MorningHello Privacy Policy

1. Who Is Responsible for Processing Personal Data

The controller of personal data processed by MorningHello is:

Oxana Krylova, a sole proprietor registered in Israel (עוסק פטור)

Official registered name: אוקסנה קרילובה
Identification number: 342837382
Address: 5 Shai Agnon Street, Apartment 73, Netanya, Israel
Email: krylov.oxana@gmail.com
Phone: +972 53-708-4224

In this Privacy Policy, the terms “MorningHello,” “we,” “us,” and “our” refer to the data controller identified above.

2. Core Principles

MorningHello processes only the data necessary to set up the App, personalize postcards, record “I’m Alive” or “I’m OK” check-ins, operate the alert process, send invitations to Emergency Contacts, and provide user support.

MorningHello does not sell personal data, use it for behavioral advertising, or track Users across apps and websites operated by other companies.

MorningHello is not an emergency, medical, or rescue service. A User’s check-in does not confirm their location, health, or safety.

3. Data Stored Only on the iPhone

The following data is stored locally using iOS technologies, including AppStorage, UserDefaults, and, depending on the implementation, Keychain:

• the number of the accepted version of the Terms of Use and information about completion of onboarding;

• the User’s name, form of address, day and month of birth;

• selected holiday categories and religious preferences;

• the selected check-in interval of 24, 48, or 72 hours;

• the local date of the most recent check-in;

• details of one or two Emergency Contacts and their locally stored statuses;

• the technical installation identifier, appInstanceId;

• local notification settings.

The day and month of birth and selected holiday categories are used to display personalized and holiday postcards on the device. Under the current architecture, they are not included in the heartbeat request and are not transmitted to the MorningHello Backend.

A personal message added to a postcard is limited to 50 characters. It is entered separately for each postcard, is not saved in the User’s profile, is not transmitted to the MorningHello server, and is cleared before the next postcard is opened. When the postcard is shared, the message is rendered directly into the final image.

Deleting the App generally removes the App’s locally stored data in accordance with iOS rules. Data previously transmitted to the Backend is not automatically deleted when the App is removed.

4. Data Transmitted to the MorningHello Backend

After the User taps “I’m Alive” or “I’m OK,” or after Emergency Contacts or the check-in interval are changed, the App may transmit a complete and current heartbeat request to the server. It includes:

• appInstanceId, a randomly generated UUID temporarily used instead of an account;

• the User’s display name;

• the value male or female, generated from the selected form of address;

• the selected interval of 24, 48, or 72 hours;

• the date and time of the most recent check-in;

• the device time zone;

• the complete current list of Emergency Contacts.

For each Emergency Contact, the App may transmit a stable contact UUID, first name, last name, phone number, email address, and consent status. The email address is required to send the invitation and alert email. The phone number may be stored for functionality planned as part of the App’s future development, but in the current version the Backend does not use it to send automated SMS messages.

Registration, login credentials, and passwords are not required. appInstanceId is not an advertising identifier and is not used for tracking, but it technically links server records to a specific installation of the App.

5. How and Why We Use Data

We use data for the following purposes:

• completing onboarding and saving App settings;

• personalizing the interface, postcards, and greetings on the device;

• recording the most recent check-in successfully transmitted to the server;

• calculating the period selected by the User during which no new check-in has been received;

• synchronizing the current list of Emergency Contacts;

• sending an invitation asking a contact to consent to becoming an Emergency Contact;

• sending an alert email only to a confirmed Emergency Contact after the selected interval expires;

• maintaining the statuses Pending, Confirmed, Declined, and Revoked;

• preventing errors and misuse and ensuring the security and availability of the service;

• responding to inquiries that the User voluntarily sends to the developer.

6. Legal Bases for Processing

Depending on the User’s country, MorningHello relies on one or more of the following legal bases:

• performance of an agreement with the User and provision of the requested App functions;

• explicit consent where required, including iOS permission for local notifications;

• our legitimate interests in operating, securing, supporting, and improving MorningHello, while respecting the rights and interests of individuals;

• the Emergency Contact’s consent to receive alert emails;

• compliance with obligations imposed by applicable law.

For residents of the European Economic Area, the United Kingdom, and other jurisdictions with similar rules, the relevant legal bases under local law apply. Where processing is based on consent, consent may be withdrawn for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Emergency Contacts and Their Consent

The User manually adds at least one Emergency Contact. A second contact is recommended but is not required. MorningHello supports no more than two Emergency Contacts.

MorningHello receives an Emergency Contact’s details from the User, not directly from the contact. After a new contact is added, the Backend is intended to send an email invitation asking the person to consent to becoming an Emergency Contact. Until consent is confirmed, the contact has Pending status and must not receive alert notifications.

After responding, the contact may have one of the following statuses:

• Confirmed: consent has been provided and alert emails are permitted;

• Declined: the invitation has been declined;

• Revoked: consent previously provided has been withdrawn.

Changing the contact’s email address returns the status to Pending and requires new confirmation. Changing the contact’s first name, last name, phone number, or form of address does not by itself require a new invitation.

An Emergency Contact may decline the invitation or withdraw consent using the method specified in the invitation or email, or by contacting krylov.oxana@gmail.com. After consent is withdrawn, future alert emails to that contact will stop, except for messages necessary to confirm completion of the request or comply with legal requirements.

8. Local Reminder and Server-Generated Alert Email

These are two separate mechanisms.

A local reminder is created using iOS and is displayed only to the User on their iPhone. It requires system permission for notifications. The MorningHello Backend does not use local notifications to communicate with Emergency Contacts.

A server-generated alert email is created by the Backend if 24, 48, or 72 hours, as selected by the User, have passed since the server successfully received the most recent check-in. An alert email may be sent only to a contact with Confirmed status.

The current channel for automated alert notifications is email sent through Amazon Simple Email Service, or Amazon SES. Automated SMS delivery is not an active feature in the current version.

A network error may result in a postcard opening on the device even though the Backend has not received a new check-in. MorningHello does not guarantee the delivery of every invitation, reminder, or alert email.

9. Postcards, the System Share Menu, and Third-Party Apps

Postcards and the User’s personal message are combined on the device into a single image. When the postcard is shared, MorningHello provides the selected app only with the finished image, not separate profile fields or the text of the personal message.

The User initiates sharing and selects iMessage or another compatible app from the iPhone system share menu, such as WhatsApp, Telegram, Signal, Viber, Mail, or AirDrop. Once an app is selected, that service’s privacy policy and terms apply. MorningHello does not control how the recipient or third-party app subsequently processes the image.

10. Feedback and Support Requests

The App allows the User to prepare a message to the developer through the system Mail or Messages app. The text can be edited, sent, or canceled. MorningHello does not receive the message unless the User personally confirms that it should be sent.

If the User sends an email or message, we receive the contact details they provide, the content of the inquiry, and any technical information they choose to include. We use this information to respond, provide support, correct errors, and review suggestions.

11. Recipients of Data and Service Providers

Personal data may be processed by the following categories of recipients:

• Amazon Web Services, or AWS: hosting of the Backend, PostgreSQL database, and related infrastructure;

• Amazon SES: delivery of invitations and alert emails;

• Let’s Encrypt: provision of the HTTPS certificate through the server proxy, without using profile content for its own purposes;

• network and technical infrastructure providers, to the extent necessary to transmit data and protect the service;

• public authorities or other parties where disclosure is required by law or necessary to protect rights and safety.

MorningHello does not disclose an Emergency Contact’s phone number to an SMS provider for automated notifications unless and until that function is implemented and described in an updated Privacy Policy.

12. Where Data Is Processed and International Transfers

The primary Production Backend and database are hosted by Amazon Web Services in the il-central-1 region in Israel. Data is transmitted between the App and the server over HTTPS.

For the operation of Amazon SES, network infrastructure, and subprocessors, certain technical operations may take place in other countries. In such cases, MorningHello uses contractual and other safeguards required by applicable law and the service providers’ terms.

For automated transfers of personal data from the European Union, Israel is recognized by the European Commission as providing an adequate level of data protection within the scope of the relevant adequacy decision. Where a specific onward transfer requires additional safeguards, Standard Contractual Clauses or another permitted transfer mechanism may be used.

13. Data Retention

Local data remains on the device until the User changes or deletes it or removes the App, subject to iOS operation and backup practices.

The Backend retains current data needed to operate the alert process for as long as the User uses the function, the data is required for the stated purposes, or a valid deletion request is received. Records of triggered alerts and Emergency Contact consent may be retained for as long as necessary to operate the service, resolve disputes, protect security, and comply with legal requirements.

Under the current technical architecture, exact automatic deletion periods have not been established for all categories of server records. MorningHello does not claim a retention period that has not been implemented. Until an automated retention policy is introduced, a deletion request may be submitted by email.

If the App sends the Backend an empty emergencyContacts array, the contact list previously stored on the server for that installation is deleted. This action does not necessarily delete appInstanceId, the most recent check-in, alert history, or other server records.

14. Data Deletion

The User can edit, replace, and delete Emergency Contacts in the App. Following the next successful full synchronization, the contact list stored on the server is replaced with the current list from the device.

Deleting the App from the iPhone does not by itself guarantee deletion of data previously transmitted to the server. Under the current architecture, a self-service function for the complete deletion of all server records has not been confirmed as operational.

To request access to, correction of, or complete deletion of server data, email krylov.oxana@gmail.com with the subject line “MorningHello Personal Data.” To locate the relevant record, we may need appInstanceId or other information reasonably linking the request to a specific installation. Do not publish appInstanceId. Provide it only through an agreed secure channel.

Before deleting data, we may ask the requester to verify their connection to the relevant installation or email address. Certain information may be retained where required by law, necessary for security or the establishment, exercise, or defense of legal claims, or needed to document the withdrawal of consent.

15. Security

MorningHello uses organizational and technical measures designed to protect data. The Production API uses HTTPS, the former unencrypted external address is no longer used, and the database is hosted in managed AWS infrastructure.

Under the current architecture, there is no login, password, bearer token, or full authorization system. appInstanceId is transmitted in the request URL and effectively serves as the access secret for an installation record. A person who obtains appInstanceId could potentially attempt to access data associated with that installation. Users should therefore not publish, forward, or show this identifier to unauthorized persons.

No method of transmission or storage can provide absolute security. If you suspect a security incident, contact us at krylov.oxana@gmail.com.

16. Analytics, Advertising, and Technical Logs

The current version of the App does not use advertising networks, Meta Pixel, third-party advertising identifiers, or cross-service tracking tools. MorningHello does not use App data for targeted advertising.

MorningHello does not create a User profile based on an IP address. During ordinary network operations, an IP address and other technical metadata may be processed temporarily by internet service providers, AWS, Caddy, and other infrastructure systems for routing, security, and diagnostic purposes. The App’s debug output is intended for development and is not user analytics.

If analytics, advertising, or a new type of server logging is introduced in the future, this Privacy Policy and the App Privacy information in App Store Connect will be updated before the relevant processing begins, and consent will be requested where required by law.

17. Children’s Data

Independent use of MorningHello is permitted for persons over the age of 16. A younger person may use the App only with the consent of a parent or legal guardian.

MorningHello does not knowingly collect children’s data for advertising and is not intended for covert monitoring of a child. If you believe that a minor’s data has been submitted without appropriate authorization, contact us at krylov.oxana@gmail.com.

18. Rights of Users and Emergency Contacts

Depending on applicable law, an individual may have the right to:

• receive information about processing and access their personal data;

• request correction of inaccurate or incomplete data;

• request deletion of data;

• restrict or object to processing;

• withdraw consent for future processing;

• receive data in a portable format where this right applies;

• lodge a complaint with the competent data protection authority.

Requests should be sent to krylov.oxana@gmail.com. We may request reasonable verification of identity or connection to the data and will respond within the period required by applicable law.

In Israel, an individual may contact the Privacy Protection Authority. A resident of the European Economic Area may also contact the data protection authority in the place of their residence, workplace, or the alleged infringement.

19. Changes to This Privacy Policy

MorningHello may update this Privacy Policy when its features, Backend, service providers, storage practices, or applicable laws change. The current version will be published on the official website with a new effective date and version number.

If a change materially affects data processing or Users’ rights, MorningHello will also notify Users in the App and, where necessary, request new consent before they continue using the relevant functions.

20. Contact Information

For privacy questions, to exercise your rights, or to report an incident, contact us at:

Email: krylov.oxana@gmail.com
Phone: +972 53-708-4224
Postal address: 5 Shai Agnon Street, Apartment 73, Netanya, Israel

Recommended email subject line: “MorningHello Personal Data.