Privacy Policy
Short version: Hugo needs no account. Your alarms, your routine, your streak and everything you enter in the app stay on your iPhone. Two things reach us: a fixed list of anonymous usage events, and crash reports when the app fails. Both hang off a random installation ID — no name, no email address, no account. This website sets no cookies. The rest of this page explains that in the detail the GDPR (Art. 13) asks for. The German version is the legally binding one.
1. Controller
Jan Lennard Klein
Am Mergelgarten 4
61440 Oberursel
Germany
Email: hello@hugoalarm.com
Phone: +49 151 10690937
2. The Hugo app
2.1 Data on your device
Hugo stores your alarms, missions, morning routine, streak and lifetime total of mornings locally on your device only. There is no sign-up, no account and no server of ours holding this data. Delete the app and it is deleted. An iCloud backup of your device may include it; Apple's privacy policy applies to that.
2.2 Permissions
- Alarms and notifications. Hugo asks for permission to schedule alarms (on iOS 26.1 and later via Apple's AlarmKit) or to send notifications. Alarm times are managed by the system on the device.
- Camera. Only for the “object hunt” and “push-ups” missions. The camera image is analysed on the device only, never stored, never transmitted and never sent to any of the services named below. If you don't use those missions, the camera is never accessed.
2.3 The installation ID
Because there is no account, Hugo generates a random number (a UUID) on first launch and keeps it in your device's keychain. It is the only identifier the services below ever see. It says nothing about you, it is not synced to other devices, it is never shared with ad networks, and it is neither Apple's advertising identifier (IDFA) nor the vendor identifier (IDFV) — Hugo never asks for either and does no tracking in the sense of Apple's App Tracking Transparency.
It survives a reinstall, deliberately, so a restored subscription lines up with its own history instead of counting as a new install. If you'd rather it didn't, see 2.9.
2.4 Usage events (PostHog)
So we can see whether the app does what it exists for — is an alarm set, does it ring, is the mission cleared, does the morning finish — Hugo sends a fixed list, exhaustively enumerated in the code, of events: alarm_set, alarm_fired, mission_done, routine_done, morning_counted, onboarding_completed, paywall_seen, trial_started, purchase, review_prompt and feedback_sent. Alongside them the SDK sends install, launch and background events and the technical fields every app request carries: app version, iOS version, device model, language and time zone. What travels is the name of the event, not its content.
What is not sent: your alarm times, the names of your routine tasks, your streak, camera images, screen recordings (session replay is switched off in the code) and a log of the screens you visit (screen tracking is off). No person profile is created for anonymous installs.
One exception we name explicitly: if you use the feedback box in Settings, the text you write rides along as a property of the feedback_sent event. Whatever you put in there is transmitted — so don't put anything in there you don't want to send.
The processor is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA, acting under Art. 28 GDPR. Hugo sends to PostHog's EU Cloud (eu.i.posthog.com, servers in Frankfurt, Germany), so the data is stored and processed in the European Union. Where support access from the US occurs, it relies on standard contractual clauses. See PostHog's privacy policy.
Legal basis: our legitimate interest in knowing whether the app works and where it loses people (Art. 6 (1) (f) GDPR). Retention: events are deleted after twelve months. Your right to object is in 2.9 and section 5.
2.5 Crash reports (Sentry)
If Hugo crashes or hits an error, a report goes to Sentry: the place in the code (stack trace), device model, iOS version, app version and the last steps taken in the app before the failure. The installation ID from 2.3 is attached so two crashes from the same install read as one. Not sent: screenshots, your IP address as a user identifier, or the content of your data; the option for personally identifying extras is switched off in the code, as is performance tracing.
The processor is Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, acting under Art. 28 GDPR; Hugo uses Sentry's EU region (servers in Frankfurt, Germany). Where access from the US occurs, it relies on standard contractual clauses and the EU-US Data Privacy Framework. See Sentry's privacy policy.
Legal basis: our legitimate interest in an alarm app that does not crash (Art. 6 (1) (f) GDPR). Retention: 90 days.
2.6 On-device diagnostics
Separately from 2.5, Hugo reads the crash and performance reports iOS itself generates on the device (MetricKit) and shows them in Settings so you can choose to email them to us when something goes wrong. Those reports never leave the device on their own. Separately again, Apple may offer to share diagnostics with developers when you set up your iPhone; that is controlled in iOS settings.
2.7 App Store, subscription and purchases
Downloads, updates and purchases go through the App Store. Apple processes data on its own responsibility there (Apple ID, payment details, purchase history). We receive no personal data about you from Apple, only anonymous sales statistics. See Apple's privacy policy.
Hugo checks your subscription directly with Apple (StoreKit) and stores the result — subscribed yes/no — on the device. No third-party subscription service is involved. That a purchase or trial happened is counted as an event under 2.4 (purchase, trial_started); the amount, your Apple ID and your payment details are not part of it and never reach us.
2.8 Advertising measurement
Hugo is also promoted through paid ads. To find out whether a campaign works, the app uses Apple's own measurement mechanisms only. There is no advertising SDK from Meta, TikTok or a measurement partner in the app, and Hugo never asks for the advertising identifier (IDFA) — which is why you never see the „Allow Hugo to track you across apps“ dialog.
SKAdNetwork and AdAttributionKit. The app reports a number between 0 and 63 to the operating system describing how far this install got — „onboarding finished“ or „trial started“, for example. Apple itself derives a delayed report to the ad network from it. That report contains no identifier — neither the installation ID from 2.3 nor a device ID; it cannot be attributed to a person. We receive a copy of it at hugoalarm.com. Turning off the switch in 2.9 also stops this report.
Apple Search Ads. If the app was installed from an ad in the App Store, Hugo asks Apple once which campaign, ad group and search term that was (AdServices). Those values describe the ad, not you, and are attached as properties to the events in 2.4. If the install did not come from an Apple ad, the answer is simply „no“.
As with 2.4 and 2.5 the legal basis is legitimate interest (Art. 6 (1) (f) GDPR) in knowing whether a euro spent achieved anything. Objection: 2.9.
2.9 Objection and erasure
In the app: Settings → Privacy → turn off „Share usage data“. Hugo then sends neither usage events (2.4), crash reports (2.5) nor the advertising measurement in 2.8. It takes effect immediately; on the next launch the services are not started at all.
Separately, you can ask us to erase data already transmitted: an email to hello@hugoalarm.com is enough. Because there is no account, we can only find your data via the installation ID — write to us and we'll tell you where to find it in the app. We confirm the deletion.
3. This website
3.1 Hosting and server logs
The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes the technically necessary access data: IP address, time, URL requested, browser identifier. The legal basis is our legitimate interest in secure, stable operation (Art. 6 (1) (f) GDPR). Vercel is our processor; transfers to the US rely on the EU-US Data Privacy Framework and standard contractual clauses. Vercel deletes logs after a short period.
3.2 No cookies, no tracking
This site sets no cookies, uses no analytics or advertising services and embeds no third-party content. The analytics tool in 2.4 runs in the app only, not here. Fonts are served from our own server, not from Google. That is why there is no cookie banner.
3.3 Links to the App Store
Tapping “Download on the App Store” takes you to Apple; Apple's privacy policy applies from there.
4. Email contact
If you write to us, we process your email address and the content of your message to answer it (Art. 6 (1) (b) and (f) GDPR). We delete the correspondence once the request is resolved and no statutory retention applies.
5. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21) — that covers 2.4, 2.5 and 2.8, and 2.9 says how. You may also lodge a complaint with a supervisory authority. For the data in 2.1: we don't have it; you delete it yourself by deleting the app. If you live in California or another US state with a privacy law: we don't sell or share personal information, and the rights above apply to you in the same way.
6. Children
Hugo is not directed at children under 16 and we do not knowingly collect data from children. The events in 2.4 and the reports in 2.5 contain no age and nothing we could infer one from.
7. Changes
We update this policy when the app or the site changes. The current version is always at hugoalarm.com/privacy; the date above shows the version.