Bed Quitter Privacy Policy

Last updated: 5 November 2026. Effective date for the public release: to be set before launch.

Bed Quitter is a workout alarm for Android and iPhone. This policy covers both; where the iPhone app differs, the section “On iPhone” says how. It has no advertisements, billing, feeds or friend lists; you can share a card of your morning and invite a friend (below). Signing in is optional: it only keeps a backup of your app data in your Google account, and the app works fully without it.

Camera and workout detection

Bed Quitter uses the front camera to count the movement you choose, such as squats, push-ups or lunges. Camera frames and body landmarks are processed in memory on the device. They are not saved, uploaded, or shared. If the user enables optional personalized push-up detection, the app stores only median top and bottom elbow angles and normalized body bounds; it does not store individual landmarks or frames. Camera processing stops when the challenge ends or leaves the foreground.

Alarm and app data

Alarm times, weekdays, exercises, repetition targets, selected tone references, setup status, optional personalized calibration values, challenge results and totals are kept in the app’s private local storage. Unless you sign in (below), Bed Quitter does not back up this data to the cloud. Clearing app storage or uninstalling the app removes the copy on the device.

Optional account and backup

You can sign in with a Google account, during setup or later in Settings. Signing in is never required, except to invite friends or come in through a friend’s invite (see “Sharing and invites”).

What we receive from Google: your Firebase user ID, name and email address, through Firebase Authentication. We do not receive your Google password, contacts, photos or any other Google data.
What is backed up: a compressed copy of the same data a backup file holds (alarms, settings, movement setup and calibration values, challenge results and totals), plus when it was saved, the app version, the phone model, and counts of alarms, wake-ups and set-up movements so you can recognise the backup before restoring it. Camera frames, videos and body landmarks are never backed up.
Where it is kept: in Google Cloud Firestore through Firebase, in the United States (multi-region nam5). Only your signed-in account can read, replace or delete your backup. Data is encrypted in transit and at rest by Google.
When it is sent: after you sign in and choose what to keep, about ten minutes after your data changes, and when you tap Back up now. If your account already has a backup, nothing replaces it until you choose Restore or Keep this phone’s.
Retention: the backup stays until you replace it, delete it, or delete your account. Signing out stops backing up and keeps the backup in your account.
Deleting it: in the app, Settings → your account → Delete account removes the backup and your account. You can also request deletion at https://bedquitter.app/delete-account/ or by emailing support. Google processes this data under the Firebase terms and privacy documentation.

Sharing a card: when you tap Share, the app draws a picture of your morning or your streak and hands it, with a line of text and your invite link, to the app you pick in your phone’s share sheet. Bed Quitter receives nothing from this; the app you share to handles it under its own policy. If you tap Save image, the picture goes to your photos.
Your invite link needs your Google account: invites work only while you’re signed in, so that each person can take one invite, once. The first time you open Invite a friend or share a card while signed in, our server makes a random six-character invite code (for example K7M4QX) for your account and keeps which account it belongs to. Your link is bedquitter.app/i/ followed by that code. Signed out, a shared card carries bedquitter.app with no code.
When a friend uses it: the friend’s app keeps your code. Once they’re signed in, it tells our server twice: when it takes the invite, and after they finish their first alarm. The server checks their account is new, hasn’t taken another invite and isn’t yours, and keeps which account took your code. Their streak save, and yours, come only once the server has their first alarm. On Android, Google Play hands the code to the app after the install (the Play install referrer), and the app reads it once.
What you see: your app reads how many friends finished their first alarm with your code, and a list with one line per friend: whether they joined or finished, from Android or iPhone, and when. It never names them, and they never see you. Only your account can read your code’s record.
What protects it: the server’s functions take a request only from a signed-in account and, through Firebase App Check, only from the real app on a real phone (Play Integrity on Android). A code collects at most 10 friends’ first alarms a day.
Where it is kept: in Google Cloud Firestore through Firebase, in the United States (multi-region nam5); the functions run in Google Cloud in the United States. Deleting your account removes which account owns a code and which code it took; the friends’ lines under your code stay without anything that leads to you, so a friend who came in through it still gets their save.

Optional beta diagnostics

If the user opts in, Bed Quitter uses Firebase Analytics and Firebase Crashlytics to collect:

Alarm delivery delay, without the configured alarm time or alarm identifier.
When an alarm didn’t ring on time: how (didn’t ring, rang late, stopped early, phone was off), whether Android reported the app was closed, minutes late, the phone’s maker, whether battery saving is off for the app, and Android’s standby bucket for it. Test alarms report whether they rang and how late.
Camera-ready time, processing time, and processed frames per second.
Exercise type and challenge outcome.
When you share or invite: that the share preview opened, which kind of card and shape, which app you picked (its package name), and that an invite was reported or earned saves. Never the card, its text or your code.
Android version, RAM bucket, and device model.
Crash stack traces and related diagnostics.

Diagnostics never include camera frames, videos, body landmarks, alarm times, alarm IDs, selected tone URIs, names, email addresses, or personal content.

Diagnostics are used only to measure beta reliability, performance, and crashes. Analytics user- and event-level retention will be configured to two months. Firebase Crashlytics retains crash information and associated identifiers for 90 days before beginning deletion. Google processes this information under its Firebase terms and privacy documentation.

Diagnostics are disabled by default in the public release. In the beta build shared with invited testers they start on, and the Privacy screen says so. Users may enable or disable them in Settings at any time. Disabling diagnostics stops future collection, resets local Analytics data, and deletes unsent crash reports.

Beta testing (invited testers only)

The beta build is shared through Firebase App Distribution, which Google runs. To get it, testers accept an email invitation with their Google account; App Distribution then knows that email, which builds they were sent, and when they installed them. If a tester turns on update alerts, the app signs in to App Distribution with that account to offer new versions. If a tester sends feedback from Settings, it holds their note, a screenshot they can leave out or replace, the tester’s email, the app version and the phone’s model and Android version; only the Bed Quitter team reads it, in the Firebase console. A tester can ask for their feedback or tester record to be deleted at any time. None of this is in the public release.

Problem reports

When a test alarm doesn’t ring and nothing is left to change in the app, Alarm checks offers to send a problem report. It is sent only when you tap Send a report, whether or not diagnostics are on, and the app lists what it holds before you send it:

The phone’s maker and model, Android version and app version, and how Android has been treating the app (its standby bucket, whether background use is restricted, and how its last processes ended).
The alarm checks and whether each passed, and which of the phone maker’s settings steps are marked done.
For the last 14 days, when each alarm and quick check was due, when it rang, how it ended, and whether it didn’t ring on time; and the last test alarm.
Anything you type in the optional note.

A report never includes camera frames, videos, body landmarks, your name, your email or your account. It carries a short code (for example BQ-4F2K) that the app shows you, so you can tell us which report is yours. Reports are kept in Google Cloud Firestore through Firebase, in the United States (multi-region nam5). The app can add a report but not read, change or delete one; only the Bed Quitter team reads them, to find out why an alarm didn’t ring. During the beta they are deleted within 90 days. To have one deleted sooner, send us its code.

On iPhone

The iPhone app is still being built. Where it differs from the Android app:

Camera: the same rules apply. Apple’s Vision framework finds your body in each frame on the iPhone itself; frames and body points are handled in memory, then let go. Nothing is saved, uploaded or shared.
Alarms and app data: alarms are set through Apple’s AlarmKit, which asks your permission first. The app’s data stays in its private storage on the iPhone and is left out of iCloud and computer backups. Deleting the app removes it.
Nothing leaves your iPhone: the iPhone app has no sign-in, account backup, diagnostics or problem reports yet, so it has no invites either: a card you share carries bedquitter.app with no code. Opening a friend’s invite link keeps their code in the app for when sign-in comes, and sends nothing. Before anything comes to iPhone, this policy will say what it sends.
Permissions: it asks only for the camera and for alarms. Spoken coaching uses the iPhone’s own voices, on the device.
Apple’s own reports: if you choose in iPhone Settings to share analytics with app developers, Apple may pass us crash reports and usage statistics under Apple’s privacy policy.

Website and launch waitlist

This policy also covers the Bed Quitter website at bedquitter.app.

Free tools: the calculators run in your browser. The times and numbers you enter stay in your browser; they are not sent anywhere or saved. The snooze receipt’s picture is drawn in your browser too, and goes only where you share or save it. Analytics (below) only records that a tool was used, never what you entered. The clock change page works out your time zone’s next change in your browser, from the time zone your device is set to; that time zone isn’t sent anywhere. A shared link to a wake up earlier plan, and the clock change page’s Open in the planner link, hold only the plan’s times, dates and choices (from the clock change page, also a place you picked from its list, never your device’s time zone). They come after a # mark, which browsers don’t send to the website, and analytics doesn’t record them.
Your location, on the Brahma Muhurta page: that page can use your device’s location to work out sunrise where you are, only after you tap Use my location and your browser asks you. The location is used on your device only: it is not sent to us or to anyone else, not saved, and not put in any address. The city you pick there, and how you choose to count, are remembered in your browser’s local storage for your next visit. If you share a link to the page, the link names the city you picked (never your location) after a # mark, which browsers don’t send to the website and analytics doesn’t record. Analytics only records that its calendar file was saved, never the city you picked or your device’s location.
Analytics: we use Google Analytics 4 to count visits and see which pages and tools people use. It records the pages you view, the site that sent you, your device type and browser, your rough location (country and city, which Google works out from your IP address; Google Analytics doesn’t store the address), Google Analytics’ standard measurements (how far you scroll, clicks on links to other sites, file downloads, and starting or sending a form, never what you typed into it), and these events: a tool used (on the wake up earlier planner, also which preset was picked: exam morning, college exam, short night or clock change, never the times or dates in it), a calendar file downloaded or a result shared, a snooze receipt picture shared or saved (which of the two, and whether it was the India receipt or the one for everywhere else; never the numbers on it), whether the 2-minute alarm test rang, a button that leads to the waitlist or the store buttons, a test or a fix page clicked, a waitlist or challenge email sign-up (never your email), a challenge printable opened (which one, and which file), whether the squat demo was started, finished or couldn’t run and why (never anything from the camera), a store button tapped, a phone fix page opened, and an invite page opened or its Google Play button tapped. Invite pages are recorded without their code, and a link to a tool’s result without the times and numbers in it. When the Android app opens a fix page on the site, its address names your phone’s maker (the page it opens) and says it came from the app and from which screen, including whether an alarm hadn’t rung on time; it carries nothing else about you or your phone. For a maker without a page of ours yet, the site passes you straight on to that maker’s guide on dontkillmyapp.com, a separate site with its own privacy policy, and the app’s link reaches it unchanged. It sets first-party cookies (_ga and _ga_EZ48FCFR7F) holding a random ID for up to two years. Google signals and ad personalisation are off, and nothing is used for advertising. Google processes this data, mostly in the United States, and keeps the detailed records for 2 months; report totals are kept longer.
Your choice: if your device’s time zone is in Europe, nothing from Google Analytics loads until you choose Allow. Anyone can change their answer under Cookie settings at the bottom of every page; No thanks stops analytics and removes its cookies. Your answer is kept in your browser’s local storage.
Hosting: the site’s fonts and images, and the squat demo’s body finder, come from the site itself. To deliver the pages, Firebase Hosting (run by Google) handles your IP address and the pages you request, under Google’s Firebase terms; we don’t use that to identify you.
What the waitlist keeps: if you join, we store the email address you type, the page you joined from, whether your device looked like Android, iPhone or something else (worked out from your browser, kept only as that one word), and when you joined. Nothing else is collected with it.
Where it is kept: in Google Cloud Firestore through Firebase, in the United States (multi-region nam5). The website can add a sign-up but cannot read, change or delete one; only the Bed Quitter team reads the list, in the Firebase console.
What we use it for: one email when Bed Quitter is out on Google Play, or when the iPhone version is out if you joined from an iPhone. We don’t send other email, and we never sell or share the list.
Retention: we delete the list within 30 days of sending that launch email. To be removed sooner, email us from the address you signed up with.

Challenge emails

The 30-day challenge printables page offers 4 short emails during the January challenge, which starts on 1 January 2027. This is a separate list from the launch waitlist: joining one doesn’t add you to the other. The printables themselves download without an email.

What we keep: the email address you type, that you ticked “I’m 18 or older”, which version of the form’s wording you saw (so we can show what you agreed to), the page you signed up on, and when you signed up. Nothing else is collected with it.
What we use it for: 4 short emails during the challenge, with tips for it and a word about the Bed Quitter app. We don’t send other email to this list, and we never sell or share it.
Legal basis: your consent, which you give by sending the form (Article 6(1)(a) of the GDPR and the UK GDPR). You can withdraw it at any time; that stops the emails still to come.
Adults only: the emails are for people 18 or older, which the form asks you to confirm in a box of its own. If we learn an address belongs to someone under 18, we delete it.
Where it is kept: in Google Cloud Firestore through Firebase, in the United States (multi-region nam5). The website can add a sign-up but cannot read, change or delete one; only the Bed Quitter team reads the list, in the Firebase console.
Who sends the emails: an email delivery service will send them for us, only on our instructions. We haven’t chosen it yet. Before any address is copied to it, and before the first email, we will name it here, with where it keeps data and whether it records when an email is opened or a link clicked.
How to stop them: reply to any of the emails, or email support@bedquitter.app from the address you signed up with. We then stop sending and delete your address, here and at the email service.
Retention: we delete the whole list, here and at the email service, once the challenge’s last email has gone, and by 28 February 2027 at the latest.

Camera on the website

The “Try it: 5 squats” page (bedquitter.app/try/) can use your device’s camera to count squats in your browser.

Only after you tap Start: nothing for the camera loads, and your browser doesn’t ask for it, until you tap Start. Your browser then asks your permission. You can say no, and you can turn it off later in your browser’s settings.
Frames never leave your device: each camera frame is read in memory, in the page, by Google’s MediaPipe Pose Landmarker, which runs in your browser from files on bedquitter.app. It finds points on your body; the squat counter reads the shoulder, hip, knee and ankle points; then the frame and its points are dropped. No photo, video or body points are saved, uploaded or shared, with us or with anyone else.
The library’s usage reports are blocked: MediaPipe is made to send Google usage and performance figures, such as which task ran, how fast it ran and your device’s operating system, though never images. The page refuses those requests twice: in its own script, and with a security policy that lets the page connect only to bedquitter.app, Google Analytics and the waitlist’s database. So they are not sent.
When it stops: the camera turns off when your five squats are done, when you tap Stop, and when you leave or hide the page.
What analytics hears: only that the demo was started, finished, or couldn’t run and why (for example, the camera was turned off, there was no camera, or the page was open in an app’s built-in browser). Never a picture, a body point or anything else from the camera.

Permissions

On Android, Bed Quitter requests camera, notification, exact-alarm, full-screen-alarm, vibration, boot, and foreground-service permissions only for workout challenges and reliable alarms. It uses the network only for invites, the optional account backup, diagnostics, problem reports you choose to send and, in the beta build, update alerts and feedback; alarms and the camera never need it. It can fill in a backup alarm in your phone’s own clock app, which you then save there (the set-alarm permission). The beta build can also download and install its own new versions, which Android asks you to allow. It never prevents access to Home, power, or other system controls.

Contact

For questions about this policy or your data, or to have something deleted, email support@bedquitter.app. This policy is published at https://bedquitter.app/privacy/.