Privacy Policy

1. About this Policy

This Privacy Policy explains how Codevia LLC ("Codevia", "we", "our", "us") — a limited liability company organized under the laws of the State of New Mexico, United States — collects, uses, and protects information in connection with:

• The AlarmChampion mobile application for Android (the "App"); and
• The website codevia.pro (the "Site").

By using the App or the Site you agree to the practices described below. If you do not agree, please do not use the App or Site.

2. Where the Service is Available

The App and the Site are available globally where Google Play distributes applications. Codevia complies with applicable U.S. law, the General Data Protection Regulation (GDPR) for users in the European Economic Area, the UK GDPR for users in the United Kingdom, the California Consumer Privacy Act (CCPA/CPRA), Brazil's LGPD, Mexico's LFPDPPP, and other applicable data protection frameworks of the user's country of residence.

3. Data We Collect

3.1 Information you provide

• Alarm configuration, missions, tones, wallpapers and general settings you create in the App.
• Email content you send to us for support (support@codevia.pro) or privacy requests (privacy@codevia.pro).
• Google Sign-In (optional): if you choose to sign in with Google, we receive your name, email address, and profile photo URL from Google via Firebase Authentication. This information is stored solely to identify your account within the App and is never shared with third parties beyond what is required to operate Firebase Authentication. Signing in is entirely optional — all core features work without an account.

3.2 Location (optional — Morning / Weather)

• What: Approximate location only (no precise GPS). We use ACCESS_COARSE_LOCATION.
• Why: To show local weather in the Morning tab via WeatherAPI.com.
• Consent: We ask for explicit consent before collecting. Location stays off until you accept.
• Retention: Cached locally for up to 30 minutes, then automatically discarded.
• Control: You can revoke consent any time in Settings → Privacy → Weather or by clearing the app data.

3.3 Photos and Camera (optional — Photo & Barcode missions)

• The camera is activated only while you are actively running the Photo mission or the Barcode/QR mission.
• Captures are processed on-device with Google ML Kit (barcode scanning and image matching).
• Photos used to dismiss an alarm are stored locally to allow the mission to validate the shot; they can be deleted from the app's storage.
• Nothing from the camera is uploaded to Codevia's servers.

3.4 Motion & Activity sensors (optional)

• Accelerometer (Shake & Squat missions), step counter (Step mission and sleep-movement detection).
• Permission requested: ACTIVITY_RECOGNITION (Android 10+) for step counts.
• All motion data is processed on-device. Nothing is uploaded.

3.5 Microphone / Audio (optional — Sleep Tracking)

3.6 Device and technical data

• Device model, Android version, app version, language and locale settings.
• Crash reports and diagnostic events (only if you consent — see section 6, Firebase Crashlytics).
• We do not collect IMEI, MAC address, phone number, or contacts. Email address and display name are collected only if you choose to sign in with Google (see section 3.1).
• Android's Advertising ID (AD_ID) is not collected by Codevia directly. When advertising is active, the Google AdMob SDK may read your Advertising ID for ad serving and frequency capping (see section 6). You can reset it or opt out of ad personalization at any time in Android Settings → Privacy → Ads.

3.7 Remote content served to the App

• The App downloads a catalog of alarm tones and wallpapers from our Firebase Firestore database.
• This flow is one-way: from our server to your device. We do not write user data to Firestore.
• Your IP address is necessarily visible to Google/Firebase when the App fetches content; Google's processing is described in section 6.

3.8 Purchases and subscriptions

• AlarmChampion may offer paid Premium features, including monthly and annual subscriptions, promotional subscription offers, free trials, and one-time lifetime access.
• Payments are processed by Google Play Billing. Codevia does not collect, receive, or store your credit card number, bank account, billing address, or full payment credentials.
• The App receives limited purchase information from Google Play, such as product ID, purchase state, acknowledgement state, purchase token, and whether an active subscription or one-time purchase exists.
• We use this purchase state only to activate Premium features, hide or reduce ads for Premium users, handle pending purchases, restore purchases, prevent unauthorized access, and provide support.

4. How We Use Your Data

• Deliver core alarm, sleep-tracking, mission and weather features.
• Activate and manage paid Premium features purchased through Google Play Billing.
• Maintain and improve the App, including stability fixes (crash reports, with consent).
• Measure advertising and marketing campaign performance when you consent.
• Respond to your support or privacy requests.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not use your data for profiling, automated decision making with legal effects, or behavioral advertising beyond what AdMob does for ad serving.

5. Legal Basis for Processing

For users in the European Economic Area, the United Kingdom, and Switzerland, the GDPR, UK GDPR, and Swiss FADP require a lawful basis for each processing activity (Art. 6 GDPR). For users in jurisdictions with similar data-protection frameworks — such as Brazil's LGPD, Mexico's LFPDPPP, or California's CCPA/CPRA (see section 8) — the same activities are justified on equivalent grounds. The table below maps each purpose to its lawful basis:

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Where processing is based on legitimate interest, you have the right to object (see section 10).

6. Third-Party Services

7. Storage and Security

7.1 Where your data lives

• Alarm configuration, mission history, sleep results and app preferences are stored locally on your device (Room database and Android DataStore).
• Uninstalling the App or clearing its storage permanently deletes this local data from your device.
• Optional account data: if you sign in with Google, your Firebase Authentication record (UID, email, display name) is stored on Firebase servers (Google LLC). You can permanently delete it at any time from Settings → Account → Delete Account. We will also process deletion requests sent to privacy@codevia.pro within 30 days. If you have not signed in, we do not maintain any server-side record of you.

7.2 Security measures

• HTTPS only: cleartext HTTP traffic is disabled system-wide (usesCleartextTraffic="false").
• Signed & obfuscated builds: release builds are signed, minified and obfuscated with R8/ProGuard.
• No cleartext secrets: API keys are injected at build time from files outside the source repository.
• Scoped permissions: optional permissions (microphone, camera, location, activity) are requested only when the feature is invoked.
• No backup of sensitive data: Android auto-backup is disabled (allowBackup="false").

No method of electronic storage is 100% secure. We take reasonable measures to protect your data but cannot guarantee absolute security.

8. California Residents (CCPA / CPRA)

8.1 Categories of data we collect

8.2 Your California rights

• Right to know what we collect and how we use it.
• Right to delete personal information (see section 10).
• Right to correct inaccurate personal information.
• Right to limit the use and disclosure of Sensitive Personal Information (we already limit it by keeping audio on-device).
• Right to non-discrimination for exercising these rights.

To exercise any right, email privacy@codevia.pro from the email you wish to be verified with. We will respond within 45 days.

Do Not Track signals. There is no consistent industry standard for honoring browser or OS "Do Not Track" signals; we do not currently respond to them, but we do not sell personal information regardless.

9. GDPR & UK GDPR Privacy

9.1 Applicability

This section applies to you if you access the App or Site from the European Economic Area (EEA), the United Kingdom, or Switzerland:

• EEA users: processing of your personal data is subject to Regulation (EU) 2016/679 (the GDPR).
• UK users: processing is subject to the UK GDPR as supplemented by the Data Protection Act 2018.
• Swiss users: processing is subject to the revised Federal Act on Data Protection (FADP).

For the purposes of these laws, Codevia LLC is the data controllerfor the personal data processed in connection with the App and Site (contact details in section 16).

9.2 Legal Basis for Processing under GDPR / UK GDPR

Article 6 GDPR (and the equivalent UK / Swiss provisions) requires a lawful basis for every processing activity. The six possible legal bases are:

1. Consent — Art. 6(1)(a): you have given clear, specific, freely given, informed consent.
2. Contract — Art. 6(1)(b): processing is necessary to perform a contract with you, or to take steps prior to entering into one.
3. Legal obligation — Art. 6(1)(c): processing is necessary to comply with a legal obligation.
4. Vital interests — Art. 6(1)(d): processing is necessary to protect someone's life.
5. Public interest — Art. 6(1)(e): processing is necessary for a task carried out in the public interest.
6. Legitimate interests — Art. 6(1)(f): processing is necessary for our legitimate interests, balanced against your rights and freedoms.

Codevia relies on consent, contract, legal obligation, and legitimate interests as set out in section 5. We do not rely on vital interests or public interest. For special-category data (such as audio that could reveal health information through snore detection), we additionally rely on Art. 9(2)(a) — your explicit consent.

9.3 Your Rights under GDPR / UK GDPR

You have the following rights with respect to your personal data:

1. Right of access (Art. 15) — obtain confirmation of whether we process your personal data and a copy of that data.
2. Right to rectification (Art. 16) — have inaccurate data corrected and incomplete data completed.
3. Right to erasure / "right to be forgotten" (Art. 17) — have your data deleted where one of the legal grounds applies.
4. Right to restriction of processing (Art. 18) — limit how we use your data while a dispute is being resolved.
5. Right to data portability (Art. 20) — receive data you provided in a structured, commonly used, machine-readable format, and transmit it to another controller.
6. Right to object (Art. 21) — object to processing based on legitimate interests, including for direct-marketing purposes.
7. Right to withdraw consent (Art. 7(3)) — withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
8. Right to lodge a complaint (Art. 77) — complain to your local supervisory authority (see section 9.5).

You also have the right not to be subject to a decision based solely on automated processing, including profiling (Art. 22). We do not carry out such decision-making.

9.4 How to Exercise Your Rights

• Email: send your request to privacy@codevia.pro from the email address you wish to be associated with the request.
• Response time: we will respond within 30 days of receipt, in accordance with GDPR Art. 12(3). The period may be extended by up to two further months for complex or numerous requests, in which case we will notify you within the first 30 days and explain the reason.
• Identity verification: to protect your data, we may ask you to confirm details that allow us to reasonably verify you are the data subject (or an authorized representative). We will only use information collected for verification for that purpose.
• Cost: exercising your rights is free of charge. We may charge a reasonable fee or refuse to act only where requests are manifestly unfounded or excessive (Art. 12(5)).
• In-app controls: for consent-based processing (analytics, crash reporting, weather, sleep tracking, personalized ads, TikTok attribution), you can also withdraw consent directly inside the App under Settings → Privacy, or through the Google UMP consent dialog for advertising.

9.5 Supervisory Authority

If you believe our processing of your personal data infringes the GDPR, the UK GDPR, or the Swiss FADP, you have the right to lodge a complaint with a supervisory authority — in particular in the EU/EEA Member State of your habitual residence, place of work, or alleged infringement.

• EEA — list of national supervisory authorities: edpb.europa.eu/about-edpb/about-edpb/members_en
• United Kingdom — Information Commissioner's Office (ICO): ico.org.uk
• Switzerland — Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch

We would, however, appreciate the chance to address your concerns first — please contact us at privacy@codevia.pro before lodging a complaint.

9.6 EU / UK Representative (Article 27 GDPR)

Codevia LLC is established in the United States and currently does not maintain an appointed representative under Article 27 of the EU GDPR or UK GDPR. We rely on direct contact at privacy@codevia.pro for all data-subject requests from users in the EEA, UK, and Switzerland, and we will respond within the 30-day GDPR statutory deadline. We will reassess the need for a designated Article 27 representative as our user base in those territories grows.

9.7 Automated Decision-Making and Profiling

We do not engage in automated decision-making that produces legal or similarly significant effects on you. The algorithmic suggestions shown in the App (sleep score, recommended bedtime, etc.) are for informational purposes only and do not produce any binding decision about you.

10. Your Rights & How to Exercise Them

This section consolidates the rights available to you under all applicable laws. For GDPR-specific procedures, see section 9; for California-specific procedures, see section 8.

Depending on where you live, you may have the following rights:

• Access — a copy of the personal information we hold about you.
• Rectification — correction of inaccurate data.
• Erasure — deletion ("right to be forgotten").
• Restriction / Objection — limit or stop certain processing.
• Withdraw consent — for anything processed on the basis of consent (analytics, weather, sleep tracking, personalized ads).
• Portability — to the extent we hold data about you in structured form.
• Non-discrimination — exercising your rights will not result in degraded service.

How to exercise:

• In the App: toggle consent and delete cached data under Settings → Privacy.
• By email: write to privacy@codevia.pro. We respond within 30 days for GDPR / UK GDPR / Swiss FADP requests, and within 45 days for CCPA / CPRA requests.
• Uninstall: because almost all of your data lives on your device, uninstalling the App or clearing its storage deletes it permanently.

11. International Transfers

Codevia LLC is established in the United States. Some of our service providers — Google LLC (Firebase, AdMob, ML Kit, Play Services, Google Play Billing), TikTok, WeatherAPI.com, and Formspree, Inc. — are also located in the United States or operate global infrastructure. When personal data of users in the EEA, UK, or Switzerland is transferred outside their territory, we rely on the following safeguards:

11.1 Transfers from the EEA to the United States

• Standard Contractual Clauses (SCCs). We rely on the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 (Modules 2 and 3, as applicable) for transfers to processors and sub-processors in the United States. Google LLC and other relevant service providers have incorporated these SCCs into their data-processing agreements with Codevia.
• EU–U.S. Data Privacy Framework (DPF). Where the recipient is certified under the EU–U.S. Data Privacy Framework (such as Google LLC), transfers may also be made on the basis of the European Commission's adequacy decision of 10 July 2023 under Art. 45 GDPR. You can verify a participant's current certification on the official Data Privacy Framework list at dataprivacyframework.gov.
• Supplementary measures. All transfers use TLS 1.2+ in transit and access controls at rest. We have assessed (and continue to monitor) the legal regime of the destination country and will adopt additional safeguards if required by case law of the Court of Justice of the European Union.

11.2 Transfers from the United Kingdom

For transfers from the UK, we rely on:

• the UK International Data Transfer Agreement (IDTA), or
• the UK Addendum to the EU SCCs issued by the Information Commissioner's Office, or
• the UK extension to the EU–U.S. Data Privacy Framework ("UK Extension to the DPF") where the recipient is certified.

11.3 Transfers from Switzerland

For transfers from Switzerland, we rely on the Swiss-U.S. Data Privacy Framework where the recipient is certified, supplemented by the EU SCCs adapted for Swiss law.

11.4 How to obtain a copy of the safeguards

You may request a copy of the relevant SCCs, IDTA, or other transfer mechanism by emailing privacy@codevia.pro. We may redact commercial terms before sending.

12. Children's Privacy

The App is intended for users 13 years of age or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contactprivacy@codevia.proand we will delete it promptly.

In jurisdictions where the digital age of consent is higher (for example, 16 in some EU Member States), the minimum age to use the App without parental consent is the higher local threshold, and parental authorization is required below it.

13. Data Retention

14. Review Integrity

Codevia LLC does not solicit, incentivize, manipulate or purchase reviews on the Google Play Store or anywhere else. If the App asks you whether you would like to rate it, the request is generated by Google's native in-app review API after genuine usage milestones and can be safely ignored. We do not condition any feature, reward, or service on you leaving a review.

15. Changes to this Policy

We may update this Policy to reflect changes in our practices or legal requirements. Material changes will be announced with at least 30 days notice inside the App and on this page. The "Last updated" date at the top reflects the latest revision. Continued use of the App after the effective date constitutes acceptance.

16. Contact

Data Controller

Supervisory Authorities

You have the right to lodge a complaint with the data-protection authority of your country of residence:

• California Privacy Protection Agency (CPPA): cppa.ca.gov
• California Attorney General: oag.ca.gov
• European Data Protection Board (EDPB) — list of EEA national authorities: edpb.europa.eu/about-edpb/about-edpb/members_en
• United Kingdom — Information Commissioner's Office (ICO): ico.org.uk
• Switzerland — Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch

We would, however, appreciate the chance to address your concerns first — please contact us at privacy@codevia.pro before reaching out to a supervisory authority.