Privacy Policy
Effective date: February 22, 2026 · Last updated: September 10, 2026
1. Introduction
MidnightInsomnia is a real-time chat application exclusively available during midnight hours (00:00–04:59 in your local timezone), designed for night owls and insomniacs. This Privacy Policy explains how we collect, use, and protect your information when you use the app.
Data controller: Zorbey Torunoglu · Contact: zorbeytorunoglu@gmail.com
This policy applies to all versions of MidnightInsomnia (Android and iOS) and the server infrastructure that supports the app.
Age restriction: MidnightInsomnia is rated 17+ and is not intended for anyone under the age of 17.
2. Information We Collect
| Category | Data | Stored Where | Persisted? |
|---|---|---|---|
| Account | Firebase UID, authentication method (anonymous, Google, or Apple), anonymous status flag | MongoDB | Yes |
| Profile (premium) | Display name, avatar ID | MongoDB | Yes |
| Subscription | Premium status, premium expiration date | MongoDB | Yes |
| Timestamps | Account creation date, last seen, last visit date | MongoDB | Yes |
| Usage stats | Total messages sent, reactions given/received, nights visited, current streak, longest streak | MongoDB | Yes |
| Achievements | Achievement identifiers with unlock status | MongoDB | Yes |
| Chat messages | Message content, sender info, emoji reactions | Server memory only (max 50) | No — lost on server restart |
| Timezone | Timezone string (e.g. "Europe/Berlin") | Session memory only | No |
| Device storage | Firebase token, notification preference | Device (DataStore) | Local only |
| Firebase Analytics | App usage events, device info, session data | Google servers | Per Google policy |
| RevenueCat | Purchase transactions, entitlements | RevenueCat servers | Per RevenueCat policy |
Our server does not store your email address. Firebase Authentication may provide your email to the app client-side, but the server only extracts your Firebase UID and anonymous status from authentication tokens.
3. How We Use Your Information
- Authenticate your identity and manage your session
- Provide real-time chat functionality during midnight hours (00:00–04:59)
- Track usage statistics and unlock achievements (gamification features)
- Manage premium subscription status and entitlements
- Deliver optional midnight reminder notifications (local only, opt-in)
- Monitor app performance and stability (Firebase Analytics)
- Process in-app purchases (RevenueCat)
4. Legal Basis for Processing (GDPR Art. 6)
| Legal Basis | Data & Purpose |
|---|---|
| Contract performance (Art. 6(1)(b)) | Account data, usage stats, achievement tracking, premium subscription features |
| Legitimate interest (Art. 6(1)(f)) | Server logging (console-only, not persisted to files), analytics for app improvement |
| Consent (Art. 6(1)(a)) | Midnight reminder notifications (opt-in); Firebase Analytics (device-level opt-out available via your device settings) |
5. Data Sharing & Third-Party Services
| Service | Data Shared | Purpose | Privacy Policy |
|---|---|---|---|
| Firebase Authentication (Google) | Auth tokens, UID | User authentication | https://firebase.google.com/support/privacy |
| Firebase Analytics (Google) | App usage events, device info | Analytics & performance monitoring | https://firebase.google.com/support/privacy |
| RevenueCat | Purchase transactions, entitlements | Subscription management | https://www.revenuecat.com/privacy |
| Google Sign-In | Google account info (during auth flow) | Authentication option | https://policies.google.com/privacy |
| Apple Sign-In | Apple ID info (during auth flow) | Authentication option | https://www.apple.com/legal/privacy/ |
| Hetzner Online GmbH | All server-side data (hosted infrastructure) | Server hosting (Frankfurt, Germany) | https://www.hetzner.com/legal/privacy-policy/ |
We do not sell your personal data.
6. International Data Transfers
Our server is located in Frankfurt, Germany (within the European Economic Area). However, some third-party services may process data outside the EEA:
- Firebase / Google and RevenueCat may process data in the United States.
- Apple may process Sign-In data in the United States and other jurisdictions.
These transfers are protected by Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework.
7. Data Retention
| Data | Retention Period |
|---|---|
| Account & profile data | Retained while your account exists; deleted upon account deletion request |
| Chat messages | Not retained — held in server memory only (max 50 messages), lost on server restart |
| Server logs | Console/stdout only; not persisted to files |
| Firebase Analytics data | Per Google's retention settings (default 14 months) |
| RevenueCat data | Per RevenueCat's retention policy |
| Device-local data | Until you uninstall the app or clear app data |
8. Data Security
- All WebSocket connections are encrypted via WSS/TLS.
- Firebase authentication tokens are verified server-side on every connection.
- MongoDB runs on a private network and is not publicly accessible.
- No passwords are stored — authentication is fully delegated to Firebase.
- Chat messages are ephemeral by design (privacy-by-design principle) — they exist only in server memory and are never written to disk.
9. Your Rights
All Users
- Right to know what personal data we hold about you
- Right to deletion of your personal data
- Right to withdraw consent at any time (where processing is based on consent)
EEA / UK Residents (GDPR)
- Right of access to your data
- Right to rectification of inaccurate data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with your local supervisory authority
California Residents (CCPA / CPRA)
- Right to know what personal information is collected
- Right to delete your personal information
- Right to opt-out of the sale of personal information (we do not sell your data)
- Right to non-discrimination for exercising your privacy rights
CCPA categories collected: Identifiers (Firebase UID), Internet or other electronic network activity information (usage statistics), and commercial information (subscription status).
How to Exercise Your Rights
Email zorbeytorunoglu@gmail.com with your request. If possible, include your Firebase UID to help us locate your data. We will respond within 30 days.
10. Account Deletion
You can delete your account and its data directly in the app: open your Profile, tap Delete Account, and confirm. If you cannot access the app, email zorbeytorunoglu@gmail.com to request deletion.
When your account is deleted, we remove your user record from our database (profile, statistics, achievements, subscription data), delete your billing customer record with our subscription provider, and delete your Firebase Authentication account. If you request deletion by email, we confirm the deletion by email when it is complete.
Chat messages do not require deletion because they are ephemeral and exist only in server memory. For the full process, see the Account and Data Deletion page (/delete-data).
11. Children's Privacy
MidnightInsomnia is rated 17+ and is not intended for children under the age of 17. We do not knowingly collect personal data from anyone under 17. If you believe a child under 17 has provided us with personal data, please contact us at zorbeytorunoglu@gmail.com, and we will promptly delete that data.
12. Notifications
MidnightInsomnia offers optional midnight reminder notifications to let you know when the chat window opens. These notifications are:
- Local only — scheduled and delivered entirely on your device
- Opt-in — you must explicitly enable them
- Not powered by a remote push server
On Android, the app requests the following permissions solely for this feature: POST_NOTIFICATIONS and RECEIVE_BOOT_COMPLETED.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted at this same URL with an updated "Last updated" date. Your continued use of MidnightInsomnia after any changes constitutes acceptance of the updated policy.
For material changes, we will attempt to notify you through the app.
14. Contact Information
If you have any questions about this Privacy Policy or your personal data, contact us at:
Zorbey Torunoglu · zorbeytorunoglu@gmail.com