UNIFIED PRIVACY GOVERNANCE

Privacy Policy

LAST UPDATED: OCTOBER 2026 • GOVERNING WEBSITE & ALL MOBILE APPLICATIONS

At Circuit & Moss Labs (“we”, “us”, or “our”), privacy is a foundational engineering principle. This Unified Privacy Policy covers both our official website (circuitandmosslabs.com) and all mobile applications developed and published under our developer accounts (including Ripple: Speaker Cleaner, Permissify — Privacy & Permission Auditor, Kiri — Mindful Screen Time, Wake Up Smart Alarm, Morrow — Daily Generative Wallpapers, Defaultify — Android Default Apps Manager, and future software releases).

SCOPE & APPLICABILITY

A Unified Policy for Web & Mobile

By maintaining a single, transparent Privacy Policy across our web domain and mobile store listings, we ensure consistent data protection standards regardless of whether you visit our site or use our iOS / Android applications.

SECTION 01 • MOBILE APPLICATIONS

Mobile Application Data Collection & On-Device Processing

When using our mobile applications (such as Ripple, Permissify, Kiri, Defaultify, Wake Up Smart Alarm, and Morrow — Daily Generative Wallpapers), we handle your data with strict privacy boundaries:

  • Ripple Microphone Use (100% On-Device): In Ripple: Speaker Cleaner (iOS and Android), the microphone is used only while a speaker health check, a Smart Eject tuning sweep, the mic check or the sound meter is running, to measure how your speaker plays. Audio is processed in device memory and discarded immediately; it is never recorded to storage, uploaded or shared. The mic check keeps its short recording (up to 10 seconds) in memory only until you leave that screen. Cleaning works without microphone access.
  • Ripple Local Results & Settings: For each health check Ripple stores only the time, which speaker was measured, seven frequency band levels and the score, plus your calibration baseline, the cleaning frequency Smart Eject found for your speaker, and your settings. This data stays in Ripple’s app storage on your device. Ripple has no accounts, ads, analytics, crash reporting or advertising identifier.
  • Permissify Permission Audit (No Internet Permission): In Permissify — Privacy & Permission Auditor, the list of installed applications, the permissions each one requests and has been granted, and special access settings (such as accessibility, notification access and display over other apps) are read strictly locally via Android PackageManager, QUERY_ALL_PACKAGES and AppOpsManager, solely to show you what your apps can access. If you choose to allow Usage Access, Permissify also reads when you last opened each app (via UsageStatsManager) to find forgotten apps. Permissify declares no internet permission at all, so Android itself prevents it from connecting to any server: your app list, permissions and usage times cannot be uploaded or transmitted.
  • Permissify Tracker-SDK Scan (Pro, 100% On-Device): With Permissify Pro, the app reads the code files of your installed applications on your phone and matches their class names against a list of known advertising and analytics SDKs built into the app. Nothing is fetched or uploaded, and the contents of other apps are never stored beyond the list of SDK names found.
  • Permissify Local History & Update Alerts: Permission snapshots, the change timeline, tracker results and settings are stored 100% locally in Permissify’s private storage and are excluded from device backups. Optional Pro update alerts are produced by a daily check that runs on your device and are shown as local notifications. Permissify has no accounts, ads, analytics, crash reporting or advertising ID.
  • Kiri On-Device Screen Monitoring & Usage Stats (100% On-Device): In Kiri — Mindful Screen Time, system usage statistics access (via Android UsageStatsManager) and active foreground app monitoring run strictly locally on your device to trigger your chosen attention talisman and mist veil when application time budgets are reached. We never inspect, read, scan, record, or transmit your in-app content, typing, messages, or activity inside watched applications. All time calculations and app monitoring operate ephemerally in device memory with zero external telemetry.
  • Kiri Reflections & Local Pebble Storage: The apps you choose to watch, your daily time budgets, time spent, pause history, one-word check-ins, calm days and pebbles are stored 100% locally on your phone and never uploaded. Kiri has no user accounts. Only your Kiri settings (not your usage history) may be included in your own Google device backup, if you have it turned on.
  • Defaultify Package Visibility & Intent Inspection (100% On-Device): In Defaultify (Android Default App Manager), installed application packages and system intent handlers are queried strictly locally via Android PackageManager (utilizing explicit package visibility queries and QUERY_ALL_PACKAGES) solely to audit and display default app handlers and file associations across system roles (browsers, dialers, SMS, launchers, assistants) and 100+ file extensions (PDF, office documents, media, archives, code). We never collect, harvest, upload, or transmit your installed application list or file handler choices to external servers. All analysis executes ephemerally in device memory.
  • Defaultify Deep Link & URI Scheme Inspector: Deep link inspection tests URL intent resolution entirely on-device to determine compatible candidate applications. We do not track, log, or transmit URLs, deep links, or custom URI schemes tested within the application.
  • Defaultify Local JSON Backup & Profiles: Default profile configurations and backups are created and stored 100% locally within private application storage or via the Android Storage Access Framework (SAF). Defaultify operates with zero cloud server integration or remote cloud backups.
  • On-Device Local Storage & Vault: Alarm schedules, puzzle progress, artwork configurations, daily streak checkpoints, coin balances, and custom preferences are stored 100% locally on your device. We do not transmit or store your personal alarms, streak counters, or created artwork parameters on remote servers without explicit user initiation.
  • On-Device Procedural Rendering: In generative media applications (such as Morrow), canvas graphics and mathematical shaders execute in real time directly on your device GPU and ephemeral memory. No generative telemetry or rendered user outputs are transmitted or stored remotely.
  • Device Gallery & Wallpaper Permissions: For media export features (such as saving 4K wallpapers to your device), applications request permissions (e.g., NSPhotoLibraryAddUsageDescription on iOS) solely to write user-selected artworks directly to your device Photos library. We never read, scan, or access your existing photo library.
  • Device Sensors & Motion Data: In alarm applications (Wake Up), motion sensors (accelerometer and step counter) are accessed in real time 100% locally on your device solely to calculate physical wake-up missions (e.g., Shake and Step missions). Sensor data is processed ephemerally and is never recorded, transmitted, or stored on external servers.
  • System Overlays & Exact Alarms: Operating system permissions such as Exact Alarms, Display Over Other Apps (Overlay), and Full-Screen Notifications are requested strictly for application utility—to fire, present, and lock full-screen wake-up missions when an alarm sounds.
  • Spoken Curatorial Essays & Audio Commentary: Morrow streams curated voice commentary and original audio essays accompanying daily drops. Audio playback functions exclusively through device output hardware; the application never records, captures, or accesses your device microphone or voice.
  • Ad Network Identifiers (Google AdMob): Free tiers may serve banner, interstitial, native, or rewarded video ads (such as +10 free coin bonuses). Google AdMob may process device advertising identifiers (such as IDFA on iOS or Advertising ID on Android), general location, and IP address for ad delivery, subject to your tracking consent.
  • In-App Subscriptions & Purchases (RevenueCat): Subscription status (e.g., Morrow Pro, Wake Up Premium, Defaultify Pro Lifetime, Ripple Pro, Kiri Pro and timer packs), purchase receipts, and anonymous customer IDs are processed via RevenueCat and platform billing systems (Apple App Store / Google Play Store). We never collect or store payment credit card information. For Ripple Pro, RevenueCat receives a random anonymous app user ID, the purchase receipt or token and the product, plus basic app and device details (app version, OS version and store country), solely to confirm and restore your purchase; Ripple never identifies you to RevenueCat. Permissify Pro does not use RevenueCat: it is a one-time purchase processed entirely by Google Play Billing, and the app only asks the Play Store app on your device whether Pro is owned.
SECTION 02 • WEBSITE VISITORS

Website Data Collection (circuitandmosslabs.com)

When visiting our website, we collect minimal operational information:

  • Web Contact & Correspondence: If you reach out via our contact email or forms, we receive your email address and message contents to provide support.
  • Server Logs & Technical Security: Standard web server request logs (IP address, browser type, request time) are temporarily maintained for server diagnostics and DDoS defense. We do not track visitors across third-party websites.
SECTION 03

Third-Party Services

Our services integrate specific third-party partners who process data according to their own privacy policies:

Google Play Services & AdMob

Ad network delivery, in-app billing & diagnostics.

Google Privacy Policy →

RevenueCat

Subscription & in-app lifetime license validation.

RevenueCat Privacy Policy →
SECTION 04

Your Privacy Rights & Controls

  • iOS ATT Prompt: Opt out of ad tracking at any time in iOS Settings > Privacy & Security > Tracking.
  • Android Ad ID: Reset or opt out of personalized ads in Android Settings > Privacy > Ads.
  • Ripple Local Data: Delete saved checks in Ripple Settings > Clear check history, forget the tuned frequency in Settings > Reset Smart Eject tuning, or remove everything by uninstalling the app (on Android also Settings > Apps > Ripple > Storage > Clear Data). Microphone access can be turned off at any time in your device’s privacy settings. To have RevenueCat’s anonymous purchase record deleted, email us.
  • Permissify Local Data: Delete the change history in Permissify Settings > Clear change history, or remove everything in Android Settings > Apps > Permissify > Storage > Clear Data or by uninstalling the app. Usage Access can be withdrawn in Settings > Usage access.
  • Defaultify Local Data: Clear all local default app profiles and preferences at any time in Android Settings > Apps > Defaultify > Storage > Clear Data or by uninstalling the app.
  • Photos & Sensor Permissions: Revoke photo saving or motion sensor access at any time in your device system settings.
  • Data Inquiries: Request details or data deletion by emailing us at contact@circuitandmosslabs.com.
SECTION 05

Contact Us

For any questions regarding this Unified Privacy Policy or our data protection practices across web and mobile:

CONTACT@CIRCUITANDMOSSLABS.COM