HumaxXPrivacy Policy
This Privacy Policy explains how HumaxX ("we", "us") handles information when you use the HumaxX mobile application (the "App") and the website at humaxxapp.com (the "Site"). We wrote it to be read, not skimmed: it lists exactly what leaves your device, why, and how to make it stop.
1. The short version
- You can use HumaxX without an account. In guest mode all your data stays on your device.
- If you choose to link an account, we store your progress (missions, habits, streaks, journal entries, settings) in our cloud so you can restore it. This is opt-in and reversible.
- We run no advertising SDKs and no third-party analytics or tracking.
- Purchases are processed by Apple, Google and our billing provider RevenueCat. We never see your card details.
- You can export all your data as a JSON archive and permanently delete your account from inside the App at any time.
2. Information we process
2.1 Guest mode (default)
When you first open HumaxX you are a guest. Everything you create — missions, completions, habits, streaks, journal entries, mood and energy notes, future-self letters, avatar choices and settings — is stored locally on your device. Nothing is sent to our servers. If you delete the App, this data is gone unless you exported it or linked an account.
2.2 Linked account (optional)
To protect your progress you may link an account using Sign in with Apple, Google Sign-In or a passwordless email code. When you do, we process:
| Data | Purpose | Where |
|---|---|---|
| Email address (or the relay address Apple provides), a display name if you set one, and the provider's user identifier | Create and identify your account, sign you in, send the one-time code and account-related emails | Supabase (our authentication and database provider) |
| Your player snapshot: character state, skill progress, mission completions, habits and habit entries, streak state, Guardian state, avatar and cosmetics, settings, and change revision numbers | Back up your progress, sync it between your devices, and merge it safely if the same account is used on more than one device | Supabase |
| Session tokens | Keep you signed in securely. Stored in your device's secure storage, never in plain text | Your device |
Journal text is personal. We do not read it, analyse it, train anything on it, or share it. It is stored so that it can be restored to you.
2.3 Purchases
Subscriptions (Plus, Premium) and LifePoint packs are sold through the Apple App Store and Google Play. Payment is handled entirely by Apple or Google under their own privacy terms. We use RevenueCat to validate receipts and know which entitlements your account has. RevenueCat receives an anonymous app user identifier (linked to your account identifier if you are signed in), your purchase history for this App, device platform and country. We never receive your payment card, billing address or bank details.
2.4 Notifications
If you allow notifications, HumaxX schedules local reminders on your device (habit and mission reminders, streak "last call" nudges). These are created and delivered on-device; we do not operate a push-notification server and do not collect push tokens. You can switch them off in the App or in your system settings at any time.
2.5 Beta feedback
If you send us feedback from inside the App, the report includes what you write plus a small technical context to help us reproduce problems: app version, platform and OS version, screen size, language, the screen you were on, theme and a timestamp. Attachments are included only if you add them.
2.6 Website
The Site is static. If you join the early-access list we store your email address, the platform you selected, your language, the date, and the country Cloudflare infers from your connection — solely to notify you when the App is available. The Site is served by Cloudflare, which processes connection data (such as IP address) to deliver and protect the Site under Cloudflare's privacy policy. We do not use cookies for tracking, analytics scripts or advertising pixels on the Site.
2.7 What we do not collect
- No advertising identifiers (IDFA / GAID), no ad networks.
- No third-party analytics or crash-reporting SDKs.
- No precise location, contacts, photos, microphone or camera access.
- No health data. Integrations with Apple Health, Google Health Connect or wearables are not active in the current version. If we add them in the future they will be strictly opt-in, request the minimum permissions, explain exactly why, and be covered by an updated version of this policy before they ship.
3. Why we are allowed to process this (legal bases)
For users in the EU/EEA, the UK and Türkiye (KVKK), we rely on: performance of a contract (providing the App, syncing your account, delivering purchases); consent (linking an account, notifications, early-access list, beta feedback) which you can withdraw at any time; and legitimate interests (keeping the service secure, preventing fraud such as duplicated purchases, fixing bugs), balanced against your rights.
4. Sharing
We do not sell personal data and do not share it with advertisers. We share data only with the processors needed to run the App, each bound by contract to use it solely on our instructions:
| Provider | Role | Data |
|---|---|---|
| Supabase | Authentication, database, transactional email for sign-in codes | Account and player-snapshot data in §2.2 |
| RevenueCat | In-app purchase validation and entitlements | Purchase data in §2.3 |
| Apple / Google | Sign-in providers and app stores | Per their own terms when you use their sign-in or buy through their store |
| Cloudflare | Website hosting and early-access list storage | Website data in §2.6 |
We may also disclose information if required by law, or to protect the rights, safety or property of users or the public.
5. International transfers
Our providers may store data in the United States or the European Union. Where data leaves your region we rely on the providers' standard contractual clauses or equivalent safeguards.
6. Retention
- Guest data lives on your device until you delete it or the App.
- Account data is kept while your account exists. When you delete your account in the App, your account record and player snapshots are deleted from our database; backups roll off within 30 days.
- Purchase records are retained by Apple, Google and RevenueCat for as long as their policies and tax law require; we retain the minimal entitlement record needed to honour your subscription.
- Early-access emails are deleted after the launch notification is sent or on request, whichever is first.
7. Your rights and controls
You do not have to email us to exercise the important ones — they are built into the App under Profile → Account & Security:
- Export: download a complete JSON archive of your data.
- Delete: permanently delete your account and cloud data in a multi-step confirmation.
- Unlink: remove a sign-in provider or sign out of other sessions.
- Reset: wipe local data and start over.
Depending on where you live you may also have rights to access, rectify, restrict, object to processing, data portability, and to lodge a complaint with your supervisory authority (for example the Turkish Personal Data Protection Authority, KVKK). To exercise any right not covered in-app, email hello@humaxxapp.com. We answer within 30 days.
8. Security
Data in transit is encrypted with TLS. Cloud data is protected by row-level security so that an account can read and write only its own rows. Session tokens are kept in the operating system's secure storage. No system is perfectly secure; if we ever learn of a breach affecting your data we will notify you as the law requires.
9. Children
HumaxX is not directed at children under 13 (or the higher minimum age in your country, such as 16 in parts of the EU). We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.
10. Changes
When we change this policy we update the version and effective date at the top and, for material changes, show a notice in the App before the change takes effect. Earlier versions are available on request.
11. Contact
HumaxX
Email: hello@humaxxapp.com
Web: humaxxapp.com