Privacy Policy

1. Overview & Scope

Double Punch Alarm ("we", "our", or "the App") is an accountability alarm application designed to help families, students, and heavy sleepers wake up reliably through a verified two-stage wake-up protocol. We are deeply committed to protecting your personal information, family privacy, and child data.

This Privacy Policy explains how our Android mobile application and associated web properties collect, process, store, and safeguard your data in compliance with the Google Play Developer Program Policies, the Children's Online Privacy Protection Act (COPPA), and general data protection standards.

2. Information We Collect

We believe in strict data minimization. We only collect the minimal information necessary to deliver accountability features:

• Parent / Account Administrator Information: When a parent or primary user creates an account via Google Sign-In or Firebase Authentication, we store basic profile details (email address, display name, and unique authentication identifier). This information is used solely to maintain family rooms, manage in-app subscriptions, and route remote notifications.
• Child / Sleeper Devices: Child devices connect to a family room exclusively via local QR code scan. We do NOT require or collect children's personal accounts, email addresses, phone numbers, or social media handles.
• Alarm Configuration Data: Alarm schedules, chosen mission types (AI Photo Match, Barcode Scan, Step Counter, Energy Shake, Tongue Twister, Animal Sketch, and The Riddler), Punch 1 cognitive awakening preferences (Math challenges and Trivia quizzes), and grace windows are stored in Cloud Firestore to synchronize wake-up rules between paired family devices.

3. Device Permissions & Usage Rationale

To execute the accountability protocol, Double Punch Alarm requests specific hardware permissions on Android devices:

• Camera (android.permission.CAMERA): Used locally to scan the family pairing QR code and capture morning verification targets (such as a bathroom sink or household barcode). Verification photos are stored securely in your family's private Cloud Storage bucket and are never shared with third parties or used for advertising.
• Microphone / Speech Audio (android.permission.RECORD_AUDIO): Used during the Tongue Twister mission to evaluate pronunciation accuracy, and during The Riddler challenge for spoken answer voice input. Audio is processed transiently and discarded immediately after scoring.
• Physical Activity / Accelerometer (android.permission.ACTIVITY_RECOGNITION): Used locally on the child's device during the 40-Step Pedometer and Energy Shake missions to detect kinetic movement. Sensor readings are processed on-device in real-time and are never logged or tracked outside active missions.
• On-Device Sketch Canvas: Child drawings created during the Animal Sketch mission are rendered locally on the touchscreen and transmitted securely to Gemini AI Vision for artistic evaluation, after which transient data is cleared.
• Alarms & Reminders (USE_EXACT_ALARM, SCHEDULE_EXACT_ALARM, USE_FULL_SCREEN_INTENT): Required to ensure alarms trigger reliably over lock screens, even when the device is in Do-Not-Disturb or silent mode.
• Push Notifications (POST_NOTIFICATIONS): Used to deliver critical breach alerts to the parent's phone when a wake-up mission deadline has passed.

4. Children's Privacy (COPPA Compliance)

We comply fully with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal contact information from children under 13. If you believe that a child has submitted personal details without parental consent, please contact us immediately at support@doublepunchalarm.com and we will expeditiously remove all associated data.

5. Cloud Infrastructure & Gemini AI Processing

Our backend operates on enterprise-grade Google Cloud Platform and Firebase infrastructure:

• Dual-Layer Dead-Man's Watchdog & Cross-Device Sync: Double Punch Alarm enforces accountability through two synchronized fail-safe layers:
  • Local Parent Watchdog Alarm: When an alarm is saved or synced, an exact native watchdog alarm is scheduled on the parent's phone (via Android AlarmManager) for the child's wake-up time plus grace period buffer. Even if the child powers off their phone or loses network connectivity completely, the parent's local alarm sounds automatically at the deadline.
  • Server-Side Watchdog (Google Cloud Tasks): When the child enters the Punch 2 countdown window, a server-side Cloud Task is enqueued for the exact deadline. If verified mission completion is not registered before expiry, the server dispatches a high-priority Firebase Cloud Message (FCM) to trigger the parent's emergency breach siren.
• Gemini AI Vision & Semantic Processing:
  • Photo Match: Compares morning photos to parent reference images semantically, adapting to morning lighting and angles.
  • Animal Sketch: Evaluates hand-drawn sketches for recognizable anatomical features (ears, manes, trunks) to verify cognitive alertness.
  • The Riddler: Understands synonyms, conversational answers, and semantic nuances when evaluating riddle answers.
  • Trivia Quizzes: Generates and validates questions across History, Civics, and General Knowledge.
• Zero Training Data Retention: All verification media and AI prompts are processed transiently and are never used to train public artificial intelligence models.

6. In-App Subscriptions & Payment Processing

Double Punch Alarm offers 10 free trial wake-up credits upon download. Ongoing unlimited family usage is monetized via a $5.00/month recurring Google Play In-App Subscription.

All payment transactions, billing, renewals, and cancellations are handled directly by Google Play Store Billing. We never receive, process, or store your credit card numbers, bank account numbers, or billing addresses.

7. Data Retention & Account Deletion

You maintain full control over your family's data. You may at any time:

• Disconnect sleeper devices or reset family QR codes from the Parent Command Center.
• Request immediate deletion of your family room, authentication credentials, and stored reference photos by emailing support@doublepunchalarm.com with the subject "Data Erasure Request".
• Upon receipt of a deletion request, all corresponding records in Cloud Firestore and Cloud Storage are permanently purged within 7 business days.

8. Security & Cryptographic Standards

All data transmitted between mobile devices and Google Cloud services is encrypted in transit using industry-standard TLS 1.3 / HTTPS. Firestore databases are protected by fine-grained security rules ensuring only authenticated family members can view their respective session data.

9. Contact & Support

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our team: