO: avaliar se o legítimo interesse, art. 7º, IX, é base mais adequada]; usar as respostas de "Suas manhãs" (alarmes e sonecas) só em totais, como parte da medição de uso (legítimo interesse, art. 7º, IX, com a mesma forma de oposição; essas respostas são necessárias para continuar a configuração, por isso não usamos o consentimento como base). As respostas nunca são usadas para direcionar anúncios a você nem compartilhadas com anunciantes ou plataformas de anúncios.
• Bases legais da conta opcional: criar e manter a conta, mostrar seu perfil aos seus amigos e grupos, os pedidos de amizade, os grupos, os clipes que você decide compartilhar, o controle de despertar que você ativa para cada amigo, a entrega dos alarmes e das mensagens de voz e a restauração do seu calendário (execução de contrato, art. 7º, V, a pedido seu); notificações push (consentimento, art. 7º, I, dado quando você permite as notificações; você revoga nos Ajustes do iPhone ou em Configurações → Notificações); filtro de nomes, verificação por IA dos clipes (3 quadros enviados à Anthropic, sem seu ID, e apagados depois da aprovação) e das mensagens de voz (o áudio transcrito pela ElevenLabs e o texto verificado pela Anthropic, sem ID; a transcrição nunca é guardada), denúncias, bloqueios, banimentos e limites de uso, para a segurança dos usuários (legítimo interesse, art. 7º, IX); comunicar às autoridades material de abuso sexual infantil, quando a lei exigir (art. 7º, II). [ADVOGADO: confirmar as bases e se o fuso horário visível aos amigos exige aviso adicional.]
• Dados sensíveis (art. 11): usar a missão de versículos bíblicos pode indicar uma convicção religiosa. Não perguntamos sobre suas crenças. Esse tratamento depende do seu consentimento específico e destacado (art. 11, I), dado no aviso curto exibido antes da primeira missão bíblica ("Toque em Continuar para permitir"; o botão "Usar matemática" está sempre disponível) [ADVOGADO: confirmar que o aviso curto, de uma frase com o nome do fornecedor, ainda é consentimento específico e destacado para o art. 11, I]. Os eventos de uso nunca indicam a missão bíblica (o app remove esse valor antes do envio e o servidor remove de novo); o único registro no servidor é o da verificação de fala (data, resultado e tempo de resposta), apagado após 30 dias. A missão de foto "vestir-se" mostra você na imagem; ela é usada só para conferir a roupa e os sapatos, nunca para identificar você, e não criamos dados biométricos. Gênero e faixa etária não são dados sensíveis na LGPD (o art. 5º, II menciona "vida sexual", não gênero), e não perguntamos sobre orientação sexual [ADVOGADO: confirmar].
• Compartilhamento: apenas com os operadores que fazem o app funcionar: Supabase (servidores, login e armazenamento dos clipes compartilhados), Anthropic (verificação de fotos, dos clipes compartilhados e do texto das mensagens de voz), ElevenLabs (transcrição de leituras e das mensagens de voz), RevenueCat (assinatura), Expo (entrega de notificações push, se você permitir) e Apple (loja, pagamento, Entrar com a Apple, entrega de notificações e reconhecimento de fala); e, se você criar um perfil, com seus amigos e outros usuários, só o que a Seção 3A descreve. Não vendemos seus dados, não exibimos anúncios e não rastreamos você entre apps. As decisões sobre onde anunciar o Upa Alarm usam só totais das respostas do onboarding; nunca entregamos suas respostas nem seu ID a anunciantes ou plataformas de anúncios.
• Transferência internacional: seus dados são tratados nos Estados Unidos e, pelos fornecedores, possivelmente em outros países. A transferência é necessária para executar o contrato com você (art. 33, IX, c/c art. 7º, V). [ADVOGADO: avaliar a adoção das cláusulas-padrão contratuais da Resolução CD/ANPD nº 19/2024.]
• Seus direitos (art. 18): confirmação da existência de tratamento; acesso; correção; anonimização, bloqueio ou eliminação de dados desnecessários ou excessivos; portabilidade; eliminação dos dados tratados com consentimento; informação sobre com quem compartilhamos; informação sobre a possibilidade de não consentir e suas consequências; e revogação do consentimento a qualquer momento. A forma mais rápida de apagar tudo é Apagar meus dados em Configurações → Jurídico e suporte (Apagar minha conta e meus dados, se você entrou com a Apple). Você pode corrigir seu perfil no próprio app a qualquer momento. Você também pode peticionar à Autoridade Nacional de Proteção de Dados (ANPD).
• Prazos: respondemos pedidos de confirmação e acesso no prazo da LGPD (art. 19). Informe seu ID de suporte (Configurações → Jurídico e suporte → ID de suporte) para localizarmos seus registros; se você tem conta, seu código de amigo também ajuda.
• Retenção e eliminação: como na Seção 9 acima. Registros de verificação são apagados após 30 dias (na próxima verificação do mesmo tipo); clipes compartilhados, 7 dias depois do compartilhamento (ou antes, se você apagar o clipe ou sair do grupo); mensagens de voz, no máximo 3 dias depois da gravação (ou enquanto um alarme que as usa ainda não tocou; apagadas na hora se a verificação recusar) e, no celular de quem recebe, até 12 horas depois do alarme; a transcrição, nunca; denúncias, 1 ano depois de resolvidas; e tudo é apagado quando você usa Apagar meus dados ou Apagar minha conta e meus dados (antes, pedimos à Apple que revogue o token do Entrar com a Apple). Se você parar de usar o Entrar com a Apple para o Upa Alarm nos ajustes da sua conta Apple, a Apple nos avisa e apagamos sua conta da mesma forma. Se você não conseguir usar o app, escreva para [SUPPORT_EMAIL]: confirmamos o pedido pelo e-mail vinculado à conta e apagamos em até 30 dias.
• Idade: o Upa Alarm é só para maiores de 18 anos. Ao criar um perfil, você confirma que tem 18 anos ou mais.

Os documentos completos (em inglês) são a versão válida.