Draft for review. Written from how the app works today. The highlighted items still need filling in, and this is not a substitute for legal review.

Privacy Policy

Last updated: [date of publication]

hitoha is a journal. What you write is yours, and the app is built so that as little as possible leaves your iPhone. This page explains what does, where it goes, and how to remove it.

Who we are

hitoha is made by [developer or company name, and country]. For any question about this policy or your data, write to [contact email].

Writing without an account

You can start writing without signing in. Your pages are then kept only on your device and nothing you write is sent anywhere. If you delete the app, those pages are deleted with it. If you sign in later, they move into your account's backup.

Signing in and backup

To back up your journal, you sign in with Apple or with Google. Sign-in is handled by Firebase Authentication, a Google service. We receive an account identifier, and the name and email address that Apple or Google share. With Sign in with Apple you can choose to hide your email, and we then receive an Apple relay address instead.

Once you're signed in, a copy of your pages is kept in Google Firebase (Cloud Firestore) [in the region you chose, e.g. Europe]. For each page that copy holds its text, the date and time it was written, and the weather if you allowed it. Only your own signed-in account can read or change it.

• Without Pro, your device sends its changes to the backup, and the backup is read back only when you restore it, for example on a new iPhone.
• With hitoha Pro, your pages also stay in sync between your devices while you're signed in on them.

Google encrypts this data in transit and on its servers. Unless you turn on end-to-end encryption, though, your pages are stored in a form that Google's systems can read, and that we could technically reach through Firebase's own tools. [Confirm: “We don't look at your pages.”]

End-to-end encryption (hitoha Pro)

With hitoha Pro you can turn on end-to-end encryption in Settings. A key is then made on your device and kept in its Keychain, never synced to iCloud. Each page's text and weather are sealed with that key (AES-256-GCM) before they're backed up, so the backup holds only text that nobody else can read, including us and Google.

You're shown a recovery code once, to open your journal on another device. We never see it. If you lose every device that has your journal and the recovery code too, your encrypted pages can't be opened by anyone.

Some things stay readable so the app can work: each page's date and the time it last changed, and your account details. The copy of your journal on your device is protected by iOS, as described below, not by this key.

On your iPhone

• Your pages are saved in the app's private storage, protected by iOS Data Protection: they can't be read until your iPhone has been unlocked once after it starts. Like other app data, they're included in your iPhone's own backups (iCloud Backup or your computer) if you use them.
• Search. Unless you turn off “Show Pages in Search” in Settings, your pages appear in your iPhone's Search (Spotlight), kept on the device by iOS. While the app lock is on, they're kept out of Search entirely.
• App lock uses Face ID or your passcode through iOS. hitoha never sees your face data or your passcode.
• Widgets and Apple Watch only know which days have a page, your painting and your writing rhythm. They never see what you wrote.
• Shortcuts and Siri. Words you send with “Add to Today's Page” wait in a small file on your device until the journal opens. “Today in hitoha” tells Siri only whether today has a page and how many pages the month has.
• Exporting makes a PDF or text file of your pages on your device and hands it to the share sheet. Where it goes next is up to you.
• Settings such as your painting, reminder time and app lock are stored on your device.

Weather and location

If you allow location access, hitoha looks up the weather when you write a page. Your approximate location is sent to Apple Weather (WeatherKit) or, when that isn't available, to Open-Meteo, only to look up the current weather. hitoha doesn't keep your location; it keeps only the temperature and the weather symbol with the page. You can turn location off at any time in the Settings app.

Speaking to write and Apple Watch (hitoha Pro)

Speech is turned into text on your iPhone, by Apple's speech recognition. Audio isn't recorded or sent anywhere, and if your language can't be recognised on the device, hitoha says so instead of using Apple's servers. Text you've spoken but not yet added to a page is kept on your device until you add it or discard it.

On Apple Watch, what you say is sent to your iPhone, turned into text there, and the recording is then deleted from both.

Apple Intelligence and Health

• A question to begin with. On devices with Apple Intelligence turned on, the question offered at the top of a new page is written by Apple's on-device model from your last few pages. Elsewhere, it's one of hitoha's own questions. Either way, nothing is sent anywhere and the question isn't kept.
• Your Month, in a Few Lines. Where Apple Intelligence is on, this optional summary is written on your device from the month's pages, and isn't kept.
• How did today feel? If you choose to, hitoha saves how your day felt to the Health app as a State of Mind. hitoha only writes this one kind of data and never reads anything from Health. These entries stay in Health, where you can see and delete them.

Reminders and purchases

Reminders are scheduled on your device. hitoha doesn't use push notifications or send anything from a server.

hitoha Pro is a subscription handled by Apple through the App Store. Apple processes the payment; hitoha only learns from Apple whether your subscription is active, never your payment details.

What hitoha doesn't do

• No advertising, and no tracking across apps or websites.
• No analytics, crash-reporting or advertising tools in the app.
• We don't sell or share your data with anyone for marketing.

If you've chosen in iOS to share analytics with app developers, Apple may send us crash reports and statistics about the app. You can change this in the Settings app under Privacy & Security.

Services we use

• Google Firebase (Authentication and Cloud Firestore): your account and backup, for signed-in users. Firebase privacy
• Sign in with Apple and Google Sign-In: signing in.
• Apple Weather and Open-Meteo: the weather on a page, if you allow location.
• Apple App Store: hitoha Pro.

Keeping and deleting

• Deleting a page removes its text, date and weather from your backup. A small marker without content stays, so your other devices know it was deleted.
• Signing out removes your pages, your encryption key and unsent spoken text from this device. Your backup stays in your account.
• Deleting your account (Delete Account in the app's Settings) deletes every page and your encryption key from your backup and this device, and deletes your account from Firebase Authentication. It also revokes hitoha's access to your Apple or Google sign-in.
• Without an account, your pages are deleted when you delete the app.

Otherwise, your pages stay in your account for as long as you keep it.

Your rights

Depending on where you live, for example in the EU or the UK under the GDPR, or in Türkiye under the KVKK, you can ask to see, correct, export or delete your data, and complain to your data protection authority. Most of this you can do in the app; for anything else, write to [contact email].

Children

hitoha isn't directed at children under [13], and we don't knowingly collect their data.

Changes to this policy

If this policy changes, the new version will be posted on this page with a new date.