Privacy Policy
Last updated: 2026-09-02
HexWave collects the minimum data needed to give you a reading. This page describes what we collect, why, and how to ask us to delete it.
1. What We Collect
When you use HexWave we collect:
- Email address and a hashed password (account)
- Your name and a username (display)
- Birth date and optional birth time and birth location -- encrypted at rest (calculation)
- Optional avatar image (display)
- Subscription status and entitlement identifiers, used to validate Premium access via RevenueCat
- Profiles you create for other people (names and birth data), for your personal use in Mutual Hex Maps -- encrypted at rest
- Connections you make with other users, and any optional free-text message you include with a connection request -- the message is stored and shown to the person you send it to
- Records of any blocks or reports you make (the account you blocked or reported, and any optional reason you provide) -- kept to operate our safety tools and enforce our Terms of Service
- A push notification token for your device, if you allow notifications at the operating-system level -- used to route notifications to your device; deleted from that device when you sign out, and removed from our servers after 60 days of inactivity
- Device and technical data: IP address, device type, operating system and app version, an anonymous app-installation identifier, and crash or diagnostic reports -- collected automatically to operate the service, prevent abuse, validate purchases, and diagnose errors
Birth date, time, and coordinates are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt; we never store the plaintext. All data is encrypted in transit using TLS (HTTPS), and we maintain technical and organizational safeguards appropriate to the risk. If a data breach affects your personal data, we will notify you and the competent supervisory authority within the timelines the law requires.
Reading interpretations (Birth Hexagram profiles, daily readings, mutual maps between two people) are stored in a shared content cache keyed by hexagram pair and language, not tied to any user. The same reading text is reused across every user with the same triad pair, and persists after account deletion as a shared library.
We may access connection messages and block or report records when we need to investigate a safety concern or enforce our Terms of Service.
Providing your personal data is voluntary; you are under no legal obligation to provide it, and we ask for it only to deliver the features you use.
For users in the EEA, the United Kingdom, and Switzerland, we rely on the following legal bases to process your data: performance of our contract with you (running your account, calculating readings, and delivering the features you use), our legitimate interests (keeping the service safe, preventing abuse, validating purchases, and diagnosing errors), compliance with legal obligations (tax and accounting records, responding to lawful requests, and keeping records of privacy-rights requests), and your consent where we specifically ask for it. Where we rely on your consent, you can withdraw it at any time; withdrawal does not affect processing that already happened.
2. What We Don't Track
The marketing site at https://hexwave.app uses OpenPanel cookieless analytics and Cloudflare Web Analytics, which is also cookieless and measures page performance only. There are no tracking cookies, no session fingerprinting, and no advertising pixels. The signed-in app uses a single httpOnly authentication cookie. Beyond that, only minimal client-side state for UI preferences (e.g., language) is kept. No tracking cookies, no session fingerprinting, no ad pixels.
Because we do not track you across other sites and do not sell or share your data, browser signals like Do Not Track and Global Privacy Control are honored by default; there is no tracking for them to switch off.
3. The Live Demo
When you enter a birth date in the homepage live demo, the engine processes the date and we do not retain it beyond the response.
4. Third Parties We Share Data With
Independent controllers
When you buy Premium, the app store is an independent data controller for the payment and billing data it collects. HexWave does not direct or control how the store processes that data; it does so under its own privacy policy.
- Apple App Store / Google Play -- sells the subscription and acts as merchant of record; independently collects and processes your payment, billing, and tax data
Processors acting on our behalf
These providers process data only on HexWave's instructions, each for a single purpose:
- RevenueCat -- subscription and entitlement management; validates in-app purchases and receives your account identifier plus purchase and entitlement status to unlock Premium. It does not receive your card details, which stay with the app store
- ZeptoMail (Zoho) -- transactional email and contact form delivery
- Resend -- transactional email and contact form delivery, used as a backup when ZeptoMail is unavailable
- Backblaze B2 -- avatar image storage
- OpenPanel -- cookieless marketing-site analytics
- Cloudflare -- content delivery, DNS, and cookieless page-performance analytics for hexwave.app
- Sentry -- crash and error diagnostics; receives error reports plus device model, operating system, and app version to help us find and fix bugs. It is configured to exclude your IP address and your birth data, and crash reports are not linked to your account
- Hetzner -- infrastructure hosting (servers and PostgreSQL database)
- Expo (Expo Application Services) -- push notification delivery; receives your device's push token and the content of each notification (which can include the name of a user you interact with and the kind of interaction, such as the relationship type of a Mutual Map), and relays it to Apple or Google for delivery
Each processor receives only the data it needs to perform its function.
Reading interpretations are generated using Anthropic's Claude API. Anthropic receives only non-personal inputs (hexagram numbers, line positions, and language) and never receives your account, your birth data, or any information that identifies you. The generated text is cached and shared across all users, not linked to anyone.
Platform delivery services
Apple Push Notification service (iOS) and Google Firebase Cloud Messaging (Android) deliver push notifications to your device under their own privacy terms. They receive the device token and the notification content described above.
Business transfers
If HexWave is ever acquired, merged, or transfers its assets (including in insolvency), your personal data may be transferred to the successor as part of that transaction. The successor will be bound by this privacy policy for the data it receives, and we will announce a material change of this kind in the app and on this page before it takes effect, so you can delete your account first if you prefer.
International transfers
HexWave is operated from Israel. Depending on the processor, your data may be stored or processed in Israel, in the European Union (Hetzner hosting and Sentry diagnostics), and in the United States (RevenueCat, ZeptoMail, Resend, Backblaze, and Expo). Transfers to Israel are covered by the European Commission's adequacy decision for Israel. For processors in the United States, we rely on standard contractual clauses or their certification under the EU-US Data Privacy Framework, as applicable. Where personal data is otherwise transferred across borders, we rely on equivalent recognised safeguards.
5. Retention
Account data is retained while your account is active. If you delete your account, we delete or irreversibly anonymise your records within 30 days. Backups expire on a rolling 90-day window. Generated reading interpretations are cached permanently; they are keyed by hexagram and language, not by user, so they remain after account deletion as a shared library. Push notification tokens are deleted from a device when you sign out on it, and removed from our servers after 60 days of inactivity.
6. Your Rights
You can request access to, correction of, or deletion of your personal data at any time. You can delete your account and its associated data yourself from the Delete Account page, or from within the app under Settings, then Danger Zone. EU residents have the rights described under GDPR (access, rectification, erasure, portability, objection, restriction). California residents have the rights described under the CCPA and CPRA (know, delete, opt out of sale or sharing; HexWave does not sell or share personal data). To exercise any other right, contact us through Contact. We respond within one month, free of charge. To protect your data we verify requests, typically by confirming control of the account email; an authorized agent may act for you with your written permission. If we decline a request, we will explain why, and you may appeal by replying to our response. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the ICO), though we would appreciate the chance to address your concern first. The right of access does not extend to information whose disclosure would compromise another person's privacy or safety, such as the identity of someone who reported or blocked an account.
7. Children
HexWave is for people aged 16 and older. It is not directed at children under 16, and account creation asks for your birth date to enforce this. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided data, please contact us and we will delete it. If you are a California resident under 18, you may request removal of content you posted (such as a connection message) by contacting us; deleting your account also removes it.
8. Governing Law
This privacy policy is governed by the laws of the State of Israel. The data controller is Asaf Eliyahu, operating as HexWave from Israel. You can reach us at [email protected] or through the Contact page.
9. Changes
We may update this policy. Material changes will be announced in the app and on this page. The "last updated" date above reflects the most recent change.
10. Contact
Privacy questions or rights requests: see Contact.