Halcy Privacy Policy

Effective 24 September 2026

Halcy (“Halcy”, “we”, “us”) is a private daily photo journal for iOS and Android, made by Buntikki Technologies Private Limited. This policy explains what information the app collects, why, where it is kept, and how you can delete it.

Buntikki Technologies Private Limited is the company responsible for the processing of personal information described in this policy (sometimes called the “data controller” or “data fiduciary”).

1. Information we collect

Account information

You sign in with Google or Apple. From your sign-in provider we receive and store:

• your name,
• your email address (if you use Sign in with Apple and choose “Hide My Email”, this is an Apple relay address),
• the web address of your profile picture, if your provider has one, and
• a unique account identifier.

We never see or store your Google or Apple password.

Your photos and entries

For each day you take a photo, we store:

• the photo, resized to at most 2048 pixels on its longest side, and a small thumbnail of it,
• the date of the entry, the time it was saved, and the filter you chose, and
• your device’s time zone (for example “Asia/Kolkata”), so days and streaks line up with your local calendar.

Before a photo leaves your device, Halcy removes all of its embedded metadata (EXIF), including GPS location, device model, lens information and the camera’s timestamp. Halcy does not ask for access to your location or your photo library. Photos come only from the in-app camera.

App activity and settings

• Your streak figures (current streak, longest streak, total entries, and the date of your last photo), which our servers calculate from your entries.
• Whether you’ve turned daily reminders on or off.

Technical information

Like any online service, our infrastructure provider (Google Firebase, see section 4) automatically processes some technical information when the app connects, such as your IP address, device and operating system type, and sign-in times. We use this only to operate, secure and fix the service. Our server logs record your account identifier when certain operations run, for example account deletion.

What we don’t collect

Halcy doesn’t collect your location, contacts, photo library, browsing activity, advertising identifiers or payment information. It contains no advertising, analytics, crash-reporting or tracking software.

2. How we use your information

• To provide the app: signing you in, saving your daily photo, showing your calendar and streaks, and keeping your entries tied to the right day.
• To show your name and profile picture inside the app.
• To keep the service secure and working: preventing abuse, diagnosing problems and enforcing the app’s rules.
• To respond to you when you contact us.

We don’t use your photos or any other data for advertising, profiling, or training machine-learning models. We don’t sell or rent your personal information.

Where data-protection law requires a legal basis, we process your information because it is needed to provide the service you asked for (performance of a contract), and for our legitimate interest in keeping the service secure.

3. Information stored on your device

• Reminders: daily reminders are scheduled locally on your phone. We don’t use push-notification servers, and no notification token is sent to us.
• Home-screen widgets: if you add a Halcy widget, the app saves thumbnails of up to your last seven photos, plus your streak, in a private area of your device that only Halcy and its widget can read. These files are excluded from device backups and are removed when you sign out or delete your account.
• Camera files: when you take a photo, the camera briefly writes a temporary file. Halcy deletes it as soon as the photo has been processed.
• Sign-in session: the sign-in library keeps a session token on your device so you stay signed in.
• Onboarding: a single setting records that you’ve seen the intro screens.

Halcy doesn’t keep a copy of your photo library or journal on the device. Photos are loaded from our servers into memory while you use the app.

4. Service providers and where your data is stored

Halcy is built on Google Firebase, which Google LLC operates on our behalf as a data processor. We use Firebase Authentication (sign-in), Cloud Firestore (entries and account details), Cloud Storage (photos) and Cloud Functions (thumbnails, streaks and account deletion).

Your journal photos and entries are primarily stored in Google Cloud’s asia-south2 (Delhi, India) region. Firebase Authentication, which holds your sign-in record, is processed in the United States, and certain Google infrastructure or subprocessors may process data in other countries. Google’s practices are described in the Firebase privacy and security documentation.

When you sign in, Google or Apple handles the sign-in under its own privacy policy. If you signed in with Google, the app loads your profile picture from Google’s servers.

We do not sell your information or share it with advertisers or data brokers. We disclose information only to the service providers we need to operate Halcy, such as Google Firebase, and where the law requires it, for example in response to a valid legal request. We may also disclose information where it is necessary to protect the rights and safety of our users or others.

5. Security

• All data is encrypted in transit (HTTPS/TLS) and encrypted at rest by Google.
• Your photos can only be retrieved by your signed-in account. Server-side security rules block every other account, and we don’t create public or shareable links to your photos.
• Photos are not end-to-end encrypted. Google holds the storage encryption keys, and a small number of authorised Halcy administrators could technically access stored data through the Firebase console. We do this only when it is needed to run or secure the service, or when you ask us to.

6. How long we keep your information

We keep your account information and photos for as long as you have a Halcy account. Photos from past days can’t be deleted one at a time. This is part of how Halcy works as a journal. Deleting your account removes everything.

When you delete your account, we immediately start deleting your account, photos, thumbnails, entries, streaks and sign-in record from the systems we control. Our infrastructure provider may keep residual copies in its backup and recovery systems for a limited period, in line with its own deletion processes (Google currently describes this as up to about 180 days), after which they are permanently erased. We don’t use or restore from those copies. Technical server logs are kept for up to 30 days and then deleted automatically.

7. Deleting your account and data

In the app

1. Open Halcy and tap your profile picture on the home screen.
2. Tap Delete account.
3. Confirm with Delete everything.

This permanently deletes your account, every photo and thumbnail, all entries and streaks, and your sign-in record, subject to the residual backup copies described in section 6. It can’t be undone.

Without the app

If you can’t use the app, email hello@buntikki.com from the email address linked to your Halcy account and ask us to delete it. We’ll confirm the request and delete the account and all its data within 30 days.

If you used Sign in with Apple, you can also stop Halcy’s access in your device settings under Apple ID → Sign-In & Security → Sign in with Apple. Doing this doesn’t delete your Halcy data, so please delete your account first.

8. Your rights

Depending on where you live and the data-protection laws that currently apply to you, you may have the right to:

• access the personal information we hold about you and get a copy of it,
• correct inaccurate information,
• delete your information,
• object to or restrict certain processing, where applicable,
• withdraw consent, where we rely on your consent, and
• complain to your local data-protection authority.

To use any of these rights, email hello@buntikki.com. We’ll reply within 30 days, and we may ask you to confirm your identity first. We don’t sell or “share” personal information for cross-context behavioural advertising, as those terms are defined under California law.

9. Children

Halcy is not directed at children under 13, and we don’t knowingly collect personal information from them. In some regions a higher minimum age applies. If you believe a child has created an account, contact us and we’ll delete it.

10. Changes to this policy

We may update this policy as Halcy changes. We’ll post the new version on this page and update the effective date above.

11. Contact

Questions or requests about your privacy:
Buntikki Technologies Private Limited · hello@buntikki.com