Privacy Policy

Last updated: September 26, 2026

1. Overview

Flashing Light: Morse Trainer is a native training tool for iOS and Android from Osprey Applications LLC that helps mariners practice receiving, transmitting, and interpreting visual Morse signaling for U.S. Coast Guard flashing-light competency. This policy explains exactly what the app does and does not do with your information.

In short: all of your training content, drill activity, scores, statistics, and settings stay on your device. The app requires no account and no sign-in. Four kinds of information leave your device: purchase-related data, processed by the app store you bought through — Apple on iOS or Google Play on Android — and by our purchase-management provider, RevenueCat, so we can sell, validate, and restore the one-time “Full Access” purchase; pseudonymous usage analytics and crash reports, processed by Google Firebase, so we can see which features are used and fix crashes; and any message you choose to send us through Contact the Developer. The app contains no advertising and no cross-app tracking, and it does not collect any advertising identifier.

2. No Accounts or Sign-In

No user accounts, no sign-up, and no sign-in are required to use the app. The app does not ask for your name, email address, or any other identifying personal information in order to function. If you choose to include your email address in a message to us, it is used only to reply to you (section 4.5).

3. What Stays on Your Device

The following is stored only on your device and is never transmitted to us:

• Training history and progress — your session attempts, item attempts, per-symbol mastery statistics, scores, and app settings are stored locally inside the app’s private storage on your device — SwiftData on iOS, a local database (Room) on Android. There is no cloud sync in this version and none of it is backed up to our servers.
• Bundled reference content — the app ships a read-only database of Morse symbols, signal items, drill templates, and PUB 102 / International Code of Signals reference entries. This content is identical for every user and read-only, and your interaction with it is never transmitted.
• App preferences — small interface defaults and a cached “Full Access” entitlement flag (so the app can read your purchase status instantly at launch) are kept in the platform’s local preference store — UserDefaults on iOS, DataStore on Android. A device keychain/keystore entry may hold an internal application key. None of these report data anywhere.

Uninstalling the app removes all of this on-device data.

4. What Leaves Your Device

The app is free to download and is monetized by a single one-time in-app purchase called “Full Access” ($9.99) — a non-consumable product on iOS and a one-time product on Google Play. Selling, validating, and restoring that purchase requires processing a limited amount of data off-device (4.1–4.2). The app also sends pseudonymous usage analytics and crash reports (4.3–4.4), and any message you choose to send us (4.5).

4.1 RevenueCat (purchase-management provider)

We use RevenueCat, a third-party purchase-management service, solely to sell, validate, and restore the one-time “Full Access” purchase and to determine your entitlement (whether you own Full Access). Through RevenueCat, the following categories of data are processed:

• Purchases — purchase and transaction data and your entitlement status.
• Identifiers — an anonymous app-user identifier generated for purchase management. On iOS this may include the device-scoped identifier for vendor (Apple’s identifierForVendor). The Android app configures RevenueCat in anonymous mode — no custom user identifier is set, nothing is linked to your identity — and it does not request the Android advertising ID.
• Usage Data and Diagnostics — SDK usage and diagnostic information generated by the purchase SDK.

Data shared with RevenueCat is used only to manage your purchase and entitlement. It is not used for cross-app tracking and not used for advertising or ad attribution. The app declares no tracking and contains no advertising or ad-attribution SDKs.

4.2 Payment processing (Apple / Google Play)

Payments are processed by Apple through StoreKit on iOS, and by Google through Google Play Billing on Android; RevenueCat operates on top of whichever store applies. The developer never receives your payment method, billing address, or other identifying purchase details. The relevant store’s own privacy policy governs the payment itself.

4.3 Usage analytics (Google Analytics for Firebase)

We use Google Analytics for Firebase to understand how the app is used, so we can decide what to improve. It records:

• App interactions — a small, fixed set of events: a purchase screen shown (and which screen showed it), a purchase started or completed, the rating prompt shown, a message sent through Contact the Developer, an update notice shown, and a Mock Exam passed at 85% or better. Firebase also records standard events such as first launch, app sessions, and screen views. Event contents never include your name, email address, message text, or training answers.
• Identifiers — a random app-instance identifier created by Firebase when the app is installed. It is reset if you delete and reinstall the app. The app does not collect the Android advertising ID or Apple’s advertising identifier (IDFA).
• Device and app information — device model, operating-system version, app version, language setting, and an approximate (country- or city-level) location that Google derives from your IP address. Google does not provide us with your IP address.

Analytics data is pseudonymous: we see counts and trends, not who you are. It is kept for up to 14 months and then deleted automatically. It is not used for advertising or shared with advertisers. Google processes it on our behalf under the Firebase privacy and security terms.

4.4 Crash reports (Firebase Crashlytics)

If the app crashes, Firebase Crashlytics sends us a crash report so we can find and fix the problem. A report contains the technical details of the crash (which part of the app failed), the device model, operating-system version, app version, free memory and disk space at the time, a random Crashlytics installation identifier, and the list of the app’s analytics events (4.3) leading up to the crash. It contains no training data and no personal information. Crash reports are kept for 90 days and then deleted automatically.

4.5 Contact the Developer (messages you send us)

Settings → Contact the Developer lets you send us a general message, a feature request, or a bug report. Nothing is sent unless you tap Send. A message contains:

• The message text and its type (general, feature request, or bug report).
• Your email address, only if you enter one. It is optional for general messages (you can send anonymously) and required for feature requests and bug reports so we can reply.
• Technical details that help us answer: the app version, operating-system version, device model, language setting, which screen you sent it from, and whether you have Full Access.

Messages are stored in our feedback database, hosted by our database provider, Supabase. They are read only by us, used only to answer you and improve the app, never sold or shared, and deleted on request (section 9).

5. Progress Export

With Full Access, you can export your training history. “Export progress” writes a JSON file (your sessions, attempts, mastery statistics, and settings) locally and hands it to the standard system share sheet (the iOS share sheet, or the Android share sheet via a secure in-app file provider). The app performs no cloud upload of this file — where you send or save it afterward is entirely your choice and outside the app’s privacy boundary.

6. Required-Reason API Usage (iOS)

The app’s privacy manifest declares its use of certain Apple “required-reason” APIs:

• UserDefaults — small interface defaults and the cached entitlement flag.
• File Timestamp
• Disk Space
• System Boot Time

None of these APIs are used to report data to the developer.

On Android there is no equivalent required-reason declaration. The Android app requests no runtime permissions at all — no camera, microphone, location, contacts, photos, or storage access — and does not request the Android advertising ID. Its only permissions are network access and billing (plus the network-state and wake-lock permissions that Google’s Firebase SDK adds), used by the purchase SDK and by the analytics, crash-reporting, and Contact the Developer features described in section 4.

7. No Advertising or Tracking

There is no advertising, and the app performs no cross-app tracking. The only third-party SDKs are RevenueCat (purchases) and Google Firebase (usage analytics and crash reports, sections 4.3–4.4). Neither is used for advertising or ad attribution, and the app does not collect any advertising identifier.

8. Children’s Privacy

The app is not directed to children under 13 and does not knowingly collect data from children. The app does not ask for personal information; if a child has sent us a message through Contact the Developer, email us and we will delete it (section 9).

9. Your Data Rights and How to Request Deletion

This section applies to Flashing Light: Morse Trainer, published by Osprey Applications LLC.

On-device data — you can delete it yourself, immediately

Your training history, session and item attempts, per-symbol mastery statistics, and settings are stored only on your device. Uninstalling the app permanently deletes all of it. We never receive this data, so there is nothing for us to delete on your behalf.

Purchase data and messages — how to request deletion

If you purchased “Full Access”, a record of that purchase is held by the app store (Apple or Google Play) and by our purchase-management provider, RevenueCat. If you sent us a message through Contact the Developer, it is held in our feedback database. To request deletion of either:

1. Email [email protected] from the address associated with your purchase, or the address you gave in your message.
2. Use the subject line “Data deletion request”.
3. For purchase data, include your store order ID or receipt number. On Google Play you can find this in the Play Store app under your profile → Payments & subscriptions → Budget & order history. On iOS it is in your Apple purchase receipt email. For an anonymous message, tell us roughly when you sent it and what it said.

What is deleted, what is kept

Please note: deleting your RevenueCat record also removes our ability to restore your “Full Access” purchase on a new device or after a reinstall. You would need to contact the app store directly for proof of purchase.

10. Data Security

On-device data is stored using the operating system’s built-in app sandbox and security mechanisms. Purchase data in transit to RevenueCat and to the app store (Apple or Google Play) is encrypted in transit (HTTPS/TLS) and protected by their respective systems. Usage analytics, crash reports, and messages you send us are also encrypted in transit (HTTPS/TLS), and our feedback database accepts new messages from the app but does not let the app read them back.

11. Changes to This Policy

We may update this privacy policy from time to time. We will post the revised policy here and update the “Last updated” date above. Material changes that affect how data is handled will be reflected in this document.

12. Contact

For privacy questions, contact us at: