Privacy Policy — Hermetic Daily
Note: This content is synchronized with the app’s actual data practices as described in
AGENTS.md/README.md(“Offline by design”) anddocs/REVENUECAT.md— if you add any new data source or third-party service to the app, update this document in the same change.
Version: 1.0.0 · Last updated: 2026-07-23
1. Data Controller
The data controller for Hermetic Daily app is:
LogicLoom Kamil Zwarycz sole proprietorship (JDG), registered in Poland NIP (Tax ID): 5871749235 · REGON (Business Registry No.): 540001576 ul. Kalinowa 6L lok. 3, 81-198 Kosakowo, Poland trading as “KZ Labs”
Privacy contact: contact@kzlab.dev
Given the scale of this activity (sole proprietorship, no large-scale processing of special-category data, no systematic large-scale monitoring), formal appointment of a Data Protection Officer (DPO) is not required under GDPR Art. 37. The contact above serves as the data protection point of contact.
2. What data this app collects — and what it doesn’t
Hermetic Daily has no user account, no sign-in, and no backend server of any kind. Every reading, journal entry, and preference you create lives only in local storage on your own device (expo-sqlite/react-native-mmkv) — nothing is transmitted to us or to any server we operate, because no such server exists. This is a hard architectural constraint of the app, not just a policy — see this repository’s README.md (“Offline by design”) and AGENTS.md.
| Data | Where it lives | Ever leaves your device? |
|---|---|---|
| Journal reflections you write | Local SQLite (db/schema.ts’s userProgress table) |
No |
| Which day/reading you’re on, timer usage | Local SQLite / local storage | No |
| App preferences (first-launch date, used to compute your reading day and free-trial window) | Local storage (react-native-mmkv) |
No |
| Device location (used only to shade the background with your local sunrise/noon/sunset/night) | Read from the OS, used in-memory to compute a sun-phase value | No — never transmitted anywhere, not even to us. You can deny this permission and the app falls back to a default time-based estimate instead. |
The one exception is subscription billing (§3 below): purchasing or restoring a subscription necessarily involves Apple, Google, and RevenueCat, since that’s how in-app purchases work on these platforms.
We do not collect: your name, email address, contacts, photos, microphone/camera data, advertising identifiers, or any data for profiling or ad targeting. We do not use cookies, analytics SDKs, or crash-reporting SDKs in this app at the time of writing.
3. Subscription billing data
If you start a free trial or purchase a subscription, purchase verification and subscription-status management is handled by RevenueCat, which in turn relies on Apple App Store or Google Play for the actual payment. We never see or store your payment card details — that’s handled entirely by Apple/Google.
| Data | Purpose | Processor |
|---|---|---|
| Anonymous purchase/entitlement identifier (RevenueCat’s app-user-id, generated on-device — not tied to any name or email you gave us, because we never collect one) | Determine whether your device currently holds an active subscription/trial | RevenueCat |
| Purchase receipt / transaction data | Payment processing, subscription management | Apple App Store or Google Play (per platform) |
See docs/REVENUECAT.md in this repository for the technical detail of how this is wired up.
4. Recipients of data (processors)
| Recipient | Purpose | Location |
|---|---|---|
| RevenueCat | Subscription/entitlement management | EU/US (Data Privacy Framework) |
| Apple App Store / Google Play | Payment processing for subscriptions | Per platform’s own policies |
We do not use any other third-party data processor in this app at the time of writing (no analytics vendor, no crash-reporting vendor, no advertising network, no cloud storage/sync provider).
5. International data transfers
RevenueCat and Apple/Google may process subscription data outside the European Economic Area. Where this happens, transfer relies on mechanisms recognized under GDPR — in particular the EU-US Data Privacy Framework (DPF) for US-based providers certified under that program. Current certification status can be checked at https://www.dataprivacyframework.gov/.
6. Data retention
Because journal entries, reading progress, and preferences are stored only on your device, they are retained for exactly as long as you keep the app installed — uninstalling the app permanently deletes all of this data, and we have no copy to retain or delete on our end, since none was ever sent to us.
Subscription/entitlement records are retained by RevenueCat and Apple/Google per their own retention policies, for as long as needed to manage your subscription and comply with financial record-keeping obligations.
7. Your rights
Under GDPR, you have the right to:
- Access and portability — since all of your app data (readings progress, journal entries, preferences) lives only on your device, you already have full, direct access to it at all times; there is no separate copy held by us to request.
- Erasure — uninstalling the app erases all locally-stored app data immediately and completely. For subscription/billing data held by RevenueCat or Apple/Google, contact them directly, or contact us at the address below and we will forward/assist with the request where we are able to.
- Object / restrict processing relating to the subscription data described in §3 — contact contact@kzlab.dev.
- Lodge a complaint with a supervisory authority — in Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl. If you’re in another EU member state, you may also contact your local supervisory authority.
We respond to rights requests without undue delay, and no later than one month after receiving the request (GDPR Art. 12(3)).
8. Children’s data
This app is not directed at children and does not knowingly collect personal data from children. Because the app has no account system and collects no personal data beyond the on-device data described in §2, the practical exposure is minimal — but if you believe a child has provided personal data to us in a support request or similar, contact us at the address below and we will delete it.
9. Data security
- Local data is stored using the platform’s standard app-sandboxed storage (
expo-sqlite,react-native-mmkv) — it is only accessible to this app, consistent with iOS/Android’s standard app sandboxing. - We do not operate any server that stores your personal data, which removes an entire category of server-side data-breach risk for the data described in §2.
- Subscription data is protected per RevenueCat’s and Apple/Google’s own security practices.
10. Changes to this policy
We will announce material changes to this policy at least 30 days in advance via an in-app notice and/or an update to this document. The date at the top of this document reflects the latest revision.
11. Contact
- Privacy: contact@kzlab.dev
- Support: contact@kzlab.dev
- Postal address: LogicLoom Kamil Zwarycz, ul. Kalinowa 6L lok. 3, 81-198 Kosakowo, Poland.