Privacy Policy

Data stored on your device

OkiPaca stores alarms, proof records, wake history, diagnostic attempts, settings, and optional Morning Block choices locally on your iPhone.

Camera, AI Object, and Exercise

AI Object and Exercise processing runs locally on device. OkiPaca does not upload or persist original camera photos. Camera access is used only when you register, test, or complete missions that require it.

Microphone and Read Aloud missions

Read Aloud speech recognition runs locally on your iPhone. Microphone access is requested only when you explicitly test or start a Read Aloud mission. Audio buffers, partial and final transcripts, recognition alternatives, and confidence values exist only in memory for that attempt and are not saved, logged, backed up, or uploaded. Read Aloud is a forgiving spoken-text check, not voice identity or liveness verification.

Anonymous onboarding profile

If you accept the data notice during long onboarding, OkiPaca creates a private anonymous Supabase identity and uploads selected answer categories as you continue. These can include age range, self-description, morning habits and feelings, coarse wake-time and repeat-day categories, mission and sound preferences, onboarding progress, commitment completion, and experiment assignment. OkiPaca does not upload exact wake times, signature images, camera photos, proof secrets, alarm labels, or free-text answers in this onboarding copy.

Each onboarding flow has a random identifier. OkiPaca retains no more than eight flow responses per identity, and each response expires 180 days after its most recent substantive update unless you delete it sooner. You can delete uploaded onboarding answers from onboarding or account settings. Answer-only deletion keeps the private identity for purchase access and optional account linking; it does not remove local alarms or proofs.

Optional account and cloud restore

You may link the anonymous identity to Sign in with Apple or Google, or choose an existing account. Normal linking keeps the same private profile. If you choose an existing account, OkiPaca deletes the uploaded anonymous answers first, keeps the draft on this iPhone, signs in, and uploads only the permitted answer copy under that account. Account switching stays blocked until uploaded answers are deleted.

Creating or signing in does not automatically upload alarm data. If you turn on Account Backup, OkiPaca stores an authenticated cloud copy of portable alarm settings, privacy-safe proof data, and finalized wake history. A Read Aloud collection stores its locale and collection version. A custom Read Aloud mission also stores the line you wrote, which is visible to OkiPaca’s Supabase service under the signed-in account’s access controls. It does not back up active system-alarm identifiers, enabled or ringing state, permissions, Screen Time selections, camera images, Photo Match data, microphone audio, speech transcripts, raw QR or barcode values, or raw NFC identifiers. Generated OkiPaca QR codes include enough secret data to recreate that same QR; scanned external codes cannot be recreated.

Turning backup off stops future uploads but leaves the current cloud copy until you delete it. Delete Cloud Copy removes that copy while keeping local alarms, proofs, and Stats. Restored alarms always return off with no system schedule, and restored proofs must be tested on the new iPhone before an alarm can be enabled.

Payments and subscriptions

Purchases are processed by Apple and managed through RevenueCat. OkiPaca may store customer and product identifiers, purchase events, renewal state, trial state, and subscription status needed to unlock OkiPaca Plus and provide support.

Website analytics

On public website pages, OkiPaca uses PostHog in cookieless mode to understand page visits and use of App Store or How It Works links. Events can include the normalized localized page path, a referrer domain without its path or query, allowlisted campaign tags, link placement, and coarse browser or device information. OkiPaca does not send website query strings, URL fragments, link text, form contents, email addresses, or account data to PostHog.

For PostHog, OkiPaca stores no identifier in cookies or browser storage, creates no person profile, and disables autocapture, heatmaps, surveys, feature flags, session replay, and automatic error capture. PostHog temporarily processes network information to form a privacy-preserving identifier that changes daily, then strips the IP before GeoIP enrichment. OkiPaca honors Do Not Track for PostHog collection.

The exact /auth/confirm and /auth/reset-password routes never load the PostHog client because they can carry secure callback information. If PostHog configuration is missing or invalid, PostHog collection stays off.

Cloudflare also supplies Web Analytics through our website hosting for aggregate usage and performance reports. Its browser beacon measures page views, page-load timing and Core Web Vitals, with dimensions such as page paths, referrers, browser and device type, operating system, and country. This beacon can also load on /auth/confirm and /auth/reset-password; the PostHog exclusions above do not turn it off.

App product analytics

Product analytics is on by default. A saved opt-out remains effective unless you turn sharing back on or clear all local app data. OkiPaca reads the saved Privacy & Data preference before initializing PostHog; if the preference cannot be loaded or saved, analytics stays off.

While sharing is active, events can include onboarding progress, proof type, coarse mission result, paywall steps, purchase or restore result, app version, build number, app locale, and a pseudonymous app identity. A linked account may associate that identity with an OkiPaca account identifier, but OkiPaca does not send your email to PostHog. It never sends proof payloads, camera images, microphone audio, speech transcripts or alternatives, selected phrases, custom Read Aloud lines, spoken locale, faith choice, alarm labels, exact alarm times, or support messages.

PostHog receives the network IP used to deliver requests and may derive approximate country or region. OkiPaca does not request Location Services for this, collect precise location through PostHog, or use the data to track you across other companies’ apps or websites.

Review or change sharing at any time in Settings → Privacy & Data. Stopping sharing blocks future analytics calls without removing local Wake History or affecting alarms. For deletion requests tied to a linked account, email privacy@okipaca.com. Anonymous analytics may not be linkable to an individual.

Advertising measurement

In app versions that offer advertising measurement, OkiPaca requests Apple’s tracking permission once after onboarding, when the Home screen is idle, if product analytics is enabled and no tracking choice has been made. TikTok SDK requests start only while Apple tracking permission is allowed and product analytics remains enabled.

When enabled, TikTok receives advertising and device identifiers, app/device/operating-system information, and network metadata such as IP address to measure OkiPaca ads. OkiPaca sends only app launch, first alarm creation, and verified initial trial or paid-purchase events. Purchase events may include product identifier, amount, currency, and an event identifier for deduplication. The SDK also sends request and initialization timing, delivery counts, and errors for measurement reliability and troubleshooting.

These TikTok events do not include health or faith data, alarm settings or labels, exact alarm times, mission or proof content, camera images, microphone audio, speech transcripts, account identifiers, or account email addresses.

Turning off product analytics blocks new TikTok requests and clears local SDK queues. OkiPaca also checks Apple tracking permission before new requests and when returning to the foreground, and applies the same stop when it detects withdrawal. This does not automatically delete data TikTok already received or recall a request already transmitted.

Separately, when product analytics is enabled, OkiPaca may ask Apple’s SKAdNetwork for privacy-preserving, aggregated install measurement using conversion value 0. This does not send an OkiPaca account or advertising identifier, does not start the TikTok SDK, and does not require Apple tracking permission.

Crash and error diagnostics

OkiPaca uses Sentry to diagnose crashes, errors, and performance problems. Reports can include app version and build, device and operating-system information, stack traces, limited feature breadcrumbs, and timing. Signed-out reports remain anonymous. Signed-in reports may include an OkiPaca user identifier and account email for support. Proof payloads, camera images, microphone audio, speech transcripts or alternatives, selected phrases, custom Read Aloud lines, spoken locale, faith choice, alarm labels, exact alarm times, and onboarding answers are excluded.

Email

Signed-in users with an email may receive localized trial, payment, subscription, and support-confirmation emails through Resend in their saved app language. An anonymous purchaser may optionally save a reminder email and preferred app language before purchase. Each queued lifecycle email keeps its language snapshot; legacy or invalid values use English. Account confirmation and recovery messages are handled separately by the account service.

Account deletion

Request deletion from the app or account-deletion page. Deletion removes OkiPaca account records, linked onboarding responses, and pending lifecycle emails. A restricted suppression list retains only one-way hashes of known billing identifiers to prevent later provider events from recreating deleted records. Apple subscriptions must still be managed through Apple.

Contact

Email privacy@okipaca.com for privacy questions.