Morn Terms of Service and End User Licence

Effective date: 9 September 2026

These terms are an agreement between you and Dumitru Hodan, a sole proprietor established at ul. Chmielna 73B/14, 00-801 Warszawa, Poland ("we", "us", "the operator"), about the Morn app for iOS, the Morn widget, and the website mornapp.com (together, "Morn"). By installing or using Morn you accept them. If you do not accept them, do not use Morn.

Our Privacy Policy at mornapp.com/privacy explains what Morn does with data and forms part of these terms.

Who operates Morn

1. Who may use Morn

You must be at least 16 years old, or older if the age of digital consent where you live is higher, and legally able to enter this agreement. If you are under the age of majority where you live, you may use Morn only with the consent of a parent or guardian, who accepts these terms on your behalf. Morn is a tool for exercising your own data-protection rights and is not intended for children.

You may use Morn only with mailboxes you own or are authorised to access, and only to make requests about your own personal data (or the data of a person who has expressly authorised you to act for them, where the law allows it).

2. What Morn is, and is not

Morn is software that runs on your device. It:

• reads the mailboxes you connect, on your device, or an exported mail archive (.mbox) you import, to identify companies that hold your personal data. Gmail is read through the Gmail API over HTTPS, authorised with the Google OAuth scopes https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.send and https://www.googleapis.com/auth/userinfo.email. Every other provider is read over IMAP secured with implicit TLS on port 993. Morn reads message headers and bodies for this purpose and for no other.
• looks up each company's published privacy contact, and never guesses one.
• drafts data-protection requests (for example under Articles 15 and 17 of the GDPR, the UK GDPR, and comparable laws), follow-ups and clarifications.
• sends those requests from your own mail account, only after you confirm each one. For Gmail they go through the Gmail API, and for every other provider through your provider's SMTP server secured with implicit TLS on port 465 — never in clear text, never STARTTLS.
• reads the replies, tracks statutory deadlines and shows you where each case stands.
• optionally, on your instruction, sends a one-click unsubscribe request to a sender that supports it.
• lets you keep identity details and documents in an on-device Vault to answer a company's identity check.

Morn is not:

• a law firm, a legal adviser or a representative. The letters implement well-established statutory rights but nothing in Morn is legal advice, and it is not a substitute for counsel in a dispute.
• a guarantee of any outcome. Whether, when and how a company responds is outside our control. Deadlines shown in the app are the statutory periods, not promises that a company will honour them.
• a mail client for general use. Morn does not delete, move, label, archive or alter your mail, and for Gmail it holds no permission that could.
• a service with an account, a server or a cloud copy of your data. If you lose your device without a backup, we cannot recover anything for you.

2.1 How Morn handles your data

The following statements describe Morn's actual data flows and are the same statements made in our Privacy Policy:

• All scanning, classification, letter drafting and reply reading happens on your device. Morn operates no server of its own, requires no account, and transmits no mail content, scan results, letters or identity details to the developer or to any service acting for the developer. Morn has no backend: there is no Morn server, no cloud service, no distributed infrastructure and no external server of any kind that receives, stores, relays or processes your data, and the developer has no database of users and no copy of anyone's mailbox. This is a permanent design commitment — no future version will introduce a backend, an account, remote storage or any transfer of your data to the developer or to third parties.
• The only outbound traffic is the following. The connection to your own mail provider: for Gmail, the Gmail API over HTTPS, and for every other provider IMAP over implicit TLS on port 993 and SMTP over implicit TLS on port 465, encrypted from the first byte, never in clear text, never STARTTLS. Google's OAuth endpoints, for Gmail, over HTTPS. The requests you confirm, delivered through your provider to the company you addressed. Ordinary web-page and DNS requests to look up a company's published privacy contact. And, only when you tap the corresponding control, a one-click unsubscribe request to a sender that supports it. Morn also talks to Apple's App Store, through StoreKit on the device, when you view plans, purchase, redeem a code or restore. When Morn cannot send a letter itself, it hands the letter to your provider's web compose page or your mail app instead, and you press send there. Each is described in full in the Privacy Policy, sections 5 and 8.
• Credentials (OAuth tokens and app passwords) are stored in your device's Keychain; scan results in an encrypted local database; identity details and documents in the Keychain and in encrypted, backup-excluded files on your device.
• Morn contains no analytics, advertising, tracking or crash-reporting code.
• Deleting the app deletes all of it.

3. Your mailbox and your credentials

Connecting a mailbox means giving Morn, on your device, an OAuth authorisation or an app-specific password. You are responsible for maintaining the confidentiality of your credentials — your mail provider's password or app password, your Google account, your device passcode and your Face ID or Touch ID enrolment — and for everything done with them. Morn has no account of its own and cannot reset, recover or reissue any of them. You are also responsible for the mail provider's own terms, including Google's when you connect Gmail. You may stop Morn using a mailbox at any time by removing it in Morn, and revoke the credential itself at your provider (for Gmail, at myaccount.google.com/permissions). Removing the mailbox alone leaves the stored credential on your device until you delete the app, as the Privacy Policy explains.

You confirm that scanning the connected mailbox does not breach any obligation you owe to an employer, a client or anyone else (for example if the mailbox is a work account).

4. Requests sent in your name

You are the sender. Every request, follow-up, clarification, reply and attachment goes out from your own mail account, in your name, and only after you have seen it and confirmed it. Before confirming, review the letter and the recipient. You are responsible for:

• the accuracy of everything the letter states, including your name, the address the company knows you by, and any details filled in from your Vault;
• the decision to attach an identity document, and for redacting anything you do not wish to share;
• ensuring the request concerns your own data and is made in good faith;
• any consequences of a request you chose to send, including a company closing an account or deleting data you still wanted.

Morn drafts letters from templates that reflect the law as we understand it at the effective date. Laws change and vary by country. If your situation is unusual or contested, take advice before sending.

5. Acceptable use

You agree not to:

• use Morn to make requests about anyone else's personal data without their express authority;
• use the discovery or unsubscribe features to probe, harass or overload any company or service;
• use Morn to send anything unlawful, defamatory, threatening or misleading;
• circumvent the free-tier allowance, the confirmation steps, or Apple's purchase mechanisms;
• reverse engineer, decompile, disassemble or extract the source of Morn except where the law expressly permits it;
• exploit, abuse, overload or attempt to disrupt Morn, the website mornapp.com, or any service Morn connects to on your behalf, or attempt to gain access to any system, account or data you are not entitled to;
• resell, sublicense or offer Morn as a service to others.

We may stop supporting or, through the App Store, withdraw the app from a user who breaches these terms.

6. The Identity Vault and documents

The Vault is optional. Anything you enter stays on your device, protected as described in the Privacy Policy, and is shown or attached only after Face ID, Touch ID or your device passcode. You decide, every time, whether to attach a document to a reply and to whom. Once sent, a document is in that company's hands under its own policies; Morn cannot recall it. Do not store documents that you are not legally entitled to hold.

7. Third-party services

Morn works with services we do not control:

• Your mail provider and Google (for Gmail) provide access to your mailbox under their own terms and privacy policies.

Google user data and Limited Use. If you connect a Gmail mailbox, Morn requests three Google OAuth scopes: https://www.googleapis.com/auth/gmail.readonly, to read your mailbox and the replies companies send, https://www.googleapis.com/auth/gmail.send, to send the requests you confirm from your own address, and https://www.googleapis.com/auth/userinfo.email, your address. Morn holds no permission to delete, modify, label, archive or draft mail in your Google account. The only change it makes there is a request you confirmed, which then appears in your Sent folder. You can revoke the grant at any time at myaccount.google.com/permissions.

Google API Disclosure:
"Morn's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements."

In particular, Morn uses Google user data only to provide the user-facing features described in section 2; never sells it; never transfers it to third parties other than your own provider and the company you address in a request you confirmed; never uses it for advertising; never uses it to train or improve any AI or machine-learning model; and never allows any human to read your email content. You may revoke Morn's access at any time at myaccount.google.com/permissions.

• The companies you contact, including data brokers listed in Morn's catalogue, receive your letters and answer under their own policies. Their contact details in Morn come from their own published pages or from verified public directories; a company may change or remove them at any time.
• Apple distributes Morn and processes all purchases.

We are not responsible for the availability, conduct or content of any third-party service.

8. Free tier, Morn Guard and Lifetime

How payment works. Subscriptions and payments are handled directly by the app store you installed Morn from — today Apple's App Store — through that store's own billing system. We never see or store your payment details, and refunds follow the store's rules, as set out below.

Free. Morn is free to use for up to five companies taken all the way through: letter, reply, deadline, done. Follow-ups, clarifications, replies and scheduled re-scans for those five cases are included. Two data brokers from Morn's broker catalogue are included on top of the five companies. One mailbox is included.

Morn Guard is an auto-renewing annual subscription that removes the five-company and two-broker limits, lets you send letters in batches and connect additional mailboxes. Lifetime is a one-time purchase that grants the same features permanently. It is enabled for Apple Family Sharing, so members of your Family Sharing group can use it under Apple's Family Sharing terms. Feature sets may change over time; we will not remove a feature you paid for without an equivalent.

Prices are shown in the app in your local currency before you buy and are set per App Store storefront. Where an introductory price is offered (for example a reduced first year), the app states the introductory price, its duration and the standard renewal price before you confirm. Introductory offers are available once per Apple ID.

• Payment is charged to your Apple ID at confirmation of purchase.
• A subscription renews automatically at the standard price for the same period unless you cancel at least 24 hours before the end of the current period. Your Apple ID is charged for renewal within 24 hours before the period ends.
• You manage and cancel subscriptions in your Apple ID settings (Settings › Apple ID › Subscriptions, or in the App Store app). Deleting Morn does not cancel a subscription.
• Refunds are handled by Apple under App Store terms; we cannot issue them directly. If you live in the EU or UK, your statutory right of withdrawal is exercised through Apple.
• We may change prices for new periods with notice as required by Apple and by law; you can cancel before the change takes effect.
• Offer codes may be provided at our discretion for Lifetime; they are redeemed through Apple, are non-transferable, have no cash value, and may be limited in number or time.

9. Licence and intellectual property

We grant you a personal, non-exclusive, non-transferable, revocable licence to install and use Morn on Apple devices you own or control, as permitted by the App Store terms (the Apple Media Services Terms and Conditions, including the Usage Rules). All software code, designs and branding of Morn — including the name, the icon, the templates, the catalogue and the directory — are owned by Dumitru Hodan, or by our licensors where stated, and are protected by copyright, trade-mark and other laws. You keep all rights in your own data, in the letters you send, and in anything you create with Morn.

Morn's letters may be used freely for your own requests. The bundled directory of privacy contacts is provided for use within the app; it may not be extracted and redistributed.

Morn includes the open-source GRDB database library, used under the MIT licence.

10. Apple-specific terms

Because Morn is distributed through the App Store:

• These terms are between you and us only, not Apple. Apple is not responsible for Morn or its content.
• Apple has no obligation to provide maintenance or support for Morn.
• If Morn fails to conform to any applicable warranty, you may notify Apple and Apple will refund the purchase price to you, if any; to the maximum extent permitted by law, Apple has no other warranty obligation.
• We, not Apple, are responsible for addressing any claim relating to Morn, including product-liability claims, claims that Morn fails to conform to a legal or regulatory requirement, and consumer-protection or similar claims.
• We, not Apple, are responsible for investigating and resolving any claim that Morn infringes a third party's intellectual property rights.
• You represent that you are not located in a country subject to a U.S. Government embargo or designated as a "terrorist supporting" country, and that you are not on any U.S. Government list of prohibited or restricted parties.
• You must comply with applicable third-party terms (for example your mail provider's terms) when using Morn.
• Apple and its subsidiaries are third-party beneficiaries of these terms and may enforce them against you.

11. Warranties and liability

Morn is provided "AS IS" and "as available", without guarantees or warranty of any kind, express or implied, to the extent the law allows, and the operator's liability is limited to the maximum extent permitted by law, as set out in this section. In particular we do not warrant that Morn will find every company, that every contact address will remain valid, that a company will respond, or that a request will produce any legal effect.

To the extent permitted by law, we are not liable for indirect, consequential or special loss, loss of data (Morn holds none for you), loss of profit, or for any loss arising from a request you chose to send, a company's action or inaction, or a third-party service. Our total liability to you for all claims relating to Morn is limited to the amount you paid us for Morn in the twelve months before the claim arose.

Nothing in these terms limits or excludes liability that cannot lawfully be limited, including for death or personal injury caused by negligence, for fraud, or for a breach of your statutory rights as a consumer, including under EU and UK consumer law. If you are a consumer in the EU, you benefit from the mandatory provisions of the law of the country where you live.

12. Termination

You may stop using Morn at any time by deleting it; section 8 explains how to cancel a subscription. We may terminate this licence if you materially breach these terms. Sections 4, 5, 9, 10, 11 and 13 survive termination.

13. Governing law and disputes

These terms are governed by the laws of Poland, together with the EU consumer-protection rules that apply to you, without depriving you of the protection of mandatory consumer law in your country of residence. Disputes are subject to the courts of Warsaw, Poland, or, if you are a consumer, the courts of your own country.

Formal legal inquiries, notices and complaints must be sent in writing to the operator's Warsaw office — Dumitru Hodan, ul. Chmielna 73B/14, 00-801 Warszawa, Poland — or by email to support@mornapp.com. We aim to answer within one month. We are not obliged to, and do not, participate in alternative dispute resolution before a consumer arbitration body unless the law requires it.

14. Changes to these terms

We may update these terms when the app, the law or our business changes. The effective date above will change, and material changes will be announced in the app's release notes and on mornapp.com before they take effect. Continuing to use Morn after a change means you accept it; if you do not, stop using Morn and cancel any subscription.

15. Contact

Dumitru Hodan (sole proprietor)
ul. Chmielna 73B/14, 00-801 Warszawa, Poland
support@mornapp.com (support, security reports, formal legal inquiries, everything else)
privacy@mornapp.com (privacy)