WAKERULE

PRIVACY POLICY

Last updated: 30 August 2026

WakeRule is an alarm app whose alarm stops only when your phone confirms you completed a task you set. Confirming the task means recording short video clips on the camera — or, in an older verification mode, analyzing short bursts of camera frames — and, for spoken tasks, listening on the device. This policy explains, in plain terms, what data that involves, who it is shared with, how long it is kept, and your choices. It is provided by NEXARLABS LTD, a company registered in England and Wales ("we").

The short version

When you run a camera task, your phone records short video clips of you (or, in an older mode, sends still frames) to an AI service (Google Vertex AI) to check you did the task. We do not keep those recordings. Google may keep them briefly to check for misuse of their AI, and does not use them to train their models. Spoken tasks are checked entirely on your phone and the sound is never sent anywhere. WakeRule is for adults only. We do not show ads, sell your data, or use third-party advertising or cross-app tracking SDKs. A few technical identifiers we use to run the service, and Google's on-device libraries, are described below.

What we collect

  • Mission text — the task you type when you create an alarm. Sent to our backend and to Google Vertex AI to compile it into checkpoints.
  • Camera video and frames — during a camera task, the default mode records short video-only clips (standard definition, no audio, up to 60 seconds each), cut whenever you tap CHECK or every 60 seconds; an older mode instead sends roughly five 640×480 JPEG frames per second. Each clip is written briefly to the app's private storage on your phone, uploaded to our backend and to Google Vertex AI to verify the task, then deleted from your device.
  • Account information — if you sign in with Google, we receive your email address, name, and a Google account identifier, and store them on our backend to sync your alarms and subscription status across devices. Sign-in is required to use AI-verified missions.
  • Subscription records — if you subscribe, the purchase token, product and order identifiers from Google Play, an obfuscated account identifier (a token issued by us, not your name or email, which we also give to Google Play so a purchase can be matched to your account), the subscription status and renewal date, and Google's subscription record, to confirm your subscription is active and prevent duplicate grants. We do not receive or store your card details; the payment is handled by Google Play.
  • Wake and attempt history — for each alarm: when it fired, when you started and finished, whether the task was verified, how long it took, and your task text. Used for your streak, statistics, daily attempt limits, and our own cost accounting. Stored on our backend.
  • Device and session metadata — a random per-install identifier (not a hardware or advertising ID), your platform and app version, your timezone (to know when your morning is), the browser or app user-agent string, and sign-in session records. Used to run your account, bind your alarms to it, and secure sign-in.

What we do NOT collect

  • Microphone audio. Spoken missions are verified entirely on your device. The sound is reduced to loudness readings on the phone and is never recorded to a file, uploaded, or sent to any AI service. Video recorded for a camera task is video-only — no audio track is captured.
  • No location, contacts, calendar, messages, or files.
  • No advertising, no advertising identifiers, no marketing or cross-app tracking, and no selling of your data. Some technical identifiers we do use, and telemetry from Google's on-device libraries, are described under "Device identifiers and analytics" below.

Device identifiers and analytics

We do not run advertising or product analytics SDKs, we do not use an advertising ID, and we do not profile you or track you across apps. Three technical details are worth naming plainly:

  • A per-install identifier. When you sign in, the app generates a random identifier for your installation — a random value kept in the app's private storage and deleted when you uninstall. It is not your hardware ID and not an advertising ID. It is sent to our backend on sign-in, token refresh, and alarm sync to label your device's session and bind your alarms to your account; it is never used to track you across apps.
  • What our app sends about your device. Besides that per-install identifier, our own requests include only a fixed platform value, our app's version number, your timezone, the user-agent string, and sign-in session records. We do not send your device model, manufacturer, operating-system version, phone number, hardware serial, MAC address, or any advertising identifier.
  • Google's on-device libraries (ML Kit). To start the countdown and to tell when the camera is covered, the app uses Google's ML Kit face detection, pose detection, and image labeling, which run entirely on your device — your images are not sent to Google by these libraries. ML Kit does, however, send Google diagnostic and usage data governed by Google's terms rather than ours. Google documents this as including your device manufacturer, model, operating-system version and build, a per-installation identifier Google states is not intended to identify you or your device, and API performance metrics.

Who we share it with

Google Vertex AI (Gemini). Your mission text is sent to Google's Vertex AI to compile your task; during a camera task, your camera video or frames are sent to verify it. This is a third-party AI service; your data is processed under Google Cloud's terms. Google states it does not use this data to train or fine-tune its models. Google's abuse-monitoring may retain submitted content (including images and video) for up to 90 days to detect misuse, where authorized Google staff may review flagged content. We use Google's global Vertex AI endpoint, which Google states provides no data-residency or in-region-processing guarantee, so this processing may take place in any region in which Google operates. Google also applies automatic context caching to speed up similar requests, which may hold the content we send it — including your mission text and camera video or images — for up to 24 hours before the cache expires.

Google Play, the Google Play Developer API, and Google Cloud Pub/Sub. If you subscribe, Google Play processes your payment as merchant of record and gives us a purchase token; we ask the Google Play Developer API to confirm and refresh your subscription status, and Google Play sends us renewal and cancellation notifications through Google Cloud Pub/Sub. These messages carry your subscription identifiers, never your payment details.

Google Sign-In. When you sign in, Google confirms your identity and gives us your Google account identifier, email, and name. We verify Google's signature but do not send your personal information back to Google to do so.

Amazon Web Services. Our backend runs on Amazon Web Services in the United States, which hosts our servers and database as our infrastructure provider.

We do not sell your data, and we do not share it with advertisers, data brokers, or analytics providers.

How long we keep it

  • Camera video and frames: we do not write them to disk on our backend; they exist only in memory for the moment of verification. On your device, a video clip is written to the app's private storage and deleted as soon as it has been judged, and any leftover clip is removed when the attempt ends or when you uninstall the app. Google's retention is described above.
  • Alarms, mission text, and compiled tasks: stored on your device, and on our backend while your account exists so they sync across your devices. Uninstalling the app removes the copies on your device.
  • Account and sync data (email, alarms synced to the backend, subscription status, sessions): kept while your account exists; when you delete your account it is anonymized and scrubbed as described below, with limited records retained. Sign-in sessions expire automatically.
  • Server logs: our server logs, which include the task text you enter and an internal account identifier, are kept for 30 days and then deleted automatically.
  • Database backups: automated backups are kept for 7 days, so data you delete may persist in a backup for up to 7 days before it ages out.

How we protect your data

  • Data in transit is encrypted with HTTPS/TLS (TLS 1.2 or higher); release builds of the app refuse plain-HTTP connections.
  • Our database is a managed PostgreSQL instance whose storage is encrypted at rest, is not reachable from the public internet, and accepts only encrypted connections from our own servers.
  • Camera video and frames are never written to disk on our backend — they exist only in memory for the moment of verification, then are discarded.
  • Sign-in tokens are stored on our backend only as one-way hashes, never in the clear; refresh tokens rotate on every use and a reused token revokes the whole chain. On your device they are kept in encrypted storage.
  • Subscriptions are verified with Google on our servers every time; the app is never trusted to grant itself access.

Your choices and deletion

You can delete your account from within the app, or by using our account-deletion page, or by emailing [email protected]. Data stored only on your device is removed by uninstalling the app.

Deleting your account immediately anonymizes and scrubs your record: we sign you out of every session, remove your name and email, null the task text on your wake history, and delete your alarms. A few things are kept, and we want to be plain about them:

  • An identifier tied to your Google account is retained (marked deleted) so that if you ever sign in again you are recognized and not locked out.
  • Your subscription and purchase records — including the Google Play purchase token and Google's subscription record — are kept as financial and accounting records.
  • The timing and outcome of your past wake attempts are kept (with your task text removed), because they settle against our cost records.

Deleting your account does not cancel or refund your Google Play subscription. To stop being billed, cancel the subscription separately in Google Play (Play Store → Subscriptions).

We keep records of your purchases and subscription — including Google Play order identifiers and purchase tokens, subscription status and renewal dates, and our related accounting entries — for 6 years after the end of the financial year in which the transaction took place, to meet our tax and company-law obligations, even after you delete your account. The anonymized wake-attempt timing records, which we use only to reconcile our AI processing costs, contain no information that identifies you; we keep them until the relevant billing period is reconciled and in any case no longer than 24 months. We keep the purchase records because the law requires it, and where it does not strictly require them, to prevent fraud and resolve disputes; we keep the Google-account identifier to recognize a returning user. This overrides a deletion request only to the extent the law allows.

Legal basis (EU/EEA/UK users)

We process your camera video and mission text to provide the camera-verified alarm you subscribed to, on the basis of performing our contract with you (GDPR Article 6(1)(b)). Verification is the service you chose and paid for, so the camera is a necessary part of it. Because verification only checks the action in front of the camera and never tries to identify who you are, we treat these recordings as ordinary personal data, not biometric data. We keep your purchase and accounting records to comply with our legal obligations (Article 6(1)(c)), and rely on our legitimate interests (Article 6(1)(f)) to prevent fraud, resolve disputes, and reconcile our costs.

You have the right to access, correct, delete, or export your data, to object to or restrict processing, and to complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk). To exercise any of these, email [email protected].

Children

WakeRule is for adults. It is intended for people aged 18 and over, and it is declared as an adults-only app on Google Play (an "18 and over" target audience with minor access restricted), so users Google identifies as under 18 cannot download or subscribe. We do not knowingly collect data from anyone under 18. If you believe a minor has used WakeRule, email [email protected] and we will delete the account and its data.

International transfers

WakeRule is operated internationally and your data is processed outside your own country. Our backend — which handles your account and sync data, subscription records, mission text, and your camera video and frames (held in memory only, for the moment of verification) — runs on Amazon Web Services in the United States. Our AI verification is performed by Google's Vertex AI using Google's global endpoint, which does not guarantee where processing takes place. For EU/EEA/UK users, transfers to Google are governed by Google's Cloud Data Processing Addendum, under which Google acts as a processor, and transfers to Amazon Web Services are governed by the AWS Data Processing Addendum; both incorporate the Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum.

Changes to this policy

We will update this page when our practices change and revise the "Last updated" date above.

Contact

Questions or requests: [email protected] (NEXARLABS LTD, a company registered in England and Wales).