1. Who we are
Haku is provided by the developer identified as the seller on Haku’s App Store product page (“Haku”, “we”, “us”). That developer is the controller of personal data processed directly by Haku, where applicable.
For privacy or support requests, use the current support contact shown on Haku’s App Store product page. Apple and Cloudflare act under their own policies when they provide their respective services.
2. Data Haku handles
Content you create
Haku can store letters, titles, questions, goals, predictions, responses, collections, rituals, and other text you choose to enter. You may optionally add photos, videos, audio, documents, a place, geographic coordinates, or music information.
Letter content, attachment metadata, and attachment files are encrypted on your device before Haku synchronizes them. Haku does not operate an account system separate from your Apple and iCloud accounts.
Operational metadata
To save, schedule, synchronize, and deliver letters, Haku processes record identifiers, creation and update dates, delivery schedules, letter state, revision numbers, deletion markers, and CloudKit synchronization data. Some of this operational metadata is sent to Apple CloudKit in a form that is not part of the encrypted letter body.
Permissions and device features
- Photos, camera, microphone, and files: used only when you choose to add an attachment.
- Location: requested only when you choose to add your current place to a letter. The selected location is stored inside the encrypted letter content.
- Notifications: used to remind you about delivered letters and rituals you create.
- Face ID or device authentication: evaluated by Apple’s Local Authentication framework. Haku receives only the authentication result and does not receive biometric data.
Website data
This website does not use cookies, analytics, advertising pixels, forms, or client-side tracking scripts. Cloudflare may process ordinary request information needed to deliver and protect the site, such as IP address, requested URL, device or browser information, referring page, language, and security signals.
3. Apple and Cloudflare services
Haku relies on the following service providers:
- Apple CloudKit: stores encrypted records and operational synchronization metadata in your private iCloud database.
- Apple Keychain and iCloud Keychain: protect Haku’s encryption key and may synchronize it across your devices when iCloud Keychain is enabled.
- Apple notifications, maps, photos, and device frameworks: provide features you choose to use under your Apple settings.
- Apple iTunes Search API: receives the music search terms you submit, together with network information normally sent with an internet request. Haku stores only the music result you select.
- Cloudflare Pages: hosts and protects this website.
These providers process information under their own terms and privacy policies. See Apple’s Privacy Policy and Cloudflare’s Privacy Policy.
4. How data is used
Haku processes data only as needed to:
- create, encrypt, store, synchronize, deliver, export, restore, and delete your letters and related items;
- provide optional attachments, place, music, notification, widget, and sharing features;
- protect the vault and diagnose synchronization or import failures shown to you;
- operate, secure, and serve this website; and
- comply with applicable law and protect users, the service, or others where legally required.
Haku does not sell personal data, serve behavioral advertising, build advertising profiles, or use cross-app tracking. The current app contains no third-party advertising or analytics SDKs.
5. Retention and deletion
App data remains on your device and, when iCloud synchronization is active, in your private CloudKit database until you delete individual items, use Haku’s “Delete all data” control, remove the relevant iCloud data, or applicable service-provider retention rules remove it.
Haku lets you export readable letters and encrypted backups. Exported files are controlled by you and are not deleted when you delete the app or its cloud data. Apple or Cloudflare may retain limited backups, security records, or logs according to their own policies and legal obligations.
6. Your choices and rights
- Choose whether to use iCloud synchronization and optional device permissions.
- Review and edit drafts while they remain editable.
- Export delivered letters or an encrypted backup.
- Delete individual content or erase the entire Haku vault from the app.
- Change or revoke permissions in Apple system settings.
Depending on where you live, you may also have rights to information, access, correction, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a data-protection authority. Because letter content is encrypted and Haku does not maintain a separate user account, the developer may be unable to identify or decrypt particular content on your behalf; the in-app controls are the primary way to exercise access, export, correction, and deletion.
7. Security
Haku encrypts content and attachments on your device using a key protected by Apple Keychain. Cloud synchronization transfers encrypted payloads through Apple CloudKit. You are responsible for protecting your devices, Apple account, recovery key, and any files you export.
No system can guarantee absolute security or permanent delivery. Keep the recovery key and any important exports somewhere safe and separate from the device running Haku.
8. Changes and contact
We may update this policy when Haku’s features, providers, or legal obligations change. The effective date above will be revised, and material changes will be communicated in the app or on this website when appropriate.
For questions or privacy requests, use the support contact listed on Haku’s App Store product page. You may also contact the data-protection authority responsible for your location where applicable.