Privacy policy

Who is responsible

The controller for the processing described here is Andrey Fedyukov, Mecumstraße 52, 40225 Düsseldorf, Germany.

For any question about your data, write to support@hamoji.app. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live.

What we store

• Your account: your email address and, when you sign in with Apple, the identifier Apple gives Hamoji for you. If Apple passes on your first name, it is only offered as the name you choose, and it is erased as soon as you have chosen one.
• Sign-in: the times of your sessions, with the IP address and the user agent of the app that opened them, as the sign-in service keeps them.
• Your profile: the name you chose, your color, your first hamster, the language of the app and — if you give it — your birthday.
• “Cheeky”: whether you turned this set on or off, and your App Store country. If the App Store does not give a country, we use your iPhone’s region instead. This decides whether the set is on until you make your own choice.
• Your pair: when it was formed and, if you enter it, the day you have been together since; when it ended and which of you ended it.
• What you send: each hamster — which one, its mood and outfit — with the note in its envelope if you wrote one, up to 1,000 characters; when it was sent, seen and petted.
• Invitations: the link and the code, the hamster that comes with them — its mood, its outfit and the note, if you wrote one — and when they expire. They are kept until your account is deleted, also after they expire or are replaced. Wrong attempts at a code are counted, to stop guessing.
• Your phones: the token Apple issues for notifications to that phone, whether it runs a test or a store build, and its language, so that a notification arrives in that language.
• Purchases: whether you have Hamoji Plus, until when and whether it renews, and what you have bought on its own; and, when one of you starts buying Hamoji Plus, a note of it, so that the other is not charged as well. Not your card and not your Apple ID — Apple keeps those and shows us neither.

That is the whole list. There is no advertising identifier, no analytics and no tracking in Hamoji.

Before you sign in

Hamoji can be tried without an account: choosing a hamster, a color and a name, petting and dressing your hamster, looking through the collection. All of that stays on your phone. An account is needed for what involves the other person — inviting a partner, sending a hamster — and for buying; what you chose before signing in then moves into the account.

One exception: to show prices and what can be bought, the app asks RevenueCat before sign-in too, under an anonymous identifier of this installation. RevenueCat then receives that identifier, technical data of the phone and its IP address — see Purchases.

Why we process it, and on what basis

To provide what you use Hamoji for: the account and sign-in, the pair and its invitations, sending and receiving hamsters, the calendar you share, notifications, Hamoji Plus and purchases. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

To keep the service safe and working: the limits on sign-in codes and invitation codes, and the short-lived technical logs of our providers. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

To keep, after an account is deleted, the record of its purchases for refunds and questions about them, and to leave with the partner what the deleted account sent them, which is theirs to keep. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Who sees what

A pair is visible to its two people and to nobody else — not to other users, and not to a later partner of either of you.

Your partner sees your name, color and first hamster, the day and month of your birthday if you gave it, everything you sent them, notes included, and the state of your Hamoji Plus: whether you have it, until when, whether it renews and whether you are buying it right now. You see the same of theirs.

No one but you sees the year you were born, your choice for “Cheeky” or your App Store country; your partner sees only whether the set is on for the two of you.

When a pair ends, both of you keep its history to read, and nobody can send into it any more. Each of you can hide past pairs from your own view and show them again; hiding deletes nothing.

Whoever opens your invitation link sees the hamster in it with its mood and outfit, your name and your color, the backup code and the language of your app — not the note — for as long as the invitation is valid. An invitation lasts seven days, and a new one replaces the old. Whoever enters your invitation code after signing in sees the same.

Where the data is

Your data is stored in a PostgreSQL database hosted by Supabase in Frankfurt, Germany (AWS eu-central-1). Every row is protected by row-level security: an account can read only its own data and that of its pairs.

Your phone keeps a copy of your pair and its hamsters, so that Hamoji opens without a network; signing out removes it from the phone.

Pictures of hamsters — the small ones in the calendar, the cards you share, the picture of a month — are drawn on your phone; we do not upload them.

Email

Sign-in codes are sent through Amazon Simple Email Service (Amazon Web Services, Frankfurt, Germany), which receives your email address in order to deliver them. The pictures in that email are loaded from this website when your mail app shows them, so Cloudflare sees the IP address of your mail app. There is no marketing email and no mailing list.

Notifications

Notifications — a hamster has come running, a hamster got petted, your partner has joined — are delivered by the Apple Push Notification service. Apple receives the token of your phone and the text of the notification. The text names no person and no hamster, no mood and never a note: a locked screen can be seen by others.

You can turn notifications off in the settings of your iPhone at any time.

Sign in with Apple

When you sign in with Apple, Apple confirms who you are and passes an identifier to Hamoji, with your email address — which may be a private relay address — and, if you allow it, your name. When you delete your account, Hamoji asks Apple to revoke this sign-in.

Purchases

Hamoji Plus and one-time purchases are bought through Apple’s App Store. The payment, your card and your Apple ID stay with Apple; we never see them.

RevenueCat (RevenueCat, Inc., USA) receives the App Store receipt and the identifier of your Hamoji account — before you sign in, an anonymous identifier of this installation instead — with technical data of the phone and its IP address, and tells the app and our server what you have and until when. RevenueCat processes this data on our instructions as a processor; the transfer to the USA rests on the EU standard contractual clauses.

When you delete your account, the record of its purchases at RevenueCat remains: the identifier your account had — a random string that no longer leads to anything else about you in Hamoji — and the history of its purchases with Apple’s transaction numbers, which Apple keeps as well. It is kept while refunds and questions about these purchases are possible; write to us, and we will erase it sooner.

This website

hamoji.app is hosted on Cloudflare Pages. It sets no cookies and has no analytics. Cloudflare processes the technical data any web server sees — your IP address, the requested address, the user agent — to deliver the page and to protect the service. Each time an invitation page is opened, it fetches that invitation from our server. The time zone Cloudflare infers from the IP address is used only to show the sky and the time of day on the page. None of this is stored.

Who else processes the data

Only the providers named above, each for the one job it does:

• Supabase — the database and the sign-in service;
• Amazon Web Services — sending email, and the infrastructure the database runs on;
• Apple — Sign in with Apple, notifications and payment;
• RevenueCat — processing purchases and the state of Hamoji Plus;
• Cloudflare — this website and the domain.

Some of these providers, or the companies they belong to, are based in the USA. Where data may reach them there, the transfer rests on the EU–US Data Privacy Framework or on the EU standard contractual clauses. We make sure that every provider that receives user data protects it at least as well as this policy describes.

Your data is not sold, not rented, not shared with advertisers and not used to train anybody’s models.

How long we keep it, and what deleting does

We keep your data for as long as your account exists.

Deleting your account (Settings → Account → Delete account) deletes from our server your account with its email address, your name, color and first hamster, your birthday, your choice for “Cheeky” and your App Store country, the notification tokens of your phones, your invitations and code attempts, and the records of your purchases.

What you sent stays with your partner. The hamsters and notes you sent remain in their calendar, without your name and color — as a letter stays with the one who received it. What they sent you stays with them too. When the other person of a pair deletes their account as well, the whole history of that pair is erased.

Deleting your account does not cancel an App Store subscription; cancel it in the subscription settings of your Apple ID. The record of purchases at RevenueCat remains, as described under Purchases.

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest.

Deletion is built into the app: Settings → Account → Delete account. For anything else, write to support@hamoji.app.

Children

Hamoji is made for couples and is not directed at children. It is not intended for anyone under 13.

Changes

When this policy changes, the date at the top changes with it. A change that materially affects how your data is handled will be announced in the app before it takes effect.