MonkeyRiot Privacy Policy
Effective date: November 3, 2026
MonkeyRiot is an Android alarm clock app with optional family and group features. It is made by MonkeyRiot (Dan Tollett, sole proprietor), referred to here as "we" or "us." This policy explains what information the app uses, where it goes, and how you can delete it.
Questions? Email monkeyriot.alarms@gmail.com.
The short version
- Alarms you keep to yourself stay on your phone. You don't need an account to use MonkeyRiot as a normal alarm clock.
- Family and Groups features are optional. They need you to sign in with Google. Then your name, the alarms you share, and voice messages you send are stored with Google Firebase, so the people you link with can receive them.
- No ads, no analytics, no crash-reporting tools, and we don't sell your data.
- You can unlink, leave groups, and delete what you've shared. To delete everything MonkeyRiot stores online about you, tap Delete my MonkeyRiot data in the app (Settings › Family), or email us. See Deleting your data.
1. Using MonkeyRiot without signing in
When you use MonkeyRiot only as an alarm clock, this information is stored only on your phone:
- Your alarms: time, repeat days or date, label, tone, snooze, vibration and similar settings.
- Your app settings, such as time format, low-battery warning level and bell volume.
- Custom tones: sounds you record with the microphone, or audio files you choose from your phone. MonkeyRiot keeps its own copy inside the app.
- That you tapped "I agree" to our terms (and which version), and, if you start Google sign-in, your age group from the age screen (under 13, 13–17 or 18+), not your birth date. These stay on your phone and are not sent to us.
- Where the law requires it (such as in Texas), the app asks Google Play for your age range and whether a parent approved MonkeyRiot. We use the answer only on your phone to decide whether Family and Groups are available, and we don't keep it or send it to us.
We can't see any of this. It is deleted when you uninstall the app or clear its data.
Android backup: MonkeyRiot allows Android's built-in backup. If backup is on in your phone's settings, Android may save a copy of the app's data to your Google account and may copy it to a new phone during setup. That copy can include your alarms, settings and custom tones and, if you're signed in, information the app has saved about people you're linked with. Google handles this backup under your Google account settings; we can't access it. You can turn backup off in Android settings.
2. Signing in with Google (Family and Groups)
Signing in is needed only for the Family features (linking with another person to send alarms to each other or see each other's alarms) and Groups (one organizer shares an alarm or bell schedule with many members).
When you sign in, Google and Firebase Authentication give the app:
- your Google account name and email address,
- a user ID that Firebase creates for you,
- your profile picture link, if your Google account has one. Firebase receives this, but MonkeyRiot doesn't use or show it.
MonkeyRiot shows your name to people you link with or share a group with. If your Google account has no name, it uses your email address as your name instead.
3. What is stored online, and who can see it
When you're signed in, the app stores the items below in Google Cloud Firestore, part of Google Firebase. Security rules on the database limit who can read each item.
| What | Details | Who can see it |
|---|---|---|
| Your profile | Name and your phone's time zone | You, and people you're linked with |
| Your phones | A push-notification token, time zone, app version, phone maker and model, and a random ID for that app install (not a hardware ID) | Only you (and our server, to deliver pushes) |
| Family invites | Your name, the permissions you're offering, and the name of the person who accepts. Invite codes expire after 10 minutes. | Anyone who has the exact code |
| Family links | Both people's names and user IDs, and the permissions each person gave ("can set alarms on my phone", "can see my alarms") | The two linked people |
| Alarms you send to someone | Time, days or date, label (up to 60 characters), tone and alarm settings, whether it's locked, both names, and its status (for example rang, snoozed or dismissed) with the time and the phone's install ID. A short history of those status reports is kept with the alarm. | The sender and the recipient |
| Voice messages | A recording of up to 15 seconds that you attach to an alarm you send | The sender and the recipient |
| Your alarm list (only if you allow it) | A summary of your alarms (times, days, labels, on or off, snooze, who set it, locked) and your time zone. It is published only while at least one linked person has "can see my alarms", and removed when nobody does. | You, and linked people you allowed |
| Groups | Group name, organizer's name, time zone, and the group's alarm or bell schedule (up to 40 items) | The organizer and the group's members |
| Group members | Each member's name, app version, whether they muted the group, when their phone last synced, the invite code they used, and when they joined | The organizer, and each member can see their own entry |
| Group invites | Group name, organizer's name. Codes last up to 32 days unless the organizer revokes them. | Anyone who has the exact code |
| Your group list | The names of groups you're in, so a new phone can find them | Only you |
We can see it too. As the app's developer, we can view the data stored in Firestore through the Firebase console. We look at it only when we need to run, fix or protect the app, to answer a request from you, or when the law requires it.
Microphone: MonkeyRiot uses the microphone only while you are recording a custom tone or a voice message, after you tap record. Custom tones stay on your phone. Voice messages are uploaded only when you send them with a family alarm.
4. Push notifications and our push server
To make a shared alarm arrive quickly, MonkeyRiot uses Firebase Cloud Messaging (Google's push service) and a small server we run on Cloudflare Workers.
- Your phone gets a push token from Firebase Cloud Messaging and saves it to your account (see "Your phones" above). If you join a group, your phone also subscribes to that group's push channel.
- When you send, change or answer an alarm, the app sends our server your sign-in token and the alarm or group ID. The server checks your sign-in and your permissions, reads the alarm from the database, and asks Firebase to deliver a push.
- A family alarm push contains the alarm's time, days, label and the sender's name, or the recipient's name and the alarm status. A group push only says "the schedule changed, sync now."
- Our server doesn't store your alarms, messages or profile. It keeps a short-lived counter per user, in memory only, to stop more than about 30 requests a minute.
- Cloudflare keeps a short request log. For each request to our server, Cloudflare's standard logging records technical details such as the time, the web address requested, the result, your IP address and the approximate location Cloudflare works out from it (such as country and city), and any error messages. These logs are kept for up to 3 days and then deleted automatically. We use them only to find and fix problems and to stop abuse.
- If a push token stops working, the server deletes it from your account.
- Like any internet service, Cloudflare and Google receive your phone's IP address and basic technical details when your phone connects to them.
5. What we don't do
- No advertising and no ad IDs.
- No analytics or crash-reporting tools are built into MonkeyRiot.
- No location tracking. The app stores your phone's time zone, not your location. Cloudflare's short-term logs (above) include an approximate location worked out from your IP address.
- No access to your contacts. People are linked by invite code or QR code.
- No camera access by MonkeyRiot. QR codes are scanned with Google's code scanner, which returns only the code to the app.
- We don't sell or rent your information. We share it only with the people you choose to share with in the app (people you link with or share a group with), with the service providers below, when the law requires it, or, if MonkeyRiot is ever sold or transferred, with the new owner, who would have to keep following this policy for the data it receives.
6. Service providers
- Google Firebase (Authentication, Cloud Firestore, Cloud Messaging) stores your account and shared data and delivers pushes. Firebase privacy information
- Google Play and Google Play services handle app downloads, any purchases, Google sign-in and QR code scanning. Google Privacy Policy
- Cloudflare runs our push server. Cloudflare Privacy Policy
These companies process data under their own privacy policies. Google's software libraries in the app may also send Google limited technical information they need to work.
7. Permissions the app asks for
| Permission | Why |
|---|---|
| Alarms and reminders (exact alarms) | So alarms ring at the exact minute |
| Notifications, full-screen alerts, and display over other apps | To show the ringing alarm, including on the lock screen |
| Microphone | Only when you record a tone or voice message |
| Run at startup | To set your alarms again after the phone restarts or the time zone changes |
| Keep awake, vibrate, foreground service | To keep the alarm ringing and vibrating until you stop it |
| Internet | For Family, Groups and pushes |
| Set alarm | Lets Google Assistant and other apps on your phone set or dismiss MonkeyRiot alarms when you ask them to |
You can turn permissions off in Android settings. Some features may stop working if you do.
8. How long we keep information
- On your phone: until you delete it, clear the app's data, or uninstall.
- Online: until it's deleted, by you in the app or by us when you ask. Specifically:
- Signing out removes your current phone's push token from your account.
- Unlinking from someone deletes the link and the alarms and voice messages you set for each other.
- Cancelling or clearing a sent alarm deletes its voice message, and clearing it deletes the alarm and its status history.
- Leaving a group removes your member entry. When an organizer deletes a group, it's removed for everyone.
- Your profile, other phones' push tokens and used or expired invites can stay in the database until you delete your MonkeyRiot data.
- Cloudflare request logs are deleted automatically after up to 3 days.
Deleting your data
In the app: you can unlink people, leave or delete groups, delete or cancel alarms you sent, and sign out. To delete everything at once, open Settings › Family and tap Delete my MonkeyRiot data (next to Sign out). This deletes, right away:
- your profile and your phones' push tokens,
- your family invites and family links (on both sides),
- alarms you sent and alarms sent to you, with their status history and voice messages,
- your shared alarm list,
- your group memberships, and any groups you organize, with their members and invites,
- your MonkeyRiot sign-in record in Firebase.
If something can't be deleted (for example, no connection), the app tells you, and you can try again or email us.
It does not delete your Google account, and it doesn't touch the alarms saved on your phone. You may be asked to sign in with Google again to confirm it's you.
Without the app: email monkeyriot.alarms@gmail.com from the Google account you used with MonkeyRiot, with the subject "Delete my MonkeyRiot data." If we can't match the request to an account, we may ask you to confirm it's you before deleting anything. We will delete the same data listed above within 30 days and confirm by email.
What stays: copies already delivered to other people's phones, such as alarms you set for them, stay on their phones until they remove them. Alarms saved on your own phone stay until you delete them or uninstall the app. An Android backup in your Google account is controlled by your Google settings. Cloudflare request logs expire within 3 days, and Google may take a short time to clear deleted data from its systems.
9. Children
MonkeyRiot is not directed at children under 13. Anyone can use the alarm clock without signing in, but Family and Groups are only for people 13 and older. Before you can sign in with Google for Family or Groups, the app asks your age, and it blocks sign-in for anyone under 13. Teens aged 13 to 17 may sign in only with a parent's or guardian's permission. A parent can still use MonkeyRiot as a plain alarm clock on a child's phone without signing in, in which case nothing about the child is sent to us. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has signed in to MonkeyRiot, email us and we will delete that account's data. If you were already signed in before this version, the app asks your age the next time you open it. If you're under 13, it deletes your MonkeyRiot data and signs you out.
10. Security
Data is sent over encrypted connections (HTTPS). Database rules restrict each item to the people listed above, and our server checks your sign-in before every push. No system is perfectly secure, though, so please share alarms only with people you trust.
11. Where data is stored
Our Firestore database is located in Seoul, South Korea. Cloudflare handles requests to our server at its data centers around the world, usually the one closest to you. Google and Cloudflare may also process data in the United States and other countries where they operate.
12. Your choices and rights
You can view and change most of your information in the app, and delete it with Delete my MonkeyRiot data (see Deleting your data). You can also ask us for a copy of your data, or ask us to correct or delete it, by emailing monkeyriot.alarms@gmail.com. We'll answer within 30 days, and we may ask you to confirm it's you first. Depending on where you live, you may have more rights under local law, and we will honor them.
Do Not Track: MonkeyRiot doesn't track you across other apps or websites, so it doesn't change how it works when it receives a "Do Not Track" signal.
13. Changes to this policy
If we change this policy, we'll update the effective date above. For important changes, we'll tell you in the app before they take effect and give any notice to app stores the law requires.
14. Contact
MonkeyRiot (Dan Tollett, sole proprietor)
Email: monkeyriot.alarms@gmail.com