Privacy policy

Last updated: 21 October 2026

Morning Guard (“we”, “the app”) is an Android application (com.morningguard.app) that helps you complete a morning goal before other apps’ notifications appear in your status bar. This policy describes what information the app processes, where it stays, and what optional cloud services you can use.

By using Morning Guard you agree to this policy. If you do not agree, uninstall the app and delete any account you created for cloud sync.

Summary

• Notification access is core to the app. We read app name, title, and text for notifications we hold, store them on your device, and show them in an in-app digest. We do not upload notification bodies to our servers.
• Sign-in and cloud sync are optional. You can use local-only storage without an account.
• Health Connect step counts are read on-device only when you choose a step goal.
• Crash and error reports may be sent to Sentry when enabled in your build, without notification text or highlight notes.

Information we process

Notifications (Notification Listener access)

When you grant Notification access, Morning Guard can read metadata and content from notifications posted by other apps. For notifications we hold during your morning gate, we process:

• Posting app (package name and display name)
• Notification title and text (and related fields needed to show a digest entry)
• Timestamps and identifiers needed to manage the digest

This data is stored locally in the app database on your phone. It is used to build the digest after your goal and to enforce your morning gate. We do not sync raw notification text to Supabase or other backends.

Alarms and apps you explicitly allow (including default exceptions such as phone calls and messaging apps per app policy) are not held the same way. You must confirm an in-app disclosure before opening system notification access settings.

Installed applications (bypass list)

To let you choose apps that may bypass the morning gate, the app reads the list of installed packages and labels on your device. This list is used locally for the bypass picker and is not uploaded as an inventory to our servers.

Health and fitness (Health Connect)

If you set a step-based morning goal, Morning Guard reads step count data through Health Connect (or related platform APIs on older Android versions where applicable). Step data is aggregated on-device to verify goal completion and is not uploaded for cloud sync.

Account and email (optional)

If you choose cloud sync, you sign in with a magic link sent to your email address. Authentication is handled by Supabase Auth (hosted Postgres and GoTrue). Your email is stored in Supabase as part of your auth user record. We use it only to authenticate you and operate sync.

Bible reading, highlights, and notes (optional cloud sync)

Passages may be fetched from public Bible APIs and/or our Bible proxy service to display text in the app. If you create highlights or notes:

• In local-only mode, highlights and notes stay on your device.
• In cloud sync mode, highlight metadata and notes may be stored in Supabase Postgres under row-level security tied to your user id. Notes may be encrypted on-device before upload when you enable note encryption in Settings.

Settings, streaks, and gate history

Morning window times, goal preferences, bypass packages, and completion history are stored locally. Selected settings and streak-related data may sync to Supabase when you are signed in and not in local-only mode.

Emergency bypass passphrase

If you configure an emergency bypass, only a salted cryptographic hash of your passphrase is stored on-device. The passphrase itself is not uploaded.

Diagnostics (Sentry)

Production builds may include the Sentry SDK. When a DSN is configured at build time, the app may send crash reports, non-fatal errors (for example sync failures), and technical breadcrumbs to Sentry. We configure monitoring to avoid logging notification content, email addresses, or highlight note text. See Sentry’s privacy policy.

Local encrypted backup (optional)

You may export an encrypted backup file that you control. That file can include settings and other data you select; it is protected by a password you choose and is not uploaded by the app unless you manually share it.

How we use information

• Operate the morning gate, digest, alarms, and goals you configure
• Optional authentication and sync of highlights and stats you opt into
• Improve stability and fix bugs via crash reporting when enabled
• Comply with law and protect users where required

We do not sell your personal information.

Legal bases (EEA/UK users)

Where GDPR applies, we rely on performance of a contract (providing the app), consent (notification access, Health Connect, optional sign-in), and legitimate interests (security and crash diagnostics), balanced against your rights.

Third-party services

• Supabase — authentication and optional cloud database sync. Supabase privacy.
• Sentry — optional crash and error monitoring. Sentry privacy.
• Bible content providers — scripture text requests (API Bible, bible-api.com, or our Cloudflare Worker proxy). Requests include passage references, not your notification data.
• Google Play — distribution; subject to Google’s policies when you install or update via Play.

Retention

• Notification digest entries remain on-device until you dismiss them or clear app data.
• Cloud data remains until you delete your account or we delete inactive accounts per backend policy.
• Sentry retains events per our Sentry project settings.

Security

Cloud traffic uses HTTPS. Supabase rows are protected with row-level security. Sensitive note fields may use client-side encryption before sync. No mobile app can guarantee security against a compromised or rooted device; use a device passcode and keep Android updated.

Your choices and rights

• Local-only mode — avoid sign-in; data stays on your phone (Settings / onboarding).
• Revoke access — disable Notification access or Health Connect permissions in Android settings at any time.
• Delete account — Morning Guard → Account → Delete account (removes the auth user and clears local session data tied to sync).
• Export — use encrypted local backup where available in Settings.
• Contact us — for access, correction, or deletion requests where applicable, email kenneth@codingagents.cc.

Children

Morning Guard is not directed at children under 13 (or the minimum age in your country). We do not knowingly collect personal information from children.

International transfers

Supabase and Sentry may process data in the United States or other regions where their infrastructure runs. Transfers rely on appropriate safeguards offered by those providers.

Changes

We may update this policy. We will post the new date at the top of this page. Material changes may also be reflected in the app or Play listing before they take effect.

Contact

Questions about this policy: kenneth@codingagents.cc

Back to home