Effective Date: May 15, 2026 Last Updated: May 15, 2026
Meridian is a mobile application that calculates the exact moment of solar noon at your location and supports a daily reflection practice anchored to that moment. The app uses your location, schedules local notifications, and (when enabled) syncs reflections to a cloud backend operated by Cankat Saraç on Google Firebase.
This Privacy Policy explains exactly what is collected, where it goes, and your rights.
Contact: cankatsarac@gmail.com
To calculate the exact moment of solar noon at your position, the app reads your device coordinates (latitude and longitude). Per the app’s in-app disclosure: “Meridian uses your location only to calculate the exact moment of solar noon where you stand.”
What happens to your coordinates depends on whether you are signed in (see Section 2):
users/{uid}/locations/, so that your noon times can be retrieved on other devices you sign in to. Each user’s document is readable and writable only by that authenticated user, enforced by Firestore security rules.If you write a reflection, the text is stored on your device. If you have enabled cloud sync (Section 2), the reflection is also stored in your Firestore subtree at users/{uid}/journal/, accessible only to your authenticated user.
The app may write a small set of anonymous diagnostic events (for example, “welcome_screen_viewed”, “app_opened”) to a write-only Firestore collection anonymous_events. These events do not include your user ID, your location, or your reflections. They are write-only at the database level: even we cannot read them back from the client. They are used in aggregate to understand whether onboarding and app-open flows are functioning.
If you sign in (Firebase Authentication), we store the email address or auth identifier supplied by your sign-in method (e.g., Apple Sign In private relay address). If you subscribe to Meridian Plus, an entitlement record is stored at users/{uid}/entitlements/.
If you opt in, Meridian schedules local notifications to alert you near solar noon. The app does not send push notifications from a server in the current version.
anonymous_events collection is our own write-only diagnostic stream).The app supports two modes:
users/{uid}/{...}). Firestore security rules guarantee that only the authenticated user with that UID can read or write that subtree.You can sign out at any time. Signing out stops further sync but does not delete already-synced cloud records. To delete cloud records, see Section 6 (Your Rights).
| Data | Legal basis |
|---|---|
| Location (in-memory calculation, signed out) | Consent (Art. 6(1)(a) GDPR) — granted when you accept location permission. |
| Location and reflections (cloud sync, signed in) | Performance of a contract (Art. 6(1)(b) GDPR) — to deliver the cross-device sync you signed up for. |
| Authentication identifier | Performance of a contract (Art. 6(1)(b) GDPR). |
| Anonymous events | Legitimate interest (Art. 6(1)(f) GDPR) — operational telemetry, not associated with any user identifier. |
Firebase Authentication, Firestore, and related infrastructure operated by Google. Acts as our processor for personal data stored under your authenticated user subtree. See https://firebase.google.com/support/privacy and Google’s standard data processing terms.
If you sign in, the auth provider you choose is the controller of its own sign-in flow. Your sign-in identifier (or Apple Private Relay email) is shared with us to maintain your account in Firebase Authentication.
Distribution and platform billing.
The current version does not call Rork, OpenAI, Anthropic, Gemini, ElevenLabs, fal.ai, RevenueCat, Supabase, or any advertising or third-party analytics service.
Meridian is not directed at children under 13 (or under 16 in the EEA without verifiable parental consent). We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has signed in, please contact us and we will delete the account and any associated data.
users/{uid}/... subtree and your Firebase Authentication record within 30 days.Firebase operates data centers globally, including in the United States. Where data is transferred from the EEA / UK to a country without an adequacy decision, we rely on Google’s Standard Contractual Clauses (Article 46 GDPR) or equivalent safeguards.
| Item | Retention |
|---|---|
| Local app data | On-device until uninstall. |
| Firestore user subtree | Until you delete your account or request deletion. |
| Firebase Authentication record | Until you delete your account. Inactive accounts (no sign-in for 24 months) may be flagged for deletion notice. |
| Anonymous events | Up to 365 days for operational analysis; not linked to any user identifier. |
Material changes are communicated via in-app notice on the next launch and by email where we have your email address.
Controller: Cankat Saraç (sole proprietor) Email: cankatsarac@gmail.com Postal address: [INSERT POSTAL ADDRESS]
This Privacy Policy applies to the Meridian mobile application available on the Apple App Store and Google Play Store.