Privacy Policy

Last updated: 2026-07-06

HexWave collects the minimum data needed to give you a reading. This page describes what we collect, why, and how to ask us to delete it.

1. What We Collect

When you use HexWave we collect:

• Email address and a hashed password (account)
• Birth date and optional birth time and birth location -- encrypted at rest (calculation)
• Optional avatar image (display)
• Subscription status and entitlement identifiers, used to validate Premium access via RevenueCat
• Profiles you create for other people (names and birth data), for your personal use in Mutual Hex Maps -- encrypted at rest
• Device and technical data: IP address, device type, operating system and app version, an anonymous app-installation identifier, and crash or diagnostic reports -- collected automatically to operate the service, prevent abuse, validate purchases, and diagnose errors

Birth date, time, and coordinates are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt; we never store the plaintext.

Reading interpretations (Birth Hexagram profiles, daily readings, mutual maps between two people) are stored in a shared content cache keyed by hexagram pair and language, not tied to any user. The same reading text is reused across every user with the same triad pair, and persists after account deletion as a shared library.

2. What We Don't Track

The marketing site at https://hexwave.app uses OpenPanel cookieless analytics. There are no tracking cookies, no session fingerprinting, and no advertising pixels. The signed-in app uses a single httpOnly authentication cookie. Beyond that, only minimal client-side state for UI preferences (e.g., language) is kept. No tracking cookies, no session fingerprinting, no ad pixels.

3. The Live Demo

When you enter a birth date in the homepage live demo, the engine processes the date and we do not retain it beyond the response.

4. Third Parties We Share Data With

Independent controllers

When you buy Premium, the app store is an independent data controller for the payment and billing data it collects. HexWave does not direct or control how the store processes that data; it does so under its own privacy policy.

• Apple App Store / Google Play -- sells the subscription and acts as merchant of record; independently collects and processes your payment, billing, and tax data

Processors acting on our behalf

These providers process data only on HexWave's instructions, each for a single purpose:

• RevenueCat -- subscription and entitlement management; validates in-app purchases and receives your account identifier plus purchase and entitlement status to unlock Premium. It does not receive your card details, which stay with the app store
• Resend -- transactional email and contact form delivery
• Backblaze B2 -- avatar image storage
• OpenPanel -- cookieless marketing-site analytics
• Sentry -- crash and error diagnostics; receives error reports plus device model, operating system, and app version to help us find and fix bugs. It is configured to exclude your IP address and your birth data
• Hetzner -- infrastructure hosting (servers and PostgreSQL database)

Each processor receives only the data it needs to perform its function.

Reading interpretations are generated using Anthropic's Claude API. Anthropic receives only non-personal inputs (hexagram numbers, line positions, and language) and never receives your account, your birth data, or any information that identifies you. The generated text is cached and shared across all users, not linked to anyone.

International transfers

HexWave is operated from Israel. Depending on the processor, your data may be stored or processed in Israel, in the European Union (Hetzner hosting and Sentry diagnostics), and in the United States (RevenueCat, Resend, and Backblaze). Where personal data is transferred across borders, we rely on recognised safeguards such as adequacy decisions or standard contractual clauses to keep it protected.

5. Retention

Account data is retained while your account is active. If you delete your account, we delete or irreversibly anonymise your records within 30 days. Backups expire on a rolling 90-day window. Generated reading interpretations are cached permanently; they are keyed by hexagram and language, not by user, so they remain after account deletion as a shared library.

6. Your Rights

You can request access to, correction of, or deletion of your personal data at any time. You can delete your account and its associated data yourself from the Delete Account page, or from within the app under Settings, then Danger Zone. EU residents have the rights described under GDPR (access, rectification, erasure, portability, objection, restriction). California residents have the rights described under the CCPA and CPRA (know, delete, opt out of sale or sharing; HexWave does not sell or share personal data). To exercise any other right, contact us through Contact.

7. Children

HexWave is for people aged 16 and older. It is not directed at children under 16, and account creation asks for your birth date to enforce this. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided data, please contact us and we will delete it.

8. Governing Law

This privacy policy is governed by the laws of the State of Israel. The data controller is HexWave, contactable through Contact.

9. Changes

We may update this policy. Material changes will be announced in the app and on this page. The "last updated" date above reflects the most recent change.

10. Contact

Privacy questions or rights requests: see Contact.