Privacy Policy

Last updated: 2026-09-02

HexWave collects the minimum data needed to give you a reading. This page describes what we collect, why, and how to ask us to delete it.

1. What We Collect

When you use HexWave we collect:

Birth date, time, and coordinates are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt; we never store the plaintext. All data is encrypted in transit using TLS (HTTPS), and we maintain technical and organizational safeguards appropriate to the risk. If a data breach affects your personal data, we will notify you and the competent supervisory authority within the timelines the law requires.

Reading interpretations (Birth Hexagram profiles, daily readings, mutual maps between two people) are stored in a shared content cache keyed by hexagram pair and language, not tied to any user. The same reading text is reused across every user with the same triad pair, and persists after account deletion as a shared library.

We may access connection messages and block or report records when we need to investigate a safety concern or enforce our Terms of Service.

Providing your personal data is voluntary; you are under no legal obligation to provide it, and we ask for it only to deliver the features you use.

For users in the EEA, the United Kingdom, and Switzerland, we rely on the following legal bases to process your data: performance of our contract with you (running your account, calculating readings, and delivering the features you use), our legitimate interests (keeping the service safe, preventing abuse, validating purchases, and diagnosing errors), compliance with legal obligations (tax and accounting records, responding to lawful requests, and keeping records of privacy-rights requests), and your consent where we specifically ask for it. Where we rely on your consent, you can withdraw it at any time; withdrawal does not affect processing that already happened.

2. What We Don't Track

The marketing site at https://hexwave.app uses OpenPanel cookieless analytics and Cloudflare Web Analytics, which is also cookieless and measures page performance only. There are no tracking cookies, no session fingerprinting, and no advertising pixels. The signed-in app uses a single httpOnly authentication cookie. Beyond that, only minimal client-side state for UI preferences (e.g., language) is kept. No tracking cookies, no session fingerprinting, no ad pixels.

Because we do not track you across other sites and do not sell or share your data, browser signals like Do Not Track and Global Privacy Control are honored by default; there is no tracking for them to switch off.

3. The Live Demo

When you enter a birth date in the homepage live demo, the engine processes the date and we do not retain it beyond the response.

4. Third Parties We Share Data With

Independent controllers

When you buy Premium, the app store is an independent data controller for the payment and billing data it collects. HexWave does not direct or control how the store processes that data; it does so under its own privacy policy.

Processors acting on our behalf

These providers process data only on HexWave's instructions, each for a single purpose:

Each processor receives only the data it needs to perform its function.

Reading interpretations are generated using Anthropic's Claude API. Anthropic receives only non-personal inputs (hexagram numbers, line positions, and language) and never receives your account, your birth data, or any information that identifies you. The generated text is cached and shared across all users, not linked to anyone.

Platform delivery services

Apple Push Notification service (iOS) and Google Firebase Cloud Messaging (Android) deliver push notifications to your device under their own privacy terms. They receive the device token and the notification content described above.

Business transfers

If HexWave is ever acquired, merged, or transfers its assets (including in insolvency), your personal data may be transferred to the successor as part of that transaction. The successor will be bound by this privacy policy for the data it receives, and we will announce a material change of this kind in the app and on this page before it takes effect, so you can delete your account first if you prefer.

International transfers

HexWave is operated from Israel. Depending on the processor, your data may be stored or processed in Israel, in the European Union (Hetzner hosting and Sentry diagnostics), and in the United States (RevenueCat, ZeptoMail, Resend, Backblaze, and Expo). Transfers to Israel are covered by the European Commission's adequacy decision for Israel. For processors in the United States, we rely on standard contractual clauses or their certification under the EU-US Data Privacy Framework, as applicable. Where personal data is otherwise transferred across borders, we rely on equivalent recognised safeguards.

5. Retention

Account data is retained while your account is active. If you delete your account, we delete or irreversibly anonymise your records within 30 days. Backups expire on a rolling 90-day window. Generated reading interpretations are cached permanently; they are keyed by hexagram and language, not by user, so they remain after account deletion as a shared library. Push notification tokens are deleted from a device when you sign out on it, and removed from our servers after 60 days of inactivity.

6. Your Rights

You can request access to, correction of, or deletion of your personal data at any time. You can delete your account and its associated data yourself from the Delete Account page, or from within the app under Settings, then Danger Zone. EU residents have the rights described under GDPR (access, rectification, erasure, portability, objection, restriction). California residents have the rights described under the CCPA and CPRA (know, delete, opt out of sale or sharing; HexWave does not sell or share personal data). To exercise any other right, contact us through Contact. We respond within one month, free of charge. To protect your data we verify requests, typically by confirming control of the account email; an authorized agent may act for you with your written permission. If we decline a request, we will explain why, and you may appeal by replying to our response. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the ICO), though we would appreciate the chance to address your concern first. The right of access does not extend to information whose disclosure would compromise another person's privacy or safety, such as the identity of someone who reported or blocked an account.

7. Children

HexWave is for people aged 16 and older. It is not directed at children under 16, and account creation asks for your birth date to enforce this. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided data, please contact us and we will delete it. If you are a California resident under 18, you may request removal of content you posted (such as a connection message) by contacting us; deleting your account also removes it.

8. Governing Law

This privacy policy is governed by the laws of the State of Israel. The data controller is Asaf Eliyahu, operating as HexWave from Israel. You can reach us at [email protected] or through the Contact page.

9. Changes

We may update this policy. Material changes will be announced in the app and on this page. The "last updated" date above reflects the most recent change.

10. Contact

Privacy questions or rights requests: see Contact.