Privacy Policy

Last updated: October 14th 2026

This policy describes what our apps and this website actually do with your data. Where a previous version of this page said something our software did not do, we have corrected the sentence rather than left it standing.

1. Who we are

The Sunrise is a project operated by Fireflow Creative Collective (“we”, “us”, or “our”), a company based in San Francisco, California, United States. Fireflow Creative Collective is the data controller for the personal data described here.

Contact: info@thesunrise.org
Postal: Fireflow Creative Collective, San Francisco, California, United States

This policy applies to:

• Bird Rise
• Memo Rise
• Moon Rise
• Rise in Grace
• Blurry Birds, on the web and as an iOS app
• Eagle Eye, the zoom photo enhancer for iPhone
• The browser games at thesunrise.org/app/
• Other Sunrise-branded apps
• The website at thesunrise.org, including the pages our apps open inside themselves

Cookies and similar technologies on the website are covered in more detail in our Cookie Policy.

2. The identifier at the centre of this

Most of what follows depends on one thing, so it is worth stating plainly and first.

When you first open one of our apps, the app generates a random identifier for your installation. It is not your name, your email, or your Apple ID. It is a random UUID.

Three things you should know about it:

1. It is stored in the iOS Keychain, not in ordinary app storage. That means it survives deleting the app. If you delete an app and reinstall it later, the same identifier comes back, and your new installation is re-attached to the same records. We do this so that a paying subscriber who reinstalls gets their subscription back without having to do anything. It is a deliberate choice with a real benefit to you, and it also means deleting the app is not a way to make yourself unrecognisable to us.
2. The same identifier is used across our analytics and our subscription provider. It is the Mixpanel distinct ID and the RevenueCat App User ID. Activity from those two sources can therefore be joined together.
3. This makes the data pseudonymous, not anonymous. Under the GDPR, pseudonymous data is still personal data. Earlier versions of this policy described our analytics as “aggregated” data that “does not directly identify you”. That was not accurate, and this section replaces it.

If you want that identifier and its associated records removed, see section 9 and section 10.

3. What we collect

a. Product and usage analytics

Processor: Mixpanel.

We record events describing how the app is used: screens opened, alarms created, edited and dismissed, which bird or sound played, whether a wake-up challenge was completed, onboarding steps, paywall views, and errors. In Eagle Eye these are the answers you give in onboarding (what you like to shoot, where, and whether you have thought about a camera), paywall views, and when your usage runs out. Each event carries the identifier described above, plus standard technical context supplied by the analytics SDK, such as app version, iOS version, device model, locale and approximate region derived from your IP address at the time of collection.

We also store a small number of properties against that identifier, including your App Tracking Transparency choice and which variant of an A/B test you were assigned to.

We do not attach your name or email to these records, because we do not have them unless you email us.

b. Advertising and attribution

Processor: Meta Platforms.

Our apps include the Meta (Facebook) SDK so we can tell whether the ads we buy actually bring people to the app. What it sends depends on your choice in the App Tracking Transparency prompt iOS shows you:

• Before you answer: nothing is sent to Meta. The SDK’s automatic event logging and advertising-identifier collection both start switched off.
• If you allow tracking: app events such as installs, launches, trials and purchases, including the price paid, are sent to Meta together with your device’s advertising identifier (IDFA), which allows Meta to match your activity to an ad you saw.
• If you decline: the same app events are still sent to Meta, but without the advertising identifier, which we do not collect and which Apple returns zeroed in this case. Meta uses events without it to count, in aggregate, how many installs and purchases an ad campaign brought.

You can change this choice at any time in iOS Settings > Privacy & Security > Tracking.

The website carries the Meta Pixel and Google Analytics separately from the apps. Those only run if you accept them in the cookie banner. See section 3f.

c. Purchases and subscriptions

Processors: Apple, RevenueCat.

If you buy a subscription or a one-time unlock, Apple processes the payment. We never see or store your card details, billing address or Apple ID.

RevenueCat receives the purchase and receipt information Apple returns, keyed to the identifier in section 2, so the app knows what you are entitled to and can restore it on a new device. This includes product purchased, purchase and expiry dates, trial and renewal status, cancellations and refunds, price and currency, and country of the store.

d. Support requests

If you use a support or suggestion form on this website, or the in-app links that open it, we receive what you type, your name and email address as you give them, any screenshot you attach, and, from in-app links, your app version, your iOS version and the identifier from section 2 so we can find the relevant records when troubleshooting. Third-party analytics and advertising tags are disabled on those pages.

e. Voice recordings (Memo Rise only)

Memo Rise lets you record your own voice for use as an alarm.

• Recordings are stored locally on your device
• We do not upload them to our servers
• They are not used for analytics, profiling or advertising
• Deleting the recording in the app, or deleting the app, removes them

f. The website

thesunrise.org uses Google Analytics 4 and the Meta Pixel. Neither loads until you accept them in the cookie banner, and neither loads at all on pages opened from inside one of our apps, or on this page, the Terms, the Cookie Policy, the FAQ or the support and suggestion forms.

The browser games at thesunrise.org/app/ work slightly differently, because interrupting a game with a consent bar is not something we are willing to do. They never ask. If you have accepted, they count you normally. If you have declined, they count nothing. If you have not been asked yet, they count the visit in a cookieless mode that stores nothing on your device and cannot recognise you again. The Cookie Policy sets this out in full.

Our hosting provider, Cloudflare, processes your IP address and request metadata as a necessary part of serving the site and protecting it from abuse. Form submissions are checked by Cloudflare Turnstile for spam. Video embeds use YouTube’s no-cookie domain and are only contacted once you click play.

Full detail, including cookie names and lifetimes, is in the Cookie Policy.

g. Permissions our apps ask for

• Alarms and notifications, so an alarm can actually sound. Declining these means alarms will not ring.
• App Tracking Transparency, covered in section 3b.
• Microphone (Memo Rise only), covered in section 3e.
• Camera, Photo Library and Location (Eagle Eye only), covered in section 3h.

h. Photos you enhance (Eagle Eye only)

Processors: Google (Gemini API), Cloudflare.

Eagle Eye sharpens a photo by having an AI image model redraw it. When you enhance a photo, whether from the camera with Eagle Eye on or from your library, this is what happens:

• The photo leaves your phone. It goes to our server, which runs on Cloudflare, and from there to Google’s Gemini API, which returns the enhanced version. The app tells you this before you first use it, and you agree to it before the camera opens.
• It goes without its metadata. Before sending, the app removes the photo’s embedded information, including where and when it was taken and the camera it came from, and sends a smaller copy no larger than the model needs. The enhanced photo gets your original’s metadata back on your phone, not on our server.
• We do not keep it. Our server passes the photo through and keeps nothing once the enhanced version is returned. We do not look at your photos, and we do not use them to train anything.
• Google processes it under its Gemini API terms for paid services, which do not allow Google to use it to improve its products. Google may keep requests for a limited period to detect abuse, as described in its terms.
• A photo you report is the exception. If you tap Report a problem on a result, we keep that photo, the enhanced result and the instructions the model was given, so we can see what went wrong. They are deleted automatically after 90 days.

Photos you take and enhance are saved to your own photo library. The original stays there too, so you can always go back to it.

Permissions. Eagle Eye asks for the Camera, to take the photo; the Photo Library, to show your photos and save the results; and Location, to record where a photo was taken in the photo itself, the way the Camera app does. That location stays in the photo on your phone; as above, it is removed before a photo is sent. You can decline any of them, and the app works with whatever you allow.

Usage. What is left of your Eagle Eye usage is kept by RevenueCat (section 3c), against the identifier in section 2. To give each new iPhone its free usage only once, the app uses Apple’s DeviceCheck, which lets us store two yes-or-no flags against your device with Apple. Apple does not tell us which device it is.

Analytics and advertising. Eagle Eye records events in Mixpanel as section 3a describes, and includes the Meta SDK and the App Tracking Transparency prompt as section 3b describes. Neither receives your photos.

4. What we do not collect

We do not collect your contacts, your precise location, your photo library, your health data, your calendar, or the contents of anything on your device other than what is described above. In Eagle Eye, only the photos you choose to enhance leave your phone, without their location, as section 3h describes. We do not record phone calls. We do not use voice recordings for profiling or advertising. We do not build advertising profiles about you ourselves.

5. Why we use it, and our legal basis

If you are in the European Economic Area or the United Kingdom, the GDPR requires us to name a legal basis for each purpose. These are ours.

Where the basis is legitimate interests, you have the right to object. See section 9.

6. Who we share it with

We do not sell personal data. We do share it with the service providers listed below, each of which processes it on our behalf under its own contract and privacy policy.

We may also disclose data if we are legally required to, or to establish or defend legal claims. If the project or an app is ever sold or transferred, data may transfer with it, and we will say so on this page before it takes effect.

A note for California residents: although we do not sell personal data for money, sending app and website event data to Meta for advertising measurement counts as sharing for cross-context behavioural advertising under the CCPA as amended by the CPRA. See section 11.

7. Where your data goes

We are based in the United States, and Mixpanel, Meta, RevenueCat, Google, Apple and Cloudflare are all US companies. If you are in the EEA, the UK or Switzerland, your data is transferred to the United States.

Those transfers rely on the European Commission’s Standard Contractual Clauses in our agreements with each provider, and, where the provider is certified, on the EU-US Data Privacy Framework and its UK Extension. You can ask us for information about the safeguards in place by writing to info@thesunrise.org.

8. How long we keep it

9. Your rights

Start here, because it is true of most of what our apps know about you: it never leaves your device. Your alarms, your settings, your history, your favourites, and in Memo Rise your recordings, all live on your phone. You can change or delete any of it yourself, whenever you like, without asking us and without waiting for us. In Bird Rise, Erase My Data in Settings clears the lot; section 10 says exactly what it does.

What we hold away from your device is short: your analytics events, and your subscription records. All of it hangs off the one random identifier in section 2, which is also the only way we can find you, since we do not know your name or your email.

If what you want is for it to be gone, you do not need us. Tap Erase My Data in the app. It deletes the identifier, asks our analytics provider to delete the profile held against it, and detaches the install from your purchase records, in one go and without waiting on a reply from anyone. It is faster than emailing us and it is the same outcome.

If you are in the EEA or the UK, you also have the right to ask us for a copy of the data described above, to have it corrected or deleted, and to restrict or object to how we use it. You can withdraw consent at any time: for advertising that is the iOS Tracking setting, and for this website it is the cookie banner. And you can complain to your national data protection authority without going through us first. There is a list at edpb.europa.eu, and in the UK it is the ICO.

The right to receive data in a portable form applies to information you gave us under a contract or by consent. Here that is your subscription record. The analytics events are processed on the legitimate-interests basis in section 5 rather than on consent, so they fall outside that right, though you can still ask for a copy of them under the access right above.

To ask for any of this, email info@thesunrise.org and include the User ID from the bottom of the app’s Settings screen. We are not being awkward: without that ID there is nothing in our records connecting a request to a person, and we would rather tell you so than accept a request we cannot act on. A copy, if you ask for one, is the list of analytics events recorded against that identifier and your subscription record. There is nothing else, because there is nothing else to give.

We are a small team and we do this by hand. We will answer within 30 days, we do not charge for it, and asking changes nothing about how the apps work for you. Where the data sits with one of the providers in section 6 rather than with us, we pass the request on to them.

10. “Erase My Data” in the app

Bird Rise has an Erase My Data button in Settings. It does the following, in this order:

1. Cancels every alarm the app has scheduled with iOS
2. Deletes all app data stored on your device, including alarms, history, favourites and settings
3. Deletes the identifier from section 2 from the Keychain, so a reinstall will not re-attach you
4. Asks our analytics provider to delete the profile held against that identifier
5. Signs the app out of our subscription provider, so the local install is no longer linked to your purchase records

After that, the app is a fresh install and onboarding starts again.

Historical events already recorded against the old random identifier are held under our provider’s retention period in section 8. Once the identifier is deleted they cannot be connected to you or to any future install of the app. If you want those events erased as well rather than left orphaned, ask us under section 9 before you tap the button, while the identifier still exists to search by.

Two consequences worth knowing before you tap it. Your subscription is not cancelled, because only Apple can do that; go to iOS Settings > your name > Subscriptions. And because the identifier is gone, restoring your purchase afterwards requires the Restore Purchases button, which recovers it from your Apple ID.

Deleting the app without using this button leaves the identifier in the Keychain, as explained in section 2.

11. California privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you specific rights.

Categories we collect: identifiers (the app identifier described in section 2, device and advertising identifiers, IP address); commercial information (purchase and subscription history); internet and network activity (app and website usage events); geolocation only at the coarse, region level derived from IP; and, if you contact support, the name, email and content you provide.

We do not sell personal information for money. We do share personal information for cross-context behavioural advertising, specifically app and website event data sent to Meta for advertising measurement. We do not knowingly sell or share the personal information of anyone under 16.

Your rights: to know what we collect and why, to access a copy, to delete, to correct, to opt out of sharing for cross-context behavioural advertising, and not to be discriminated against for exercising any of them. To use the first four, follow section 9. It is the same process and the same inbox, and it needs the same User ID.

To opt out of sharing, do any of the following. Each is a valid Do Not Sell or Share request:

• Decline the App Tracking Transparency prompt in the app, or turn the app off under iOS Settings > Privacy & Security > Tracking
• Decline in the cookie banner on this website, or change your choice from the Cookie settings link in the footer
• Send a Global Privacy Control signal from your browser, which we honour on this website
• Email info@thesunrise.org with “Do Not Sell or Share” in the subject

You may use an authorised agent, in which case we will ask for proof of their authority.

12. Children

Our apps are general-audience products and are not directed to children.

• In the EEA and the UK, we do not knowingly process the data of anyone under 16, or under the lower age set by your country where that applies, which may be as low as 13, without verified parental consent.
• Elsewhere, including the United States, we do not knowingly collect personal information from children under 13.

Our apps carry a 4+ age rating because their content is suitable for all ages, not because they are designed for children. They include advertising measurement and, on iOS, an App Tracking Transparency prompt, which is why we do not consider them appropriate for unsupervised use by a child.

If you believe a child has provided us with personal data, email info@thesunrise.org and we will delete it.

13. Security

The identifier in section 2 is stored in the iOS Keychain. Traffic between our apps, this website and our providers is encrypted in transit. Our providers hold the data under their own security programmes, linked in section 6. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify you and the relevant authority where the law requires it after a breach.

14. Changes to this policy

We may update this policy. The “Last updated” date at the top always reflects the current version. If a change materially affects how we use your data, we will note it on this page, and where the change requires your consent we will ask for it before it takes effect.

15. Contact us

Questions about this policy, or a request under section 9 or section 11:

Email: info@thesunrise.org
Postal: Fireflow Creative Collective, San Francisco, California, United States