Hekether See the app

Android app privacy policy

Last updated: 27 October 2026. This text applies to the app Hekether and the website https://hekether.com.

1. Provider and contact

Ankarina OÜ
osaühing (OÜ), Estonian private limited company
Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Estonia
Registry code 17549227 (Estonian Commercial Register (Äriregister)), represented by its management board member (juhatuse liige) Anna Lippmann
Email: [email protected]
Phone: +49 176 11361289

Ankarina OÜ ("the provider") is the controller under the General Data Protection Regulation (GDPR) for the processing this policy attributes to it. Where another party is responsible in its own right, such as Google for purchases, the relevant section says so.

2. The short version

The details are in the sections below.

3. What the app stores on your device

The app stores everything you enter in files in the app's private storage area on your device. Photos and voice recordings are kept as files in the same area.

Health data under Art. 9 GDPR:

Other data:

Widget: For the home screen widget, the app keeps the finished display texts and the moon image in the app's private storage area: the moon phase and the next festival. The widget is visible on the home screen.

Files you create yourself: backup file with everything you have written, grimoire and year book as PDF, the grimoire as a Markdown file, rituals and recipes as text. These files are not encrypted, including the health details in them. You decide where they go in your device's share menu. You can restore a backup file.

Except for files you export, save or pass on yourself, all of this stays on your device: in the app's storage or in the system locations this section names. The app sends none of it to the provider. The provider cannot access it and cannot restore it. Insofar as the provider is nevertheless considered the controller of the processing on your device because it provides the app, the purpose is the function of the app you use and the legal basis is Art. 6(1)(b) GDPR (terms of use). Everything stays stored until you delete it.

4. Permissions and device access

The app uses the following permissions and access on your device:

Hekether asks only for permissions a feature needs. The app calculates everything on the device; it has no network code and no permission for the internet.

You can revoke a permission at any time in your device settings. The feature that needs it then stops working.

At start, the app checks on the device, using its signature and its installation source, whether it comes from Google Play. If it does not, it shows only a notice. It sends nothing and does not store the result.

5. Health data

What you record in the app about your health is health data within the meaning of Art. 4(15) and Art. 9 GDPR. The section "What the app stores on your device" lists which entries these are. They stay on your device. The app does not send them to the provider or to anyone else; only you can share them. The provider cannot read, correct, delete or hand them over.

The provider does not process this data and is not the controller for it within the meaning of Art. 4(7) GDPR; it stays on your device. What you record there for yourself, you process yourself.

The app shows you your own entries. It does not interpret them as a state of health, makes no diagnosis and recommends no treatment and no products. Please do not send the provider any health information, including in support requests. The provider does not need it.

6. No device backup

The app excludes its data from device backup, so it is not intended for your Google cloud backup. Do not count on it moving with you when you change devices.

7. Purchases through Google Play

Purchases in the app run through Google Play. In these countries the contracting party for the purchase is Google Commerce Limited, 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland: EEA, Åland, Faroe Islands, Greenland, Svalbard and Jan Mayen, Ceuta, Melilla and the Canary Islands, French overseas territories except the French Southern and Antarctic Lands, Monaco, San Marino, Vatican City, Gibraltar, United Kingdom. For users in the European Economic Area, the Google Play service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which is the controller for the data processed in it. In the United Kingdom the service is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. In all other countries the provider is the seller itself; there Google offers the app on its behalf and handles the payment, and the Google company that offers Google Play in your country is responsible for the data processed in doing so.

Google's privacy policy (https://policies.google.com/privacy) and the Google Play Terms of Service apply. During a purchase the Play Store app sends Google, among other things, your Google account, payment method, country, device data, the product ID, a purchase token and the order number. The provider has no influence on this. Any transfers Google makes in the process are Google's responsibility.

For purchases the app uses the Google Play Billing Library, software made by Google. It checks whether a valid purchase exists, and the app remembers the result. The library keeps a log about itself: its version, the app's package name and version number, and error messages, for example when the billing service is not available on the device. The app has no permission to use the Internet. The library therefore cannot send the entries; they stay on the device and are gone with "Delete all data" and with the app. Your content is not included. The provider does not receive these entries. Apart from this, the app has no networking code of its own and sends nothing.

In the Google Play Console the provider sees order data such as order number, product, country, date, amount, purchase token and refunds. The provider never sees your payment method. Purposes: handling the purchase and the contract of use, processing refunds, accounting and tax. The legal bases are Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (accounting and tax obligations) and, for reviewing refunds and abuse, Art. 6(1)(f) GDPR (legitimate interest in orderly processing). The provider receives this data from Google (Art. 14 GDPR). Retention: the provider keeps order data it sees in the Play Console only for the purposes stated. It deletes its own copies at the latest 2 years after the purchase ends, unless they form part of its accounting records. Whatever the Play Console displays for longer it no longer uses; Google deletes it there under its own deadlines. Whatever forms part of its accounting records it keeps for 7 years from the end of the financial year under Estonian law (section 12 of the Estonian Accounting Act, Raamatupidamise seadus).

If you tap "Request a refund or withdrawal" in a country where the provider is the seller, the app prepares an email to the provider. You see what it contains before you send it. The provider uses your email address and the order number to review the request, arrange any refund in the Play Console and reply to you (Art. 6(1)(b) and (c) GDPR). It keeps the email for as long as its accounting requires.

8. Crash and usage statistics on Android

If you have allowed in your device settings that usage and diagnostics data is sent to Google, and you installed the app from Google Play, Google provides the provider with crash and usage statistics in the Play Console (Android vitals). They show the place in the program where the app crashed, the device model and the Android version, but no name and no identifier by which the provider could recognise you. According to Google, it shows them only if there is enough data for an anonymous report. Whether they are collected is your choice in your device settings; Google is responsible for that collection.

9. Support by email

If you email the provider, it processes your email address, the content of your message and anything you attach in order to answer you. The legal basis is Art. 6(1)(b) GDPR where your contract with the provider is concerned, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering). Recipient: the provider's email hosting provider, acting as its processor: INWX GmbH, Prinzessinnenstr. 30, 10969 Berlin, Germany; the messages are stored on its servers in Germany. The message is deleted once your request is settled, unless a statutory retention obligation requires longer storage. If you ask for a refund by bank transfer, it also processes your name and bank details for this (Art. 6(1)(b) and (c) GDPR) and deletes them as soon as its accounting allows. You do not have to write to the provider, but without your email address it cannot reply. Please do not attach content from the app; support does not need it.

If you tap “Write to us” in the app, it opens your email app with a prepared message to [email protected]. It contains the app version, the platform, the version of your operating system and the app language. You see what it says before you send it, and you can change or delete it. The app itself sends nothing.

10. Website

The website of Hekether is at https://hekether.com. This section covers visits to it. The installed app does not load its pages from there; it brings them with it. The app opens the website only when you tap a link to it in the app.

The website is delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, through its Cloudflare Pages service. With every request, Cloudflare processes the access data without which a page cannot be delivered: your IP address, date and time, the address requested, the amount of data transferred and your browser's identifier. The purpose is to deliver the pages and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in running the website securely and reliably). You can object to this as described in the section "Your rights".

Cloudflare processes this data on behalf of the provider (Art. 28 GDPR). The basis is Cloudflare's Data Processing Addendum, which is part of its contract with the provider. For part of the data, such as what Cloudflare derives from it to secure its own network, Cloudflare describes itself in its own privacy policy as a controller in its own right (https://www.cloudflare.com/privacypolicy/).

Cloudflare runs data centres in many countries. The access data may therefore reach the United States and other countries outside the European Economic Area. For the United States, the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework applies (Art. 45 GDPR, Implementing Decision (EU) 2023/1795); according to its own statement, Cloudflare is certified under it. For countries without an adequacy decision, and in case the certification lapses, the EU standard contractual clauses in the Data Processing Addendum apply (Art. 46(2)(c) GDPR, Implementing Decision (EU) 2021/914). The clauses are in the Data Processing Addendum at https://www.cloudflare.com/cloudflare-customer-dpa/. If you write to [email protected], the provider will send you a copy.

The provider keeps no access logs of its own. Cloudflare deletes the access data once it no longer needs them to deliver the pages and fend off attacks. Cloudflare does not state a fixed period.

The website sets no cookies, loads no fonts or scripts from other servers and does not measure audience reach.

11. Deletion

Data held by the provider, such as order data or emails, is deleted once the periods stated in this policy have expired.

No user account, no account deletion. The app has no user accounts. There is therefore no account to delete and no account deletion to request. Everything the app stores is on your device, and you delete it yourself.

You delete the app's data yourself: in the app under Settings, section "Reset", button "Delete practice data" (streaks); grimoire entries, rituals, recipes and relatives you delete one by one in their list, in your device settings through the app's storage, or by uninstalling the app.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20) towards the provider. Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)). Write to [email protected]. If it concerns a purchase, include the order number from the store's purchase confirmation; otherwise the provider cannot link a purchase to a person.

Right to object. Where the provider bases processing on Art. 6(1)(f) GDPR, you can object to it at any time on grounds relating to your particular situation, informally by writing to [email protected].

For data that exists only on your device you need no request: you view, change and delete it in the app yourself. If the app is locked because of your age, you save or delete it from the app's lock notice. For data processed by the store you got the app from, please contact its operator.

If you are unhappy with how the provider handles your data, you can complain to the provider directly (in the United Kingdom: section 164A of the Data Protection Act 2018): [email protected]. The provider acknowledges receipt and replies within 15 days of receiving your complaint. If it needs longer, it tells you the reason and the new deadline beforehand.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live or work or where the alleged infringement took place. If you live in the United Kingdom, you can complain to the Information Commission (ico.org.uk, section 165 of the Data Protection Act 2018).

13. Consumer health data in the United States (Washington)

This section is the consumer health data privacy policy under Washington State's My Health My Data Act (RCW 19.373). It applies to users in the United States.

Your rights under RCW 19.373.040: you can ask the provider to confirm whether it collects, shares or sells your consumer health data and to give you access to that data, including a list of all third parties and affiliates with which it has shared or to which it has sold it. You can withdraw consent and ask for your consumer health data to be deleted. Write to [email protected]. The provider responds within 45 days. If it declines a request, you can appeal to the provider; if the decision stands, it tells you how to contact the Washington State Attorney General to submit a complaint.

14. Brazil (LGPD)

Ankarina OÜ is a small-scale controller (agente de tratamento de pequeno porte) and has not appointed a data protection officer (encarregado) (Art. 11 of the Regulation approved by Resolução CD/ANPD No. 2/2022). Communication channel for data subjects: [email protected].

15. Children

Hekether is not intended for people under 18. If the provider recognises that it has received data from a child under 16, for example in a support email, it deletes that data unless a statutory retention obligation applies.

16. Age check with the store

If your device offers the check (Android with a current Google Play), the app asks the store at every launch which age range your store account falls into (Google Play: Play Age Signals). Older systems do not offer this check; the app then runs without it. Whether the store answers depends on your country and your settings. The store may ask you first whether you want to share the range. The app receives only the range, no date of birth. On Google Play it also receives whether parents manage the account and, for an account managed by parents, a technical identifier it does not use.

If the store reports an age under 18, the app locks itself. Your entries stay on the device; you can then save them as a file or delete them. If you do not share your range or the store does not answer, the app stays open. If Google Play reports that your age is not yet confirmed, the app blocks purchases when your store country is the USA or cannot be determined; the rest of the app stays open. The app does not store the result and does not send it to the provider.

The provider is responsible for the check, even though it runs only on your device. Purpose: the app is intended only for people aged 18 and over, and the laws of some states require the check, for example in Texas. The legal basis is Art. 6(1)(f) GDPR; the provider's legitimate interest is to keep minors out of the app and to comply with these laws. You can object (section "Your rights"). Where the store allows it, you decline sharing there. The store is responsible for the age in your account. If it is wrong, you change it there.

17. Automated decisions

The provider builds no profiles. The app locks itself if the store reports an age under 18 (section "Age check with the store"). If you think that is wrong, change the age in your store account or write to [email protected].

18. Version, languages and changes

This policy applies from the date stated above. You can find it at https://hekether.com/android/privacy/ and through the app. If the language versions differ, the German version prevails, unless the translation is more favourable to you. If the app changes in a way that affects this policy, the provider publishes a new version with a new date.