HardWake — Privacy Policy
Last updated 6 September 2026. Applies to the HardWake Android app
(com.obaylabs.hardwake).
Alarms and wake history stay on your phone. Pro purchases use secure server verification.
What HardWake collects
Pro verification processes purchase tokens and product IDs. There is no analytics SDK, no crash-reporting SDK, no advertising SDK and no tracking library of any kind in the app.
What HardWake stores, and where
| Data | Where | Leaves the device? |
|---|---|---|
| Alarms (times, repeats, challenges, sounds) | App-private database | No |
| A mirror of armed alarms | Device-protected app-private storage | No |
| Wake history and statistics | App-private database | No |
| App settings | App-private storage | No |
| Tahajjud location (latitude/longitude) | App-private storage | No |
| Pro entitlement cache | App-private storage | No |
Nothing is written to shared or external storage.
Accounts
There are none. No email, no phone number, no social login, no cloud sync. The app is fully functional the moment it is installed.
Permissions, and exactly why
| Permission | Why | When it is requested |
|---|---|---|
| Exact alarms | Alarms must fire at the time you set | Install time |
| Notifications | Android requires it before an alarm can show anything | First launch after onboarding |
| Run at startup | Restore your alarms after a reboot | Install time |
| Foreground service (media playback) | Keep the alarm ringing with the screen off | Install time |
| Wake lock, vibrate | Wake the device and vibrate | Install time |
| Full-screen intent | Show the alarm over the lock screen | Install time |
| Ignore battery optimisation | Stop the system killing the app before your alarm | Only from the reliability panel, only when needed |
| Physical activity | Count steps for the Walking challenge | Only when you enable that challenge |
| Camera | Scan the code you registered, to dismiss an alarm | Only when you set up a QR or barcode challenge |
| Approximate location | Compute Fajr for Tahajjud mode | Only when you turn on Tahajjud mode |
| Billing | Google Play purchases | Install time |
| Internet, network state | Google Play purchases and secure Pro verification | Install time |
No permission is requested during onboarding. Camera, location and physical activity are requested by the features that need them, at the moment you turn them on, and the app works fully without any of them.
About the camera
- Frames are decoded on the device, by a plain Java decoder with no network code in it.
- No frame is saved. Nothing is written to storage, to a cache, or to a log.
- The code's contents are never stored. A QR code can hold a home address, a Wi-Fi password or an account URL. HardWake only needs to answer "is this the same code as before?", so it keeps a salted SHA-256 fingerprint of the payload plus the name you gave it ("Bathroom mirror"). The payload itself is discarded as soon as the fingerprint is computed.
- The salt is random and per-registration, so the fingerprint cannot be tested against a list of likely payloads.
- The camera runs only while a scanning challenge is on screen, and is released when it leaves.
If you revoke the permission later, alarms that used a code fall back to a solvable challenge rather than becoming impossible to dismiss.
About location
- Only approximate location is requested, never precise.
- It reads the last known position rather than requesting continuous updates.
- The coordinates are stored locally and never transmitted.
- Tahajjud mode works entirely without the permission — you can type a latitude and longitude instead.
Google Play Billing
Google processes payments. HardWake sends purchase tokens and product IDs over HTTPS to its Google Cloud verification service. The service checks Google Play and stores hashed receipt IDs, Pro status, expiry and revocation records in Firestore. Application code does not store raw tokens. Infrastructure request logs may include IP addresses. No alarms, location, wake history or challenge content is sent to this service. Purchases are governed by Google's own privacy policy.
Backup
Android's own encrypted backup and device-transfer include your alarms and settings, so a new phone restores the alarms you depend on. The Pro entitlement is excluded (Google Play is the authority on it) and so is the direct-boot mirror (derived state). You can turn backup off system-wide in Android's settings.
Children
HardWake is not directed at children.
Deleting your data
Wake history can be cleared from Settings › Privacy. Uninstalling removes local app data, but does not delete server-side billing verification records. Contact us about billing data.
Changes to this policy
If this policy changes, the updated version will be published at this address with a new date at the top. HardWake will never start collecting data without saying so here first.
Contact
Questions about this policy: hello@obaylabs.com
HardWake is made by Obay Labs. No ads. No account.