Heart Knows Privacy Policy

Effective date: September 18, 2026
App: Heart Knows — relationship journal for iOS and Android

Summary

Heart Knows is a privacy-first, on-device journal. Your meetings, pulses, debriefs, and question notes are stored on your phone in a SQLCipher-encrypted database, and we do not operate a server that receives them. There is no account and nothing to sign in to — the app never asks for a name, email address, phone number or password, and the encrypted journal leaves the device only inside your own phone backup or an export you make yourself.

The database file is included in this phone’s backup unless you turn that off in Settings → Backup. On iPhone, that is Apple’s encrypted iCloud/Finder backup; the key that opens the journal travels with it. On Android, the live file cannot leave the chip, so the app keeps a separate encrypted snapshot that Google Auto Backup can restore onto a new phone. Either way, restoring the phone from backup brings the notebook back without a passphrase. That also means Apple or Google hold a copy that could be restored by anyone with access to that account. Turn the switch off if you do not want that.

A passphrase export is still available if you want a file only you can open.

What we collect

Data	Collected?	Where it stays
Journal entries (people, meetings, pulses, notes)	Yes — you create it	Your device (encrypted). Also in this phone’s iCloud or Google backup unless you turn that off
App lock / biometric preference	Yes	Your device only
Purchase status (subscription or lifetime)	Yes — via Apple/Google/RevenueCat	Billing providers; entitlement flag on device
Install and store details sent to RevenueCat (anonymous install identifier, device model, OS version, locale, store country)	Yes — on every launch, whether or not you ever buy anything	RevenueCat
Diagnostics preference (on or off)	Yes	Your device only
Crash diagnostics (redacted error summary, Dart stack trace, app/device metadata)	In release builds when Firebase is configured and diagnostics are on	Firebase Crashlytics
Feedback emails	Only if you choose to send one	Your email client → our support inbox
Analytics events (onboarding and purchase-funnel actions, plus Firebase default install, session, and engagement events)	In release builds when Firebase is configured and diagnostics are on	Firebase Analytics
Session and installation records (random Firebase installation ID, bundle ID, OS and SDK version, network type, time in foreground)	In release builds when Firebase is configured and diagnostics are on	Firebase (Installations, Sessions)
Voice dictation audio and transcript	Not collected. Recognised on this device only when you tap the dictate button; the audio is never stored or uploaded, and the text lands in your encrypted journal	Your device only
Face ID / passcode	Not collected. iOS performs the check and tells the app only whether unlock succeeded	Your device only
Check-in reminders	Scheduled and shown by this phone; nothing is sent to a push server	Your device only

We never collect person names, pulse values, debrief text, or question answers — not for analytics, not for advertising, and not inside a crash report.

How crash reports are redacted

A crash report is not the error object. Before anything is transmitted, the error is reduced to a fixed set of fields:

the error's type (for example SqfliteDatabaseException)
which operation was running, chosen from a fixed list in our code (for example draft_save)
an sqlite result code, where there is one (for example 787)
a Dart stack trace, which is file, class and line numbers from our own code

Error messages are not included. This matters because a database error message can otherwise carry the statement that failed along with the values bound to it — which, for a failed draft save, would be the text of your debrief. Nothing derived from an error message, and no widget or screen contents, reaches Crashlytics.

Dictation, Face ID and reminders

Dictation (microphone and speech recognition). Typing is the default; dictation is offered as a button. The first time you tap it, iOS or Android asks for microphone and speech-recognition permission — the app never asks at launch. Recognition is forced to run on the device (on iOS, requiresOnDeviceRecognition); if the phone cannot recognise speech locally, dictation is simply unavailable and you keep typing. There is no cloud fallback, so the recording of your voice is never uploaded to us, to Apple, or to Google by the app, and no audio is kept once the words appear in the text field. The transcript is ordinary journal text and is protected the same way.
App lock (Face ID, Touch ID or passcode). Off until you turn it on. The check is done by the operating system, which returns only pass or fail; the app never sees, stores or transmits biometric data.
Check-in reminders. Optional local notifications scheduled on the phone. There is no remote push service, and no reminder is sent through a server.

Turning diagnostics off

Settings → Privacy and lock → Share diagnostics. It is on by default in release builds. Crash reports and analytics events may be sent as described above. Switching it off stops crash reports and analytics events at once — including the native Crashlytics and Analytics collection — and the choice is stored on your device. Journal content is never included. Two things are not covered by this switch: subscription billing may still sync with Apple, Google, and RevenueCat to validate purchases, and the RevenueCat SDK still sends the install and store details listed above at launch.

Identifiers

The app has no user ID. The only identifiers involved are random, per-install values generated by the SDKs themselves: RevenueCat's anonymous app user ID, the Firebase installation ID and Google Analytics app-instance ID, and Crashlytics' installation UUID. None of them is derived from your name, email, phone number, Apple ID or Google account, none is the advertising identifier (IDFA) or vendor identifier (IDFV), and we do not join them to any other data set. We do not use them, or anything else, to track you across other companies' apps or websites, and the app has no App Tracking Transparency prompt because it does no tracking.

How long data is kept

Journal: on your device until you delete it (Settings → Delete all data), plus whatever your own phone backups or exports hold.
Crash reports: Firebase Crashlytics keeps crash stack traces and the associated installation identifiers for 90 days, then begins deleting them.
Analytics events: kept under Google Analytics' data-retention setting for our Firebase project, which we leave at the default (user-level event data for two months; aggregate reports longer). Turning diagnostics off stops new events immediately.
Firebase installation ID: retained until we ask Firebase to delete it, after which it is removed within 180 days. Email us to trigger that.
Purchase records: RevenueCat and the app store keep the anonymous purchase record for as long as it is needed to honour your subscription or lifetime purchase, and afterwards as their own policies require. There is nothing in it but the store transaction and the anonymous install identifier.
Feedback email: kept in our support inbox until the conversation is resolved, then deleted on request.

How we use data

Run and protect your encrypted notebook on the device
Validate Active journey / Lifetime keep purchases through the app stores
Diagnose crashes and understand aggregate onboarding and purchase-funnel performance

Third parties

Apple App Store / Google Play — subscription and lifetime purchase processing
RevenueCat — receipt validation and entitlement sync. The RevenueCat SDK starts when the app launches, not when you open a purchase screen, so it receives an anonymous install identifier together with your device model, OS version, locale and store country on every launch — including for people who never buy anything and never see a price. We do not enable RevenueCat's device-identifier collection, so it does not receive your device's advertising identifier (IDFA) or vendor identifier (IDFV), and it receives no journal data.
Google Firebase — redacted crash diagnostics and four custom funnel events (onboarding complete, paywall shown, purchase started, purchase completed), only while diagnostics are on. Automatic screen-view reporting is off. Firebase may still record default install and session events while diagnostics are on. Never journal content
Email — if you contact support via mailto

No third party receives your journal content, and this app does not upload your journal database to our servers. Apple's Face ID and on-device speech recognition run inside iOS on your phone; the app does not send anything to Apple for either feature. Phone backup is the exception you control: Settings → Backup is on unless you turn it off. On iPhone, iOS copies the database into your Apple device backup. On Android, Google Auto Backup may hold an encrypted snapshot plus the secret that opens it. That is Apple or Google storing it under your account, not us sending it.

Your choices

Diagnostics: Settings → Privacy and lock → Share diagnostics (on by default in release builds; when off, no crash or analytics data is sent)
App lock: Settings → Privacy and lock. Off until you turn it on. When on, Face ID or your device passcode unlocks the app when it launches or returns from the background. There is no separate in-app PIN and no idle timeout.
Phone backup: Settings → Backup → Back up with this phone (on by default). Restoring the phone from iCloud or Google brings the notebook back. Turn it off to keep the notebook only on this device. See the Summary.
Export: Settings → Backup → Export encrypted backup (you control where the file goes). The copy is re-encrypted with a passphrase you choose, using SQLCipher's own key derivation. Your device key is not included in the export and is not needed to open it, so this is a real restore path: Settings → Backup → Restore from a backup, or Restore on the first intro screen, will open the file on a different phone. The passphrase is therefore the only way in. Nobody holds a second copy of it — not us, not Apple, not Google — and there is no reset. If you lose the passphrase, that backup is permanently unreadable.
Lost device key: If this phone can no longer open the on-device database (for example after a security reset that destroyed the keystore key), the app shows an unrecoverable screen. On Android, an automatic Google-backup snapshot is applied first when one is present. A passphrase file still cannot be opened from that screen. Restore while the app still opens, or restore the phone from backup.
Delete: Settings → Delete all data destroys the journal and its encryption key on this device. It does not cancel a store subscription — manage or cancel that in iOS Settings or Google Play. RevenueCat and Firebase may keep anonymous install, purchase, and diagnostic records. Email 132.rishabh@gmail.com to request deletion of those vendor records; there is no Heart Knows account to delete.
Subscriptions: Manage or cancel in iOS Settings or Google Play subscriptions

App Store privacy label

For readers comparing this policy with the App Store "App Privacy" section: the label declares Crash Data, Other Diagnostic Data, Product Interaction and Purchase History — all not linked to you and not used for tracking — and nothing else. Voice dictation, Face ID and reminders appear nowhere on it because none of them collects data from the device. Journal content is not declared because it is never collected.

Children

Heart Knows is intended for adults 18 and older. We do not knowingly collect data from anyone under 18.

Changes

We will update this policy when practices change. The effective date at the top will change accordingly.

Contact

Questions about privacy: 132.rishabh@gmail.com.