Heptyx Privacy Policy

Effective date: 16 October 2026
Controller: Gökberk Batuhan Demirbaş · Contact: privacy@heptyx.app

Heptyx is a daily ritual app that combines biorhythm, numerology, chakra traditions and crystals. It is built so that the personal data it needs stays on your phone.

1. Data that stays on your phone

These are calculated and stored only on your device. We never receive them:

• your birth date (unless you use rhythm match, see section 3)
• your full birth name, if you add it (used only for numerology name numbers)
• your chakra check-in answers and your journal
• your crystal collection, reminder settings and widget content

Because chakra and energy answers can reveal beliefs, we ask for your explicit consent before you enter them (GDPR Art. 9(2)(a)). You can withdraw it at any time by deleting your data in Settings.

2. Data we receive

After you give consent, the app creates an anonymous account: a random identifier with no name, e-mail or phone number. Linked to it we store:

Events never contain your birth date, name or check-in answers; the server rejects any other field.

Your IP address is used briefly to limit abuse (rate limiting) and appears in server access logs, which are kept for 14 days.

3. Rhythm match (optional)

Rhythm match is off until you create or accept an invite, and each time it asks for your consent first.

• What we receive: your birth date, stored encrypted (Fernet, with a key kept outside the database). Your name is never sent.
• Invite: a random 8-character code. We store only a one-way hash (SHA-256) of it, who created it and when it expires. An invite is valid for 7 days, for one person.
• Match: a record linking two anonymous accounts. The match values and sync days are calculated when you open them and are not stored.
• What the other person sees: the match values (physical, emotional, intellectual and overall) and your shared sync days in the next 30 days. Never your birth date, name, curve or critical days. These values together can be enough to work out your birth date, so invite or join only people you trust. The nickname you give a match stays on your phone.
• How long: invites are deleted after the 7 days (within the following hour). A match is deleted at once when either of you ends it, and with either account. Your encrypted birth date is deleted as soon as you have no match and no open invite.
• Usage events record only that an invite was sent or accepted or a match ended: never the code, a nickname or a date.

4. Crystal scan and OpenAI

Scanning is optional and asks for separate consent the first time. When you scan:

1. The photo you take or choose is reduced in size on your phone and sent to our server.
2. Our server sends it once to OpenAI (United States) to recognise the stone. Your birth date, name and check-ins are never sent.
3. The photo is processed in memory and not stored by us. Only the result (stone ID and confidence) is recorded as an anonymous event.

OpenAI states that API inputs are not used to train its models by default and that abuse-monitoring logs are kept for up to 30 days, unless the law requires longer. See OpenAI: Your data. You can turn scanning off at any time; the stone library works without it.

5. Purchases

Subscriptions are sold by Apple (App Store) or Google (Google Play). We never see your payment details. We use RevenueCat to check whether your subscription is active; RevenueCat receives your random account ID and your store purchase records (RevenueCat privacy policy).

6. What we do not do

• No advertising, no ad tracking, no data sale or "sharing" for cross-context advertising.
• No push notifications from our servers: reminders are scheduled locally on your phone.
• No location, contacts, microphone or health data.

7. Legal bases (EEA/UK)

• Explicit consent: check-in data on your device, crystal scan, rhythm match (Art. 6(1)(a), Art. 9(2)(a)).
• Contract: running your account and subscription (Art. 6(1)(b)).
• Legitimate interests: security, stopping abuse, anonymous product statistics (Art. 6(1)(f)).

8. Your choices and rights

• Export: Settings → Export my data (everything stored on your phone, as JSON).
• Delete: Settings → Delete my data removes everything on your phone, cancels reminders, clears widgets and deletes your anonymous account on our server together with your scan counts, subscription record, rhythm matches, invites and encrypted birth date. Past usage events are kept only without any link to you. If you are offline, the server deletion is retried the next time you are online.
• Subscriptions are cancelled in your App Store or Google Play account settings; deleting your data does not cancel them.
• You can access, correct, delete or port your data, object to processing, withdraw consent and complain to your data protection authority. California residents: we do not sell or share personal information. Contact privacy@heptyx.app.

9. Children

Heptyx is not directed to children under 13 and is rated 13+. We do not knowingly collect data from children.

10. Not medical advice

Heptyx is a reflection and ritual tool. It does not diagnose or address any medical condition and is not a substitute for professional advice.

11. Changes

We will update this page and the effective date when this policy changes, and tell you in the app if the change is significant.