1. Information We Collect or Generate
Depending on the features you use, the App collects or generates the following categories of information:
- Alarm, repeat-day, skip, volume, notification, speech, departure-timer, and display-language settings
- Squat counts, completion times, streaks, history, rewards, and selected display items
- Sign-in, profile, ranking, friend, friend-request, block, and safety-report information
- WakeSquat Adventure progress, battles, level, inventory, currencies, shops, and crafting data
- Product type, purchase token, purchase state, and verification results for Pro and Gem purchases
- Identifiers such as advertising IDs, IP address, ad interactions, diagnostic information, and consent status
- App Check, Play Integrity, or App Attest data, request records, and fraud-prevention information
- Email address, subject, message, attachments, and correspondence you send when contacting support
We receive this information from your input, from use of the App, or from third-party services such as Google Play, the Apple App Store, Firebase, and advertising SDKs.
2. Information Processed and Stored on Your Device
Alarm schedules, repeat days, one-time skips, selected sounds, volume, vibration and notification settings, squat history, departure-timer settings, display settings, and temporary ad or Pro state may be stored in local databases, files, or preferences. The App uses this information to provide features, restore alarms after reboot, and retry operations after failures.
If Android or iOS backup or device transfer is enabled, eligible data may be encrypted, transferred, and stored by the operating system, Google, or Apple. Certain information that must be verified again, including the local Pro entitlement cache, may be excluded from backup.
The App lets you select one of 17 display languages: Japanese, English, Italian, Hindi, Bengali, Nepali, Urdu, Persian, Arabic, Korean, Simplified Chinese, Spanish, French, German, Brazilian Portuguese, Indonesian, and Vietnamese. The selected display language is processed as an on-device setting.
Automatic alarm stop on iOS: To stop an alarm that keeps ringing for about 10 minutes while the iOS app is not running, devices with alarms turned on send our server the alarm times, repeat days and on/off settings, the dates of one-time alarms and one-time skips, the device time zone, the display language, and a push notification token (Firebase Cloud Messaging). The times at which an alarm was stopped or its mission was started in the app are also sent, so that no unnecessary notice is shown. Alarm names, exercise records, and account information are not sent. This information is not linked to your account; it is keyed by a hash of a random identifier created on each device and is used only to send the device a notification about 10 minutes after an alarm starts so that the alarm can be stopped. A device registration is deleted automatically 60 days after its last update, per-ring records within 2 days, and when all alarms are turned off the registration is deleted within 2 days (it is kept briefly so that a snooze of an alarm that just rang can still be stopped). The automatic stop may not work if the app has been closed or the device is offline.
3. Accounts and Authentication
Google sign-in, Sign in with Apple, or email-and-password sign-in may be used for rankings, friends, cloud sync, and WakeSquat Adventure. Through Firebase Authentication, we process a user ID (UID), display name, email address, authentication provider, and account status.
When using Sign in with Apple, you can share the email address on your Apple Account (including an icloud.com address) or choose Hide My Email and share an Apple private relay address. Firebase stores the address selected for that account. With your explicit action, another sign-in method may be linked to the same WakeSquat account.
Passwords are managed by Firebase Authentication. We do not view or store passwords in plaintext. Your profile name, system-generated avatar initial, selected reward, and related settings may be stored in the cloud.
If you voluntarily choose a profile photo through the operating system’s photo picker, the App resizes and converts it on your device and stores it in the App’s private storage. Android versions that support photo sharing upload and store a thumbnail in your Firebase user profile during signed-in synchronization, and display it to other users in rankings, friends, and user profiles. Photos retained on the device while sharing was disabled may also be uploaded again when a supported version synchronizes. The current iOS app uses selected photos only on the device and does not upload them. Attachments you voluntarily send to support outside the App are handled as support correspondence.
4. Fitness Records, Rankings, and Friends
When signed in, total, daily, and weekly squat counts, personal bests, streaks, ranking position, reward unlocks, first-share completion, and related information may be stored in Firebase. We use this data for cross-device sync, ranking calculations, rewards, and prevention of duplicate submissions.
Friend features process friend lists, incoming and outgoing requests, public profiles, friend counts, and read or quota-management information. We may also store processing timestamps, event identifiers, and completion ledgers needed for reliable aggregation and duplicate prevention.
Safety features process the reporter and target UIDs, report reason, optional details, source screen, report time, deduplication and rate-limit information. We store the UID of a user you block to exclude both sides of the block relationship from each other's rankings, friends, requests, and Adventure support choices and to prevent new requests. Reports and block relationships are not visible to other ordinary users.
5. WakeSquat Adventure Data
WakeSquat Adventure processes the following cloud game data for each account:
- Stages, laps, bosses, remaining boss HP, attack counts, and clear status
- Shared level, EXP, Coins, Gems, materials, treasure chests, and rewards
- Characters, weapons, talismans, treasures, blueprints, equipment, and party loadouts
- Shop purchases, crafting, ad rewards, login rewards, and Pro benefits
- Friend support, support loadouts, requests, results, rate limits, and operational audit records
When you complete an alarm mission or free-squat session, the App may send a completion event ID, required and completed reps, completion time, and difficulty-related values to grant Adventure attacks or rewards and update rankings. Raw accelerometer streams are not uploaded to the cloud.
6. Pro, Gems, and Store Purchases
The one-time Pro purchase and the 100, 500, and 1,000 Gem products use Google Play Billing on Android and Apple StoreKit on iOS. We process the product ID, a hash of the purchase token or transaction ID, order or acknowledgment status, purchase time, verification result, and associated user ID. Google Play or the Apple App Store handles payment credentials such as card numbers; we do not receive them.
We retain Google Play and App Store purchase-verification ledgers for Pro and Gems to restore entitlements and prevent duplicate grants or fraud. When an account is deleted, direct owner links (the owner UID and account hash) are removed, but hashed purchase-token or transaction data and an irreversible hash of a previous owner identifier may be retained where necessary for legal compliance, purchase restoration, fraud prevention, and dispute handling. Consumable Gem ledgers also remain to prevent a transaction from being granted twice after deletion.
On Android, Google Play real-time developer notifications and the Voided Purchases API are used to check completed, canceled, refunded, or charged-back purchases. If a Gem purchase is voided, the server-controlled refund ledger records the amount removed from the available balance, any amount already spent that could not be removed, and whether review is required.
On iOS, we verify Apple-signed transaction information on the server and reflect any cancellation, refund, or refund-reversal status we receive in the Pro entitlement and Gem ledgers.
Gems, Coins, equipment, blueprints, and other virtual items have no cash, cryptocurrency, or property redemption feature.
7. Advertising, Rewarded Ads, and Consent
The free version displays banner, interstitial, and rewarded ads through Google AdMob. In version 4.1.0, the mediation SDKs are Liftoff Monetize, InMobi, and Unity Ads on Android, and Liftoff Monetize and Unity Ads on iOS. These ad networks may process information when AdMob selects them to serve an ad. Completion of a rewarded ad may be used to grant Gems or other in-app benefits.
Advertising SDKs may collect or share an IP address (which may estimate general location), Android advertising ID, App Set ID, Apple's Identifier for Advertisers (IDFA), Identifier for Vendor (IDFV), or other identifiers, app launches, taps, video views, device and app information, ad results, diagnostics, performance data, and fraud-prevention signals. We use Google User Messaging Platform (UMP) to request advertising consent and provide privacy choices where required. On iOS, we request App Tracking Transparency (ATT) permission before accessing the IDFA.
For rewarded ads in WakeSquat Adventure, the App sends AdMob a random, single-use claim value that expires after a short period so that rewards are granted only for a valid completed view. Our server verifies the claim value, ad unit, reward settings, transaction identifier, and timestamp in AdMob's signed callback. We retain hashes of the claim and transaction identifiers and the verification result for as long as needed to prevent duplicate rewards and abuse. This process does not send your Firebase user ID, email address, or profile information to AdMob.
Ads are generally disabled for Pro users. Limited network activity may still occur before purchase status is confirmed, during restoration, or for SDK initialization and legally required consent management.
8. Sensors, Audio, Speech, and Sharing
- Motion sensors: The App uses accelerometer or similar sensor readings on the device to estimate squat movements. Raw sensor readings are not normally stored in the cloud.
- Sounds and speech: The App can use a sound selected on the device, included app sounds, and the device text-to-speech engine for alarms and timers. It does not record audio or use microphone input.
- Sharing: Progress images may be generated locally and sent through the operating system’s share feature to an app you select. The App does not post automatically on your behalf.
The App does not request permissions for the purpose of accessing your camera, microphone recordings, contacts, SMS, call history, or precise location.
9. App Check, Play Integrity, App Attest, and Security Data
The App integrates Firebase App Check and attempts to obtain and attach integrity tokens using Google Play Integrity on Android and Apple App Attest or equivalent attestation on iOS. Some security-sensitive operations may require a valid token. For other server operations, enforcement is introduced in stages after verification metrics show that legitimate store-distributed builds will not be disrupted. Firebase Authentication and server-side authorization, input validation, rate limits, and duplicate prevention apply independently of App Check enforcement. Google, Apple, and our systems may process integrity tokens, app identifiers, request time and result, IP address, and failure counts for these purposes.
10. Purposes of Processing
- Providing alarms, squat detection, departure timers, notifications, and speech
- Authenticating accounts and operating sync, rankings, friends, and Adventure
- Verifying, granting, and restoring Pro, Gem purchases, ad rewards, and game items
- Providing support and improving reliability, performance, and usability
- Detecting inappropriate display names, responding to reports, providing blocking, and protecting user safety
- Detecting and preventing abuse, duplicate submissions, cheating, attacks, and purchase fraud
- Complying with law, Google Play and Apple App Store policies, and valid requests from authorities
11. Information Visible to Other Users or Shared by You
Rankings, friends, and support features may display your display name, system-generated avatar, selected reward, squat totals, rank, Pro badge, and Adventure support information to other users. Android photo sharing also displays a thumbnail of your selected profile photo in rankings, friends, and user profiles. Your email address and authentication credentials are not made public.
Server-side inappropriate-content and spam controls apply to public display names. You can report or block another user from that user's profile. Once either user blocks the other, the pair is excluded from each other's rankings, friends, requests, and Adventure support choices.
If you use sharing, information is sent to the service you select under that service’s terms and privacy policy. Do not place confidential information or a name that infringes another person’s rights in your public display name.
12. Third-Party Services and Disclosures
We do not sell personal information. The following providers process information under their own terms and policies as needed to provide the App:
- Google Play, Google Play Billing, and Google Play services: distribution, updates, purchases, reviews, authentication, and device services.
Google Privacy Policy - Firebase (Authentication, Cloud Firestore, Cloud Functions, App Check, and Cloud Messaging): authentication, storage, synchronization, server processing, abuse prevention, and the iOS automatic alarm stop notification.
Privacy and Security in Firebase - Apple App Store, StoreKit, and Sign in with Apple: app distribution, updates, purchases and restoration, Apple Account authentication, and provision of a shared email or private relay address.
Apple Privacy Policy - Google AdMob and User Messaging Platform: ad delivery, measurement, consent management, and fraud prevention.
Google Advertising Policies - InMobi (Android): ad mediation, delivery, measurement, and fraud prevention.
InMobi Privacy Policy - Unity Ads (Android and iOS): ad mediation, delivery, measurement, and fraud prevention.
Unity Privacy Policy - Liftoff Monetize (Vungle; Android and iOS): ad mediation, delivery, measurement, optimization, and fraud prevention.
Liftoff Privacy Policy
We may disclose information where required by law, to protect life, safety, or property, or where reasonably necessary to establish rights, investigate abuse, or respond to lawful requests from courts or authorities.
13. International Processing
Apple, Google, Firebase, AdMob, InMobi, Unity, Liftoff, and their affiliates may process information on servers in various countries. Such processing is subject to the safeguards and applicable laws described by those providers.
14. Retention
On-device data may remain until you delete it, clear the App’s storage, or uninstall the App. Cloud data is retained while needed to provide your account or features and for periods reasonably necessary to handle failures, abuse, disputes, or legal obligations. Expired requests, duplicate-prevention ledgers, and rate-limit records may be deleted or refreshed on operational schedules.
Purchase-verification history, security records, and legally required records may remain after account deletion for as long as needed for their stated purpose, with direct identifiability reduced where appropriate.
To investigate requests concerning unused purchased Gems and prevent duplicate credits, we retain balances classified as purchased, free, or of unknown origin; grant, spending, and refund records; and the balance at account deletion. This ledger excludes names, email addresses, and profile photos and uses a hashed account identifier to match purchase records. We treat these hashes as linkable information and retain the records only as long as needed for investigation and fraud prevention. These records do not guarantee automatic restoration or recovery after deletion.
Safety reports are retained only as long as reasonably necessary to review and act on the report, prevent abuse, and handle disputes, after which they are deleted or de-identified. Account deletion targets reports and block relationships directly linked to that UID.
Support correspondence is retained only as long as reasonably necessary to answer the request, resolve the issue, protect safety, or handle a dispute, after which it is deleted or de-identified.
15. Account and Data Deletion; Backups
While signed in, you can delete your account from the App’s account settings. The process targets the Firebase Authentication account, profile, friend relationships and requests, ranking-related data, and Adventure progress, inventory, and support data. Related friend or request links held under other users are also removed where practicable.
If you cannot use the App, see the data deletion page. To delete only local data, use Android’s App info screen or iOS storage settings to remove the App’s data.
Account deletion also targets the on-device profile photo and the thumbnail stored in that account’s Firebase user profile. Clearing the App's data or uninstalling it also removes the local photo. After deletion, limited records may remain temporarily in rotating backups or continue where required for law, security, purchase restoration, fraud prevention, or dispute handling, as described above.
16. Your Choices and Rights
- You can change notifications and other permissions available on your operating system in device settings.
- Where advertising choices are required, the App’s privacy settings can open the UMP choices screen. Advertising-identifier choices are available in device settings.
- You can change profile and public information in the App and request account deletion in the App or through the deletion page.
- You can report or block another user from that user's profile, unblock them from the same screen, and contact support about an urgent safety issue.
- To exercise access, correction, deletion, restriction, or other rights available under applicable law, contact us below. We may need to verify your identity.
17. Minors
Minors should use the App with parental consent and supervision where appropriate. The App is not intended to knowingly obtain personal information from a child without legally required consent. A parent or guardian who believes information was collected improperly should contact us.
18. Security
We use reasonable safeguards such as encryption in transit, Firebase access controls and authentication, App Check token verification and staged enforcement, Play Integrity, App Attest, rate limits, and purchase verification. No internet transmission or storage system can be guaranteed completely secure.
19. Changes to This Policy
We may revise this Policy to reflect changes in features, SDKs, law, or operations. Material changes will be announced on this page, in the App, or by another reasonable method. The effective date is shown at the top of this page.