Privacy Policy

1. Who we are and what this covers

NAV LAB (“NAV LAB”, “we”, “us” or “our”) is an independent software studio, and Risen is one of our apps. This Privacy Policy applies to Risen on iPhone and iPad — including its widgets, Live Activities and Siri and Shortcuts actions — and to this website, getrisen.app (together, “Risen”). Risen is provided by the developer identified as the seller of the app on the Apple App Store, who operates NAV LAB from Vietnam and is the controller of your personal data under this Privacy Policy.

This policy explains what personal data Risen collects, how we use it, who we share it with, how long we keep it and what rights you have. It is the Risen edition of the NAV LAB Privacy Policy, which covers all of our apps and describes Risen in its own section. The two describe the same practices; if they ever differ, the NAV LAB Privacy Policy applies.

You can contact us about privacy at any time at admin@navlab.app.

2. The short version

• No ads, no data sales

  We don’t show ads in Risen, we don’t sell your personal data and we don’t share it for targeted advertising.

• No tracking

  We don’t use your device’s advertising identifier (IDFA) or track you across apps and websites owned by other companies.

• No account

  Your alarms and history stay on your device and, with iCloud Sync, in your private iCloud, which we cannot access.

• Missions checked on your device

  Camera images are analyzed on your iPhone or iPad, in memory only. They are never saved or uploaded, and no video is recorded.

• Analytics, not advertising

  Google Firebase receives usage events and crash reports so we can improve Risen — never your camera images.

• Payments stay with Apple

  Apple processes purchases. We never see your payment card details.

3. Personal data we collect

Risen has no accounts and no servers of our own. Here is an overview; the details follow.

Your alarms, history and onboarding answers

Risen stores your alarms — their times, repeat days, labels, sounds and missions, including mission settings such as a QR code you register — your wake-up history and streaks, and the answers you give during onboarding, such as your wake-up goal and wake-up time. They are kept on your device and, if iCloud Sync is on (it is by default; you can turn it off in Settings → iCloud Sync), in your private iCloud database, which we cannot access.

If you import your own alarm sound, the audio file stays only on your device; just its name and length are saved with the alarm. Your weather settings, including a city you choose, also stay only on your device.

Purchase information

Purchases are processed by Apple, and we never receive your payment card details. RevenueCat, our subscription management provider, gives us information about your Risen Pro purchases, such as the product purchased, transaction identifiers, purchase and expiration dates, renewal status and the country of your App Store account, linked to a random identifier that RevenueCat creates for your installation. RevenueCat also receives Apple’s privacy-preserving attribution data (AdServices), which only indicates whether Risen was installed from one of our Apple Ads campaigns.

Usage, device and diagnostic data

Risen uses Google Firebase — Analytics, Crashlytics and Remote Config — to understand how the app is used, fix crashes and configure features. Firebase receives:

• events about onboarding, including the choices you make there, such as your wake-up goal, wake-up time, first mission and alarm sound;
• events about alarms and missions, such as the mission type and difficulty, how long a mission took, how many attempts it needed and your streak, with alarm identifiers in hashed form;
• the paywall and purchase steps you go through, and whether you use Risen Pro;
• technical information: the app version, device model, operating system version, language, an approximate location derived from your IP address (country or region), crash reports, Firebase identifiers and your device’s identifier for vendor.

These events describe how Risen is used. They never include camera images, and we do not use them for advertising. Occasionally, a crash report can include a fragment of the data involved in the error.

Communications

If you email us, we receive your email address and your message, along with any details you choose to include.

This website

getrisen.app does not use cookies, analytics or advertising trackers. It is hosted by Cloudflare, which processes technical data such as your IP address to deliver the website and protect it against abuse. Its fonts are loaded from Google Fonts, so your browser also sends your IP address to Google when you open a page.

4. How we use personal data and our legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) requires a legal basis for each purpose; we indicate it for each one. Where other laws apply, we rely on the equivalent legal bases under those laws.

• To provide Risen: ring your alarms, run your missions, keep your history, sync it through your iCloud when iCloud Sync is on, show the weather and answer your support requests. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To manage purchases: verify your access to Risen Pro and keep purchase records. Legal bases: performance of our contract with you, and compliance with our legal obligations, such as accounting and tax obligations (Art. 6(1)(c) GDPR).
• To understand and improve Risen: analytics, crash reports, testing new features and measuring whether our Apple Ads campaigns work. Legal basis: our legitimate interest in understanding how Risen is used and improving it (Art. 6(1)(f) GDPR).
• To keep Risen secure: prevent fraud and abuse, fix problems and enforce our Terms of Use. Legal basis: our legitimate interest in protecting Risen, our users and ourselves (Art. 6(1)(f) GDPR).
• To ring the alarms and send the notifications you have enabled. Legal basis: your consent, given through your device’s alarm and notification permissions, which you can withdraw at any time in your device settings (Art. 6(1)(a) GDPR).
• To comply with the law: respond to lawful requests from authorities and establish, exercise or defend legal claims. Legal bases: compliance with our legal obligations, and our legitimate interest in protecting our rights.

Where we rely on our legitimate interests, you can object at any time (see Section 11). We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

5. On-device processing

Risen checks your missions on your device. Nothing it sees or measures during a mission is stored or sent anywhere.

• Camera missions. The QR Code, Photo, Squat, Push-up and Dance missions use your camera. Images are analyzed on your device with Apple’s Vision framework and, for the Photo mission on devices with Apple Intelligence, Apple’s on-device model. They are held in memory only while the mission is checked; they are never saved or uploaded, and no video is recorded.
• Movement. The Steps mission counts your steps with your device’s motion sensors, and the Shake mission detects shakes. While a mission is open, Risen also notices taps and movement so that it can ring again if you stop — for example, if you fall back asleep.
• No AI services. Risen does not send your content to us or to any AI service, and we do not use it to train AI models.
• Widgets, Live Activities, Siri and Shortcuts. Risen’s widgets and Live Activities show your alarms on your device. When you use Siri or Shortcuts with Risen, Apple processes your request under the Apple Privacy Policy.

6. Device permissions

Risen asks for access to parts of your device only for the features that need them, and only when you first use those features. You can change any permission at any time in your device’s Settings; the related feature then stops working, and the rest of Risen continues to work.

• Alarms and notifications: to ring your alarms, including in Silent mode and during a Focus, and to show them on the Lock Screen. Risen cannot ring without the alarm permission.
• Camera: for the QR Code, Photo, Squat, Push-up and Dance missions. Images are processed on your device and never saved (see Section 5).
• Motion & Fitness: to count your steps in the Steps mission.
• Location: optional, only while you use the app, and only approximately (about 3 km), to show the local weather. You can choose a city instead.

7. Who we share personal data with

We share personal data only in the following cases:

• Service providers that process data on our behalf and under our instructions: Google (Firebase Analytics, Crashlytics and Remote Config), RevenueCat (subscription management) and Cloudflare (hosting for getrisen.app).
• Apple services you use: when you sync with iCloud, make a purchase on the App Store, check the weather (Apple WeatherKit), search for a city (Apple Maps) or use Siri and Shortcuts, Apple receives the data needed for that service and processes it under its own terms and privacy policy.
• Other people, when you choose: for example, when you share your wake-up streak or a link to Risen.
• Legal reasons: when required by law or by a valid request from public authorities, or when necessary to protect the rights, safety or property of our users, the public or ourselves, including to prevent fraud and abuse.
• Business transfers: if we are involved in a reorganization, merger, acquisition or sale of assets, your data may be transferred as part of that transaction and will remain protected by this Privacy Policy. We will inform you before your data becomes subject to a different privacy policy.

We do not sell your personal data and we do not share it for cross-context behavioral advertising.

8. International transfers

We and our service providers process personal data in several countries, including Vietnam, the United States and member states of the European Union, which may be outside your country of residence. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country that does not offer an adequate level of protection, we rely on appropriate safeguards, such as the standard contractual clauses adopted by the European Commission that are included in our service providers’ data processing terms, or the provider’s certification under the EU-U.S. Data Privacy Framework. You can contact us for more information about these safeguards.

9. How long we keep personal data

• Data on your device or in your iCloud account: until you delete it, delete the app, or delete Risen’s data from iCloud. We never hold a copy.
• Purchase records: for as long as necessary to meet our legal and accounting obligations. Apple and RevenueCat keep their own records of your purchases under their own policies.
• Analytics and crash data: kept by Google Firebase according to the retention settings of those services.
• Correspondence: for as long as necessary to handle your request and for a reasonable period afterwards.

We may keep certain data longer when the law requires it or when it is necessary to establish, exercise or defend legal claims.

10. Security

Risen keeps your alarms and history on your device and in your own iCloud account, where they are protected by Apple, and the services it relies on use encryption in transit (HTTPS/TLS). No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to security incidents. Where the law requires it, we will notify you and the competent authorities of a personal data breach.

11. Your rights and choices

Depending on where you live — for example under the EU or UK GDPR, the Brazilian LGPD, the privacy laws of U.S. states such as California, or the personal data protection laws of Vietnam — you may have the right to:

• access the personal data we hold about you and obtain a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict certain processing, or object to it, including processing based on our legitimate interests;
• receive the data you have provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another provider (data portability);
• withdraw your consent at any time where processing is based on consent, without affecting processing carried out before the withdrawal;
• lodge a complaint with a data protection authority, in particular in your country of residence.

California and other U.S. states: we do not sell your personal information or share it for cross-context behavioral advertising, and we will not discriminate against you for exercising your privacy rights.

Deleting your data

1. In Risen: go to Settings → iCloud Sync → Clear All Data. This deletes your alarms, wake-up history and onboarding answers on your device and, if iCloud Sync is on, in iCloud and on your other devices.
2. Deleting the app removes everything else Risen keeps on your device, such as imported sounds and your weather settings.
3. To remove the iCloud copy without the app, go to Settings → [your name] → iCloud → Manage Storage → Risen on your iPhone or iPad and delete its data.

Deleting Risen or its data does not cancel a subscription; cancel it in your Apple Account settings.

Other requests

For any other request — including deleting analytics or purchase data associated with your installation — email us at admin@navlab.app. We may ask for information to verify your identity. We respond within one month, which may be extended by two further months for complex requests where the law allows it.

12. Children

Risen is not intended for children under 13, and we do not knowingly collect personal data from them. If you are under 18, or under the age of legal majority where you live, you may use Risen only with the permission of a parent or legal guardian. Where local law requires the consent of a parent or guardian for a minor to use online services or for the processing of a minor’s personal data, you may use Risen only with that consent. If you believe that a child under 13 has given us personal data, please contact us and we will delete it.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when we change how Risen works. We will publish the new version on this page and change the “Last updated” date. If the changes are significant, we will notify you in the app or by other appropriate means before they take effect.

14. Language

This Privacy Policy is written in English and may be translated into other languages. If there is any inconsistency between a translation and the English version, the English version prevails, to the extent permitted by applicable law.

15. Contact us

For any question about this Privacy Policy, or to exercise your rights, write to admin@navlab.app. For help with Risen, write to support@getrisen.app.