Your Data Is a Temple
HEKA Calendar is built on a local-first covenant: by default, everything lives on your device. When you choose cloud, enterprise, or AI features, your data is handled by secure server-side services we control — never sold, never mined, and always auditable.
Data Storage
Your notes, journal entries, birth charts, tracker data, and app preferences are stored in an IndexedDB database on your device using Dexie.js. We cannot access this data, we do not back it up, and it cannot be recovered if you lose your device unless you have enabled cloud sync or performed a manual export.
| Data Type | Purpose | Storage |
|---|---|---|
| Daily Notes | Calendar day notes with categories and timestamps | Device Only |
| Journal Entries | Oracle Journal entries with markdown, tags, mood, and revision history | Device Only |
| Birth Charts | Astrological profiles, natal charts, and transit calculations | Device Only |
| Daily Oracle Cards | Generated oracle cards, celestial snapshots, and draw history | Device Only |
| Reflection Data | Daily mood, rest quality, vitality, and custom reflections | Device Only |
| App Settings | Theme, location, zodiac preferences, notifications, language | Device Only |
| Notifications | Task reminders, celestial alerts, tracker reminders, daily reflections | Device Only |
| Search Index | Full-text search index of journal entries for fast lookup | Device Only |
| PDF Export | Print-to-PDF output generated locally | Device Only |
| Cloud Sync Data | Copy of selected data for cross-device sync (encrypted in transit and at rest) | Firebase Firestore |
| Push Token | FCM device token for optional push notifications | Firebase (opt-in) |
| Community Voting | Feature requests, holiday submissions, energy voting | Cloud (with UID) |
| Social Data | Friends, messages, task shares, online presence (Cosmic Circle) | Cloud (Firebase Firestore) |
GDPR & CCPA Compliance
What Runs in the Cloud
When you enable cloud synchronization, HEKA Calendar uses serverless Firebase Functions deployed in australia-southeast1. These functions never read your local IndexedDB; they only process data you explicitly send to the cloud.
Account Deletion
The deleteUserData function removes your Firebase Auth account, Firestore documents, subcollections, and shared-data references, then writes an immutable audit log. This ensures deletion is complete and verifiable.
Cloud Synchronization
Sync functions replicate your notes, journal entries, and preferences between your devices via Firebase (encrypted in transit with TLS; Firebase encrypts stored data at rest). HEKA Calendar is free during testing and contains no subscriptions, in-app purchases, or payment processing of any kind.
Enterprise SSO
The samlLogin and oidcLogin functions verify SAML assertions and OIDC tokens from your organization’s identity provider, create or link your Firebase user, and set enterprise-tier custom claims. Every SSO login is written to an immutable audit log.
Data Categories
📓 Journal & Notes
Calendar notes and Oracle Journal entries including text (plain or markdown), tags, mood ratings, timestamps, and revision history. Stored in IndexedDB with a full-text search index. AI insights use on-device template analysis by default.
🌙 Daily Oracle
One card per day is generated from a real-time celestial snapshot (moon phase, planetary positions, retrogrades, dominant element) computed on-device using Swiss Ephemeris WASM. If you have a birth chart, a personalized note connects the card to your natal Sun sign. Cards and draw history are stored locally.
📊 On-Device Analytics
Tutorial progress, onboarding funnel completion, and pattern recognition events are tracked strictly on-device to improve the user experience. These analytics are never transmitted to external servers. We do not use Google Analytics, third-party advertising, behavioral tracking cookies, or device fingerprinting.
🔔 Notifications & Push
Task reminders, celestial alerts, and tracker reminders are scheduled as local notifications on your device — their content never leaves your phone. If you enable push notifications, the app registers a device token with Firebase Cloud Messaging (Google) so cloud events (such as Cosmic Circle activity) can reach you. The token is deleted when you delete your account.
🎵 Ambient Audio
The Ambient Music feature synthesizes its six generative scores live on your device with the Web Audio API — there are no audio files to download and nothing is streamed or uploaded. The app never accesses your microphone and never records audio.
📱 Android Permissions
The Android app declares only the permissions its features require: Internet (weather, APIs, optional cloud sync), precise & approximate location (on-device sky calculations, weather, sun times), notifications (reminders and optional push), vibrate (interaction feedback), exact alarms (reliable reminder timing), and boot completion (re-scheduling reminders after reboot). The app does not request camera, microphone, contacts, call logs, or external storage access.
Your Inner Life Stays Yours
HEKA Calendar is not a medical or health application and does not collect health, fitness, cycle, or fertility data of any kind. Your notes, tasks, journal entries, and optional mood markers are personal reflections — not health records.
All reflection data is stored locally on your device by default. If you enable cloud synchronization, this data is transmitted over an encrypted connection (TLS) and stored in Firebase, which encrypts it at rest, and it is deleted permanently when you delete your account.
On-device insights: streaks, mood summaries, word counts, and the insights shown in your Journey view are computed entirely on your device using local algorithms. No reflection content is sent to external servers for analysis.
LLM Processing
HEKA Calendar offers optional AI-powered features. AI enhancement is entirely opt-in and disabled by default. Without enabling it, all insights, coaching, and analysis use on-device template-based generation — no data leaves your device.
When AI is enabled through the HEKA AI Proxy (hosted on Vercel), your request is sent to our backend, which verifies your Firebase identity, applies per-user rate limits, and forwards the prompt to the selected provider (Groq, OpenAI, Anthropic, or Moonshot) using server-side API keys. The proxy keeps sanitized audit logs for abuse monitoring and rate-limiting; logs truncate message content and redact obvious email addresses.
Advanced users may still connect their own provider API key; in that case, the request is sent directly from the device to the chosen provider and is governed by that provider’s terms.
Sentiment analysis of journal entries is performed entirely on-device using a local lexicon — no text is transmitted for this purpose.
Celestial Features
The Daily Oracle generates one personalized card per day based on a real-time celestial snapshot. Planetary positions, moon phase, retrogrades, and dominant elements are computed on-device using Swiss Ephemeris WASM. No astronomical data is transmitted to external servers.
Weather data is fetched from Open-Meteo (open-meteo.com) using your
latitude and longitude. Sunrise and sunset times are fetched from NOAA Sunrise-Sunset
(sunrise-sunset.org) using the same location. These services receive only coordinates —
no identifying information.
Location: Your location is stored locally and used for astronomical calculations, weather, and sun times. On Android the app may request precise location permission to auto-detect your position; the resulting coordinates are used on your device and are sent only to the two coordinate-based APIs described above — never to our servers. It is never shared with third parties beyond those API calls.
Cosmic Circle
The Cosmic Circle enables social features including friend connections, messaging, task sharing, and collaborative rituals. Social data is stored in Firebase Firestore and requires cloud sync to be enabled.
What is stored: Friend profiles and friendship connections, direct messages, shared tasks and task rituals, online presence and last-active status, invite codes and deep links, community holiday submissions, and feature voting (both associated with your Firebase Auth UID).
Shared tasks create public Firestore documents accessible via share code. They include the task details and creator display name. Energy voting uses a locally-generated device ID for anonymous daily participation.
Crisis Detection
To help protect user safety, journal entries are scanned on-device for crisis indicators including references to self-harm, suicide, severe depression, and violence. This scanning uses a local keyword list and occurs entirely on your device — no journal text is transmitted for this purpose.
If concerning language is detected, the app displays local support resources such as the 988 Suicide & Crisis Lifeline and Crisis Text Line. No alerts are sent to us or any third party. This is a user-safety feature designed to provide immediate access to help.
External Providers
🔥 Firebase (Google Cloud)
Cloud sync, authentication, push notification delivery, and Cloud Functions are hosted on Firebase / Google Cloud in australia-southeast1. Cloud data is encrypted in transit (TLS) and at rest by Google Cloud. Your on-device calendar state is additionally encrypted at rest with a key generated and stored on your device.
🛡️ Crash Reporting
When crash reporting is enabled, anonymized crash and error diagnostics are sent to Sentry (or Firebase Crashlytics on native builds when configured) to help us fix defects. Reports contain technical diagnostics only — never journal entries, notes, birth charts, or reflection content — and are retained for up to 90 days.
⚡ Vercel
The HEKA AI Proxy runs on Vercel. It verifies Firebase tokens, enforces rate limits, forwards AI requests to providers, and writes sanitized audit logs. Provider API keys are stored as Vercel environment variables, never in the client.
🔭 Swiss Ephemeris
Astronomical calculations run entirely on your device via WASM. No birth chart data, location, or personal information is transmitted for astrological computation.
🌤️ Open-Meteo
Weather data is fetched from open-meteo.com using your latitude and longitude.
No API key is required. No identifying information is transmitted.
🌅 NOAA Sunrise-Sunset
Sun rise and set times are fetched from sunrise-sunset.org using your
coordinates. No identifying information is transmitted.
🤖 LLM Providers (Opt-In Only)
Groq, OpenAI, Anthropic, or Moonshot — only when you enable AI. By default requests are routed through the HEKA AI Proxy using server-side keys. Advanced users may connect their own key and send requests directly.
🔤 Google Fonts
The Print-to-PDF feature loads Playfair Display and other fonts from Google's CDN
(fonts.googleapis.com) for styled PDF output.
What We Don't Do
We Don't Use:
- Google Analytics
- Third-party advertising
- Behavioral tracking cookies
- Device fingerprinting
- Selling your data
Network Requests:
- 1.App updates (manual)
- 2.Cloud sync (if enabled)
- 3.Weather & sun times (coordinate-only)
- 4.HEKA AI Proxy (opt-in only)
- 5.Community & social (if enabled)
- 6.Push token registration (if notifications enabled)
Age Requirements
HEKA Calendar is not directed to children under 13 years of age. We do not knowingly collect, use, or disclose personal data from children. The app contains wellness tracking features that are intended for adult users. If you believe a child has provided personal information through our services, please contact us immediately for deletion.
Cross-Border Transfers
By default, all data remains on your device in your jurisdiction. If you enable cloud synchronization, encrypted data is stored on Firebase servers in australia-southeast1. For any transfer outside the European Economic Area, we utilize EU Standard Contractual Clauses and maintain appropriate safeguards.
Updates
We may update this privacy policy from time to time to reflect changes in our practices, features, or legal requirements. We will notify you of significant changes through the app or via email if you have provided one. Continued use of HEKA Calendar after changes constitutes acceptance of the updated policy.
Questions?
Last Updated: October 20, 2026