Effective date: [effective date]
Hako is a study app run by [legal operator name] (“Hako”, “we”, “us”), who is the data controller for the information described here. This policy covers the Hako app for iPhone and iPad and the website at hakostudy.com.
The short version
- We collect what Hako needs to work: your account, your study data, and what you share with friends and rooms.
- No ads, no tracking across other apps or websites, and we never sell your information.
- Your data is stored in the European Union.
- You can delete your account, and everything linked to it, from inside the app at any time.
What we collect and why
Account
Your email address, an account ID, how you sign in (Apple, Google, or email and password), your username, and your chosen avatar. We need these to create your account, sign you in, and show you to the people you study with. Passwords are stored only as secure hashes by our authentication provider; Apple and Google sign-in credentials never reach us.
Study data
The subjects, tasks, countdowns, study sessions and study time, daily goals, streaks, achievements, and reflection notes you create. We use them to sync Hako across your devices and to calculate your statistics and progress.
Friends, rooms, and messages
Friend requests and connections, study invitations, the rooms you create or join, the messages and reactions you send in rooms, group study sessions, and your live study status. We use these to run the social features.
Safety
Reports you make or that are made about you (including a copy of a reported message), users you block, and moderation decisions about your account. We use these to keep Hako safe.
Activity
When you sign in and when your account was last active, such as when the app last refreshed your sign-in or synced study data. We use this for security, support, and to understand whether accounts are in use.
Notifications
If you allow notifications, a push token for your device and your notification settings, so reminders, invitations, and friend and room updates can reach you.
Study blocking (Screen Time)
If you use study blocking, you choose apps and websites through Apple’s Screen Time. Apple gives Hako only anonymous tokens for your choices, and they stay on your device. We never see or receive which apps or websites you chose or how you use them.
Purchases
If Hako offers paid features, purchases are handled by Apple. We receive the subscription status and transaction details needed to unlock them, never your payment card details.
Launch list
If you join the launch list on hakostudy.com, we store your email address and when you signed up and confirmed. We send one confirmation email, and once you confirm, we use the address only to tell you when Hako launches. Every email has an unsubscribe link, and you can ask to be removed at any time by emailing hello@hakostudy.com. We delete the list once the launch announcement has gone out. The legal basis is your consent.
Who can see your information
- Everyone using Hako can find you by username and see your username and avatar.
- Your friends can see when you’re studying, the subject, and your study time for the day.
- Members of rooms you join can see your username, avatar, messages, reactions, study time for the day, and group study activity in that room.
- Hako’s operator can see account details (including email), study totals, activity, rooms and their messages, and reports, to review reports, enforce our Community Guidelines, answer support requests, and keep the service secure. This access is limited to the operator, protected by sign-in and an allowlist, and used only for these purposes.
Service providers
We use a small number of providers who process information on our behalf, only to provide their service to us:
- Supabase: accounts, database, real-time sync, and server functions. Data is stored in the EU (Ireland).
- Apple: app distribution, Sign in with Apple, push notifications, and purchases.
- Google: Sign in with Google, if you choose it.
- Resend: sending account emails, such as security alerts, and launch list emails.
- Cloudflare: hosting this website.
Some of these providers may process information outside the European Economic Area. Where they do, the transfer is protected by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Legal bases
Under the GDPR we rely on: performing our contract with you (running your account and the features you use); our legitimate interests in keeping Hako safe, secure, and working well (safety reports, moderation, security, and activity information); your consent where we ask for it (such as notifications, which you can turn off at any time); and legal obligations.
How long we keep it
We keep your information while your account exists. When you delete your account, it and everything linked to it is deleted from our live database immediately: your profile, study data, friends, invitations, room memberships, messages and reactions, rooms you own (including their chat), and reports by or about you. Copies in our providers’ routine backups are removed as those backups expire. Website server logs are kept by Cloudflare for a short period for security.
Your rights
You can access, correct, export, or delete your information, object to or restrict how we use it, and withdraw consent. You can do much of this in the app: edit your profile and study data, export your study sessions in Settings → Sync & data, and delete your account. For anything else, email privacy@hakostudy.com. You also have the right to complain to your local data protection authority.
Children
You must be at least 13 years old to use Hako, and older if your country requires parental consent for online services at your age. If you believe a child has created an account without that, contact us and we will delete it.
The website
The public pages of hakostudy.com use no cookies, analytics, or tracking. Cloudflare processes your IP address and request details to deliver and protect the site. The private admin area uses a sign-in cookie for the operator only.
Security
Information is encrypted in transit, protected by database access rules that let each person reach only their own data, and the operator’s access requires a separate sign-in. No online service can promise perfect security, but we work to protect your information and will tell you if a breach affects you where the law requires.
Changes
If we change this policy in a meaningful way, we’ll update the date above and tell you about it in the app or by email before it takes effect.
Contact
[legal operator name]
[contact address]
privacy@hakostudy.com