Yawnzy Privacy Policy
Where your morning records are stored, and who can see them.
Learning Spoons Co., Ltd. operates Yawnzy, a service for mission alarms and shared morning challenges. This document explains the information Yawnzy processes and the choices available to you. It is a service-specific notice separate from the privacy policy for Learning Spoons education and payment services.
1. What information do we process, and why?
Basic alarms: We store alarm names, times, repeat days, sounds, volume, mission settings, ringing, snooze and mission completion status, device time zones, permissions and test results on your device. We use this information to schedule and run alarms, check problems and display personal records. You can use basic alarms without signing in.
Registration and sign-in: Depending on the available sign-in method, we process your email address, name or nickname, email verification status, profile image (if provided) and internal account ID. Email sign-in stores a password hash. Where social sign-in is offered, we process the provider account identifier and authentication tokens, not your password with that provider. Session details, expiry times, IP addresses, user agents and rate-limit information may be processed to maintain sign-in and prevent abuse.
Personal record sync: Within the scope explained after sign-in, we associate your device installation identifier, record IDs, alarm and completion times, mission types, settings and results, original dates and time zones, and optional reflections with your account. We use these to restore records, remove duplicates and calculate cumulative achievements. Existing guest records are linked to your account only if you choose to import them. We do not restore all alarm settings to another device.
Challenges: We process the rooms you join, participation status, target times and rules, scheduling and device identifiers, mission participation times and attendance decisions. Other participants see participation information defined by the challenge agreement. Your private reflections are not shared.
When you use social features: We process chat messages, morning posts and letters, their contents and creation times, photos you choose to upload, reactions, read status, receiving preferences, and blocking or reporting information and related evidence. You can choose to use these features when they are available in the service. Report handling and moderation logs may include identifiers for the moderator and the person affected.
Inquiries: We process the contact details and contents you send by email, along with materials needed to respond. Please do not send unnecessary government identification numbers, financial information or other people’s personal information.
Yawnzy does not currently offer payments or subscription purchases, so it has no feature for collecting card numbers, bank accounts, shipping addresses or purchase records. We have not added separate features to collect contacts, precise GPS location or microphone recordings. The advertising section below explains that the advertising SDK may infer an approximate location from your IP address.
2. Phone permissions and sensor information
Exact alarm, notification and lock screen display permissions are used to ring scheduled alarms and show their status. Without these permissions, the corresponding alarm features may be limited.
Walking and shaking missions use motion sensors while you perform them. We do not have a feature that sends raw movement data or continuous movement routes to the server. Mission settings and results may be included in your personal records or challenge participation results.
When you choose to use a photo feature, we request camera access or access to the photos you select. Uploaded photos are re-encoded before storage to remove EXIF metadata. Faces, addresses and documents visible in the photo itself are not removed, so please check before sharing.
You can change optional permissions in your phone settings. Basic alarms remain available without photo or social features.
3. Information visible to other users
In a challenge you join, users with participation access can see nicknames, participation and attendance information, and chat messages, posts and reactions you add to that room. Where photos are available, they are displayed according to the sharing scope and moderation process. Letters are available to the participants in the correspondence.
Personal alarm records and private reflections are handled as records belonging to your account. They are not turned into challenge rankings or public profiles. We do not disclose member email addresses or authentication tokens to room participants.
When a report is received, authorized moderators may review its contents and related evidence. Information may also be disclosed to the extent necessary in response to lawful requests under applicable law.
4. Google AdMob advertising and privacy choices
The mobile app uses the Google Mobile Ads SDK (AdMob) and User Messaging Platform (UMP). For users eligible to see ads, native ad cards may appear in the alarm and challenge lists, and a native ad row may appear below the main Alarm, Challenge, Records and Profile tabs. Ads include an ad label and access to ad information. Ads are hidden during potentially disruptive situations, such as a ringing alarm or mission, and when there is insufficient screen space. You do not have to wait for an ad to dismiss an alarm or complete a mission. Development and validation builds use Google sample apps and test ad units.
Google SDKs may process IP addresses (which may be used to infer an approximate location), device and app identifiers, ad impressions, clicks and app interactions, and performance and diagnostic information to serve ads, measure results, diagnose errors and prevent abuse. Actual collection varies by platform, SDK version, permissions and consent status. Non-personalized ads do not mean that no information is collected.
The current implementation requests non-personalized ads and does not directly attach Yawnzy email addresses, private reflections, alarm records or chat contents to ad requests. We have not added a feature that requests App Tracking Transparency (ATT) permission on iOS.
Before requesting ads, we check UMP’s status indicating whether ads may be requested. When UMP determines that a choice is required, we present Google's official privacy form outside ringing alarms and missions. We do not display a separate ad consent notice to every user. Where privacy options are required, you can review or change them under Settings → Ad privacy settings in the app. Failures to retrieve consent information or load an ad do not prevent you from using alarms. You can manage your Android advertising ID in your phone’s advertising settings.
You can also review Google’s privacy practices and available choices in its Privacy Policy and information about data use on partner sites and apps.
5. Optional usage analytics
Google Analytics and Google Analytics for Firebase are configured to analyze feature usage only after a separate usage-analytics opt-in. This is separate from advertising privacy choices; declining does not prevent use of basic features. Choices can be changed in the app My tab or the website usage-analytics settings. Development and preview runs do not send analytics events. Configured deployed builds can transmit according to the choice, so this is not described merely as unused integration code.
Feature events include landing-page visits, mission previews, onboarding steps, first-alarm setup, permission results, mission starts and completions with mission type, sign-in method, challenge-join and record-sync success or failure, and returning to the app. They are used to improve features and identify problems in the usage flow. Email, passwords, chat or letter text, reflection content, photos and individual alarm times are not attached to events, and account IDs are not set as analytics User-ID. The SDK may separately process app-instance or cookie identifiers, device, app and browser information, approximate IP-derived location and automatically collected events.
Google provides this processing. Analytics requests after opt-in may be transmitted over encrypted networks to the United States and Google international infrastructure. Configuration prevents linking advertising IDs, advertising personalization and Google signals to usage analytics. Turning the choice off stops subsequent events and resets the device analytics identifier or web analytics cookies. This does not immediately delete previously transmitted history from Google. Previous-data deletion may be requested through the privacy contact; because analytics is not linked to account IDs, we will explain the identifiable scope and provider procedure.
User-level and event-level analytics retention is set to two months, with the reset-on-new-activity option disabled. Expired data is processed through Google’s monthly deletion cycle. This setting does not apply to standard aggregate reports, and withdrawing consent does not immediately delete previously transmitted data.
6. Service providers and international processing
Vercel Inc. provides website and API hosting, request routing and security, and photo-response caching. When you use online features, information needed for the request (such as account, record, challenge, post or photo data), IP addresses, user agents, request times and error information is transmitted over encrypted connections. The configured server execution region is Singapore. CDN, support and security operations may use Vercel’s international infrastructure, including the United States; this does not mean all information remains exclusively in Singapore. Service data follows the category-specific periods below; platform operational data is also subject to Vercel’s contractual retention policies. Contact: the contact channel in the linked Vercel privacy notice.
Neon (Neon, Inc. / the Databricks group) provides PostgreSQL storage for accounts, sessions, personal records, reflections, challenges, chats, posts and reports, and Neon Object Storage for photos you upload. Our servers transmit this data over encrypted connections when you use online features. The configured database and photo-storage region is Singapore. The category-specific retention periods below apply. The database point-in-time recovery history is currently set to one day. This is not a physical-erasure deadline for all internal photo copies or provider operational information. Contact: the linked Neon support channel.
Google (AdMob and UMP) receives the device, advertising and diagnostic data described in section 4, and privacy-choice status, over encrypted connections when advertising and privacy-choice features are used. Google uses processing infrastructure in the United States and internationally. Retention depends on the purpose and data type under Google’s retention policy. We request non-personalized ads. Google’s independent processing and your choices are explained in the linked Google privacy and retention notices.
International processing and storage by Vercel and Neon needed to provide online features are described as processing for performance of the service contract. We provide separate choices where consent is required. To avoid this online processing, you can use basic alarms as a guest without account-based online features or photo uploads. You can request deletion or restriction of previously stored information through our privacy contact; this limits related online features such as record restoration and challenges. Advertising choices are available in the app’s advertising privacy settings and device settings. Choosing non-personalized ads does not stop all international data transfers.
Social sign-in and authentication email: Google and Apple sign-in and Resend authentication email are used only in environments where those integrations are enabled. Sign-in providers receive authentication requests; Resend receives the recipient email and verification or reset link. These connections were not configured in the production environment checked for this review. Processing countries, retention and user disclosures must be confirmed before activation. Usage analytics is described separately below.
7. Retention and deletion
On-device alarms, guest records and local copies remain until you delete them or clear app storage. Signing out is not deletion, and deleting a server account does not automatically erase storage on another device. Check records you need before uninstalling or clearing storage.
Account information, synced records, reflections, challenge participation and social content are retained while needed for the account and features, and erased on withdrawal or a deletion request except for necessary report or dispute preservation material and similar exceptions. Ordinary social activity history is also removed on withdrawal, and preserved reports lose their link to the reporting account. Deleted reflection content is removed; IDs, versions and deletion state needed for synchronization may remain while the account exists. Hiding content is different from erasing its text. Automatically generated nickname strings without an account link remain in a reservation list to prevent names being reused in a way that could be confused with a former user. This list does not also store account IDs, email, profiles or activity history.
Email inquiries and responses are retained for three years after resolution, with an operator managing due dates and deletion results. Report and dispute evidence and related moderation history are retained for one year after resolution. Unresolved reports receive a deadline when resolved; a reporter withdrawing their account does not itself erase the evidence. Where a statutory obligation or a separate ongoing dispute requires preservation, necessary material is retained with a reason and review deadline, and the hold is released when the reason ends. Preserved material is used only for handling reports or disputes. A scheduled job removes expired reports and associated moderation history. These are Yawnzy operating periods, not a claim that every category has mandatory statutory retention.
Challenge photos expire 30 days after the challenge ends. Account or post deletion or expiry restricts access, and a cleanup queue retries deletion of the original and thumbnail objects. Photos registered in the database but not attached to a post become eligible for cleanup after 24 hours; stored objects with no remaining database reference become eligible after 48 hours. These are eligibility times, and failures or a queue can delay actual deletion. Previously issued photo responses may remain valid or cached for up to 60 seconds. We cannot remotely erase copies another user has already saved independently.
The current Neon database point-in-time recovery window is one day. Recovery history is distinct from deletion in the active store; previously requested deletions are reapplied after recovery. Neon photo-object deletion applies to the current branch and does not mean immediate physical erasure from other branches or all internal provider copies. Our operating rule prohibits copying production photos to test branches.
Server request and error logs are processed for troubleshooting and security. Standard Vercel Pro runtime-log retention is one day; separate observability options, security logs and the provider’s own operational information follow their respective contractual retention policies. We do not intentionally write passwords, authentication tokens, reflections or chat contents to diagnostic logs.
When the retention purpose or period ends, an operator checks the deletion scope and exceptions before deletion. Electronic material is removed from service storage and handled under its deletion procedures. Paper material, if any, is shredded or destroyed by similarly difficult-to-reverse means. Requests follow intake, identity verification, scope review, processing and notification of the result. We explain any delay or reason for separate retention.
8. Requests for access, correction, deletion or suspension of processing
You can send requests concerning access, correction, deletion or suspension of processing of your Yawnzy personal information, account deletion or withdrawal of consent to the privacy contact below. Use “Yawnzy privacy request” as the subject and include your registered email address and request details. Do not send passwords or verification codes. We may request identity verification to the extent needed to avoid disclosing another user’s information.
You can edit alarm settings, reflections and other editable information in the app. After verifying your identity, delete your account and server data in Settings → Delete account in the app or on the account deletion web page. You can also contact our privacy email. Uninstalling the app does not delete your server account. Requests may also be made by a legal or authorized representative, whose authority we verify only as necessary.
You can use basic alarms as a guest. If you do not want personal record sync, use the app as a guest and separately request suspension of processing or deletion of information already stored on the server. You can change camera, photo and motion permissions in your phone settings.
Depending on the law where you live, you may request a copy, portability, restriction, objection or withdrawal of consent. Withdrawal does not affect the lawfulness of processing before withdrawal. If a request is refused or restricted, we explain why and how to challenge the decision. You can also contact your local data protection authority or the dispute-resolution bodies below.
9. Cookies, local storage and information security
The website and app use cookies or device storage to maintain sign-in, remember language choices, store alarms and records, and support offline sync. Deleting or blocking cookies or device storage may sign you out or remove records that exist only on that device.
We use account-scoped access checks, authentication rate limits, password hashing and secure storage for mobile credentials. Server communication uses HTTPS, and photos are served through restricted access to private storage. Access to personal information is limited to people who need it for their work, and an operator reviews retention and deletion scope.
Yawnzy is intended for ages 14 and older. If we learn of personal information collected from a child under 14, we restrict use and delete it after necessary checks. A parent or guardian can contact our privacy team. The app stores a self-declared country of residence and age range on the device, not a birth date or precise location. Advertising and app usage analytics stay off before this selection and for under-14 selections. Ages 14–17 receive teen or stricter child-treatment advertising according to the country policy, without personalized advertising; optional app usage analytics is disabled for them. Country and age changes invalidate existing ad permission and withdraw app analytics consent. These selections are not identity or age verification or parental consent, and do not establish eligibility for social features in every country. Regional device and consent-flow validation is still required before public release.
10. Operator and privacy contact
Operating entity: Learning Spoons Co., Ltd.
Privacy officer: Changmin Lee
Email: help@learningspoons.com · Telephone: +82-2-3445-5170
We use the contact details published in the company’s official privacy policy. Please indicate that your request concerns Yawnzy so it can be distinguished from requests about other services.
11. Changes and effective date
This policy takes effect on October 25, 2026. The public address is https://www.yawnzy.app/privacy. Material changes to data, purposes or sharing will be reflected in this policy and announced in the app or public page, with separate consent where required.