privacy policy
this privacy policy describes how rayyan studio ("we," "us," "our") collects, uses, and shares information when you use the koalarm mobile application (the "app"). we built koalarm to wake you up reliably, not to harvest your data. we collect the minimum needed to make the alarm work and the koala talk.
1. information we collect
- device microphone audio — captured only while a wake-up voice session is active and streamed in real time to our voice provider so the koala can converse with you. audio is not stored on our servers after the session ends.
- camera images — captured only when you start the photo-verify challenge, processed on-device to confirm completion, and discarded immediately after.
- motion & step data — read from apple healthkit / coremotion only during the walk and dance challenges, used on-device to confirm completion.
- onboarding answers — your name, preferred wake time, koala mode, and challenge preference. stored locally on your device. not uploaded.
- subscription & purchase data — purchase receipts and entitlement status from apple, processed by revenuecat to keep your premium status in sync across devices. revenuecat assigns an anonymous user id; we do not collect your apple id, email, or payment details.
- diagnostic logs — anonymous error reports and crash logs to fix bugs.
2. how we use information
- to schedule and fire alarms via apple alarmkit on your device.
- to drive the live voice koala via openai's realtime api (audio streamed through livekit).
- to verify wake-up challenge completion on-device.
- to manage your subscription and unlock premium features.
- to fix bugs and improve the app.
3. third parties we work with
we share data with the following providers strictly to deliver the service:
- apple inc. — alarmkit, app store payments, push notifications. governed by apple's privacy policy.
- openai, l.l.c. — real-time voice agent. audio streamed during wake-up sessions only. openai does not retain audio for training, per its api terms.
- livekit, inc. — webrtc infrastructure that pipes audio between your device and the voice agent.
- revenuecat, inc. — subscription state and entitlement validation.
- supabase, inc. — encrypted backend for non-sensitive app state.
- fly.io, inc. — hosting for the voice-agent edge servers.
we never sell your data and we do not run third-party advertising or tracking sdks.
4. permissions we ask for
- microphone — required for the voice koala.
- camera — only requested if you choose the photo-verify challenge.
- motion & fitness — only requested for walk / dance challenges.
- notifications — required for the alarm to fire reliably.
- alarmkit — required to schedule system-level alarms.
5. data retention
voice and camera data is processed in real time and not retained beyond the session. onboarding answers and alarm settings live on your device only and are deleted when you uninstall the app. subscription metadata persists at revenuecat per their retention policy until you request deletion.
6. your rights
depending on where you live (eu, uk, california), you may have the right to access, correct, or delete personal data we hold about you, and to lodge a complaint with a supervisory authority. to exercise any right, email hello@rayyanstudio.com and we'll respond within 30 days.
7. children
koalarm is not directed at children under 13 (16 in the eu). we do not knowingly collect data from children. if you believe a child has provided data, contact us and we will delete it.
8. security
data in transit is protected with tls. voice sessions are end-to-end encrypted by livekit. on-device data is protected by ios's data protection classes. no system is 100% secure; if we ever experience a breach affecting your data, we will notify you as required by law.
9. changes to this policy
we may update this policy as the app evolves. the "effective date" above will reflect any change. continued use of the app after an update means you accept the revised policy.
10. contact
questions, requests, complaints — email hello@rayyanstudio.com.