Privacy policy

Last updated 1 November 2026

The short version: your gallery is scanned on your phone. Only the photo chosen for your next surprise is sent to make your picture, and we don’t keep it. We don’t sell your data, we don’t show ads, and the website has no tracking cookies.

1. Who we are

Morning Surprise (the app and morningsurprise.app) is a trading name of One Vision One Movement Forever Ltd, a company registered in Northern Ireland (company number NI744016), whose registered office is at 8 Rossdale Manor, Ballymena, County Antrim, BT42 2SL, Northern Ireland, United Kingdom (“we”, “us”). We are the data controller for the personal data described here. Contact us at privacy@morningsurprise.app.

2. What we use, and why

Data	Why we use it	Legal basis (UK GDPR)	How long we keep it
App account ID — a random identifier created when you first open the app (no sign-up needed)	To run the app, keep your Surprise Circles and apply fair daily limits	Contract	Until you delete your data
Photos for your surprise — the one photo chosen for your next morning, close-ups of the faces in it, and any “Face photos” you add	To make your morning picture (sent to our server and our image-generation provider, fal.ai)	Contract (you ask for the feature); your permission for gallery access	Not stored by us after the picture is made. fal.ai may keep inputs and results for a short time under its own terms
Surprise settings — who stars (e.g. “family”), vibe, style, interests, the first name you give the star, and the date	To personalise the picture and message	Contract	Not stored after the picture is made
Surprise Circle — your name, that you confirmed you’re 18+, the circles you’re in, people you block, and the messages, photos and voice notes you send	To deliver surprises to the people you choose	Contract	Surprises, photos and voice notes: deleted after 30 days. Profile and memberships: until you leave or delete your data
Wake-up board (only if you switch on “Show when I get up”) — the time you switched your alarm off and your streak	To show your circles who woke first	Consent (you can switch it off)	Replaced each morning; removed when you switch it off
Reports about Surprise Circle content	To keep people safe and enforce our rules	Legitimate interests (safety); legal obligations	Until the review is complete and as long as needed to protect people or meet the law
Feedback you send from the app, with basic app details (version, your settings)	To fix problems and improve the app	Legitimate interests	Up to 2 years
Daily usage counters (how many pictures, tracks or messages today)	Fair-use limits and protecting the service from abuse	Legitimate interests	Up to 60 days
Website forms — your email, name, country, phone type, interests (early access), messages and deletion requests	To answer you, tell you about the launch if you asked, and handle requests	Consent (early-access emails); legitimate interests (replying to you)	Early access: until you unsubscribe or ask us to delete it. Messages and requests: up to 2 years
Website security — a one-way scrambled (hashed) version of your IP address	To block spam on our forms	Legitimate interests	A daily counter, deleted within 60 days

3. What stays on your phone

Gallery scanning — finding a good photo of your star (and where the faces are) happens on your phone using Google’s on-device tools. We don’t create or keep face prints.
“Note to future me” voice notes, your settings, streaks and points, and downloaded pictures, jokes and music.
Wake-up missions — the motion sensor (steps, shakes) and the photo mission (checking for a sink or a mug) work on your phone. Mission photos aren’t uploaded or kept.

4. Children

Morning Surprise isn’t intended for children under 13, and Surprise Circle is only for people aged 18 and over. If you choose to make morning pictures starring your children, their photos are used only to make your own surprise and aren’t kept by us. If you think a child has given us personal data, please contact us and we will delete it.

5. Who we share data with

We never sell your personal data. We use these trusted providers to run the service, under contracts that protect your data:

Google (Firebase / Google Cloud) — app accounts, database (London), servers (London) and file storage (United States).
fal.ai (United States) — makes the morning pictures from your photo. It also creates our AI music and the joke voices (these use no personal data).
Cloudflare — our domain and email forwarding.
Google Play (and Apple’s App Store in future) — app distribution and, when available, subscription payments. We never see your card details.

The people in your Surprise Circles see what you send them, your name, and (if you switch it on) your wake-up time and streak. We may also share information if the law requires it, or to protect someone’s safety.

6. International transfers

Some providers process data in the United States. Where this happens we rely on appropriate safeguards, such as the UK International Data Transfer Addendum or the UK–US data bridge where the provider is certified.

7. Advertising and tracking

We don’t show adverts and don’t use advertising or analytics trackers in the app or on this website. The website loads its font from Google Fonts, which means Google receives your IP address when you visit. If this ever changes, we’ll update this policy and ask for your consent where required.

8. Your rights

You have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy, and withdraw consent at any time. Use Delete my data or email privacy@morningsurprise.app. We reply within one month. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

9. Keeping data safe

Data is encrypted in transit, our database can only be reached through our own server code, and access is limited to what’s needed to run the service.

10. Changes

We’ll update this page when the app changes (for example when subscriptions or sign-in are added) and tell you in the app about important changes.