Contact support@hakawati.net with privacy questions and requests.
Accounts are optional: you can play with tales kept only on your device.
What we collect and why
- Accounts: a verified email and password are required to register. Our sign-in service uses self-hosted Logto. We also store your account ID and profile details, such as a display name, to identify your account and published scenarios.
- Devices: a generated device identifier, device name, platform, and app version help connect your devices and manage sync.
- Cloud saves: when you enable sync, we receive tale text, state, settings, and covers to save your progress across devices. New tales sync unless you choose to keep them on your device.
- Catalog submissions and reports: we process scenarios, covers, creator names, reports, and moderation decisions to run the public catalog.
- Service and security records: connection details such as IP addresses, plus errors and account activity, help us troubleshoot and prevent abuse.
- Support messages: we receive the email address, message, and attachments you send us to handle your request.
We use this information to provide the hosted features you request under the Terms of Service, to protect the service and its users, and to meet legal obligations.
Private and public content
Private tale text and state are encrypted in storage, but not end-to-end: the server can decrypt them to provide sync. Private covers use restricted download links.
Published scenarios and your creator name are public. Other users can download copies that remain after you remove the original.
Scenario text and cover images submitted to the catalog are sent to GLM hosted by DigitalOcean for automated moderation. Private tales are not sent for moderation. You can appeal a moderation decision by email.
Story generation and voice features send the relevant text or audio to the providers you configure. Those providers have their own privacy practices; check them before sending sensitive content.
Service providers and locations
- DigitalOcean: the server, account database, file storage, encrypted backups, and hosted moderation model. The server, database, and storage are in Frankfurt, Germany, but some DigitalOcean processing, such as model inference and support access, may happen elsewhere.
- Resend: account verification and service emails, including recipient addresses and delivery information.
- Namecheap Private Email: our support mailbox and the messages you send it.
- Cloudflare: website hosting and delivery, which processes connection information when you visit.
These providers may process information internationally, including in the United States. The website also loads fonts from Google and release information from GitHub, so those services receive your connection information. Your chosen story and voice providers may operate in other countries.
We may also disclose information when required by law or necessary to investigate abuse and protect users. We do not sell your personal data.
Storage and retention
We keep account information and uploaded content to provide your account and the features you use. You can delete cloud tales or unpublish catalog scenarios in the app. Unpublishing hides a scenario from the catalog but keeps its stored submission; email us to have it deleted. Turning sync off does not delete copies already uploaded.
Security, moderation, and support records are kept for as long as needed to resolve requests, investigate abuse or disputes, and meet legal obligations. Operational logs rotate by size.
Encrypted backups keep seven daily, four weekly, and three monthly restore points. Older backups are pruned after successful verified backup runs, so interruptions can extend retention. Deleted data may remain in backups until they are pruned.
The app stores your settings, local tales, and sign-in information on your device. The website stores your theme choice and cached release information in your browser.
Your choices and requests
Email support@hakawati.net to request access to, a copy of, correction of, or deletion of your personal data, including deleting your account, or to raise a privacy concern. Send account requests from your registered email when possible. We may ask for information needed to verify ownership; do not send your password or AI provider keys.
If we must keep some information or cannot fully complete a request, we will explain why. You can withdraw consent where processing relies on it; this does not change the lawfulness of earlier processing. You can also complain to your data-protection authority.