KAI · HANA

Privacy Policy

Last updated: September 19, 2026.

This policy covers all apps developed by KAI HANA LLC (“Kai Hana,” “we,” “us”). It applies to your use of any of our apps and the supporting backend services we operate. By installing one of our apps, you agree to the practices described below.

Apps covered by this policy

This umbrella policy currently covers:

  • RateGlance — currency rate viewer with alerts and home-screen widgets.
  • Kaia — personal assistant for iOS and Android.
  • ClearCast Weather Now — calm, focused weather for iOS and Android.
  • AutoPilot — Android automation tool.
  • AllDay — task manager with a read-only calendar overlay, for iOS and Android.
  • Until — event countdowns with reminders, widgets, and optional sharing, for iOS and Android.
  • AdWall — DNS-based ad, tracker, and malware blocker, for Android.
  • Crescent — haptic-guided breathing, meditation, and sleep, for iOS and Android.
  • Inkpaw — pet health records, reminders, and memories, for iOS and Android.

When we ship new apps, we’ll add them here.

Per-app data practices

Detailed data practices for each app. Where a per-app section says something different from the umbrella sections below, the per-app section takes precedence.

RateGlance

  • Cloudflare Worker backend. RateGlance is the one Kai Hana app that uses a server. The backend runs on Cloudflare Workers + D1 and exists to (a) check ECB rates hourly on your behalf when you have a Pro alert armed, and (b) verify in-app purchase receipts.
  • Device token. On first launch, RateGlance generates a random ID, stores it in iOS Keychain or Android Keystore, and registers it with the backend so we know which install owns which alerts. The token is not tied to any other identifier we hold about you and cannot be linked to a real-world identity.
  • Push notification token. When you grant notification permission, your APNs (iOS) or FCM (Android) push token is stored alongside your device token and used to deliver alert pings via the Expo Push API (exp.host). RateGlance is the only Kai Hana app that uses remote push.
  • Alert configuration (Pro only). When you arm a Pro alert, your chosen currency pair, target rate, and direction are stored on the backend so the hourly cron can check them. Free-tier alerts are checked on-device only and never sent to the server.
  • In-app purchase receipts. Apple StoreKit / Google Play Billing receipts for the pro_unlock purchase are forwarded to the backend, which calls Apple’s verifyReceipt endpoint (production or sandbox) or Google Play Developer API (androidpublisher.googleapis.com) to verify. We store the resulting transaction identifier so the same receipt cannot be re-redeemed on a different device. We never see your payment details.
  • Rate sources. Rates come from Frankfurter (api.frankfurter.dev, ECB-authoritative for about 30 major currencies) and Fawazahmed (latest.currency-api.pages.dev, used for the long-tail currencies). Neither receives any data about you — only currency codes.
  • No ads. RateGlance does not show ads. The app is supported only by the optional one-time RateGlance Pro upgrade.
  • No analytics, no account. Beyond the device token, push token, optional alert configuration, and one-shot IAP receipt above, the backend has no record of you. There is no sign-up, no email, no profile.
  • Local data. Watched pairs, currency history cache, alert preferences, and Pro entitlement are stored in the app’s encrypted SQLite database and deleted on uninstall.

ClearCast Weather Now

  • Cloudflare Worker backend. ClearCast v1.1 and later uses a Kai Hana–operated Cloudflare Worker (with a D1 database) for three things: (a) proxying Apple WeatherKit and OpenWeatherMap so paid API credentials stay off your device, (b) registering for cloud-delivered notifications, and (c) running the server-side cron that dispatches scheduled morning/evening briefings. Locations, forecasts, and settings cached on the worker are keyed to a random per-install user ID, not to a real-world identity.
  • Location (optional). ClearCast can request permission to use your device’s location to fetch local forecasts and severe-weather alerts. Permission is requested at onboarding and can be revoked at any time from your operating system’s settings. You can use ClearCast without granting location permission by saving cities manually.
  • What leaves your device.
    • Approximate latitude/longitude (rounded to ~0.1°) → our Cloudflare Worker → Apple WeatherKit, for forecasts.
    • Approximate latitude/longitude → our Cloudflare Worker → OpenWeatherMap, for air-quality data.
    • Latitude/longitude (four-decimal precision) → US National Weather Service (api.weather.gov), called directly from your device, for active alerts. US users only.
    • City search queries you type → our Cloudflare Worker → OpenWeatherMap’s geocoding endpoint.
    • Reverse geocoding (turning your current coordinates into a place name) is handed to your operating system’s geocoder rather than to us or to a weather provider. Depending on your platform and OS version, that lookup may be answered on-device or by Apple or Google; either way the coordinates go to your OS vendor under its own privacy policy, and Kai Hana neither performs nor sees this step.
  • Push notifications and server-side briefings (optional). If you turn on severe-weather alerts, daily/evening briefings, or custom alerts, ClearCast registers with the backend. The registration includes:
    • A random per-install user ID (not tied to a real-world identity).
    • Your APNs (iOS) or FCM (Android) push token, used to deliver the notifications.
    • Your active location (lat/lon) and UTC offset, so the server-side cron knows when “morning” is for you and which forecast to attach.
    • Your notification preferences (briefing times, units, time format, whether custom alerts are on).
    • A boolean indicating whether you have ClearCast Pro. Push messages are delivered via APNs (iOS) and FCM (Android) directly to your device. The data above is stored in the worker’s D1 database and is overwritten on every refresh. Turning notifications off in the app sends an /unregister request and clears the row.
  • In-app purchases. ClearCast Pro receipts are handled by Apple StoreKit or Google Play Billing. ClearCast does not transmit receipts to any Kai Hana server; the Pro entitlement is stored locally.
  • No ads. ClearCast no longer shows ads. The free-tier AdMob banner was removed in v1.1; the app is supported only by the optional one-time ClearCast Pro upgrade.

Kaia

  • No Kai Hana backend. Kaia does not communicate with any server operated by Kai Hana. All chat, settings, and entitlement state stay on your device.
  • No device token, no analytics. The “Information collected automatically” items in the umbrella section below — device token, push notification token — do not apply to Kaia. Kaia generates no device identifier, registers no push token, and contains no analytics, crash-reporting, or advertising SDKs of any kind. Per the precedence rule above, this Kaia section governs.
  • On-device language model. Kaia runs its language model locally using Google’s LiteRT-LM. The text of your prompts and Kaia’s responses is never sent to a remote inference service.
  • Voice input (optional). Kaia can request microphone access for voice input. Speech-to-text is performed on-device by your operating system; audio is not uploaded. Permission can be revoked at any time from your OS settings.
  • Location (optional). On iOS and Android, Kaia can request approximate location to answer questions about nearby places. Coordinates are used in-session only — not stored, not transmitted to Kai Hana.
  • Model downloads. When you choose a model, Kaia downloads the model file from the Hugging Face CDN (huggingface.co). The request includes standard HTTP metadata (IP, user agent). No account or identifier is attached.
  • Web search tool. When you invoke Kaia’s web-search ability, your search query is sent to a third-party search provider — either Brave Search (api.search.brave.com) or Tavily (api.tavily.com), depending on your Kaia settings. These providers receive your query and standard HTTP metadata; their handling is governed by their own privacy policies.
  • Chat history. Stored locally in an encrypted SQLite database (AssistantDatabase). Deleted when you uninstall the app.
  • In-app purchases. Kaia Pro is handled by Apple StoreKit (iOS) or Google Play Billing (Android). Entitlement is stored locally; Kai Hana does not see your purchase data.
  • Inter-app integration. Kaia exposes a signature-protected interface so the AutoPilot app (also from Kai Hana, signed with the same key) can request inference locally. Apps signed with other keys cannot use this interface.

AutoPilot

  • No Kai Hana backend, no analytics. AutoPilot has no user accounts, no cloud sync, and no telemetry — there are no analytics or crash-reporting SDKs of any kind. Your automations and their data stay on your device. The only times AutoPilot touches the network are Google Play Billing (for the Pro upgrade) and any HTTP-request action you build yourself (see below).
  • Why it requests permissions. AutoPilot is a general-purpose automation tool: it fires user-authored actions in response to user-selected triggers. Each permission backs a specific trigger or action that you opt into when you build an automation. Permissions are not used unless an automation you created requires them. Many triggers (screen on/off, battery, charging, Wi-Fi, Bluetooth, headset, shake, time) rely on ordinary system signals and sensors that need no sensitive permission.
  • Notification Listener. Required for the “notification received” trigger. Notification metadata (app, title, text) is matched against your conditions in memory and is not stored or transmitted.
  • Location (foreground only). Required for geofence enter/exit triggers and sunrise/sunset timing. AutoPilot does not request background location or activity recognition. Coordinates are handled on-device by Android’s geofencing service and are never sent to Kai Hana.
  • Calendar. Required for the “calendar event” trigger. Event data is matched against your conditions on-device.
  • Bluetooth. Required for Bluetooth connect/disconnect triggers.
  • NFC. Required for the “NFC tag” trigger.
  • Camera. Required only for the flashlight/torch and take-photo actions, and used only while such an action runs.
  • System-control actions. Do-Not-Disturb, ringer, and volume changes (notification-policy access); screen brightness (WRITE_SETTINGS); and force-stopping an app (KILL_BACKGROUND_PROCESSES) back the corresponding actions you can add. Time triggers use exact-alarm scheduling, and the always-on engine runs as a foreground service that re-arms your automations after a reboot.
  • HTTP-request action (optional). AutoPilot includes an action that sends an HTTP request to a URL you configure (for example, a webhook), with a method and body you define. This is the one outbound network path AutoPilot itself can make, and it runs only when an automation you built triggers it. The destination receives whatever you put in the request; nothing is routed through Kai Hana, and requests to private or loopback addresses are blocked.
  • WRITE_SECURE_SETTINGS. Used only if you grant it via ADB; enables the optional “wireless debugging auto-reconnect” feature, which communicates solely with your device’s own local ADB endpoint (127.0.0.1). Not requested at runtime.
  • Automation data. Your automation definitions, run history (if enabled), and settings are stored locally and deleted on uninstall. There is no cloud sync, and your automation definitions, run history, and Pro entitlement are excluded from Android’s cloud backup and device-transfer.
  • Inter-app integration. AutoPilot’s optional “Ask Kaia” action calls the sibling Kaia app via a signature-protected interface; the prompt is passed to Kaia on-device. If you enable web search for that action, Kaia may use its own web tools as described in Kaia’s section above.
  • In-app purchases. AutoPilot Pro is handled by Google Play Billing. Entitlement is cached locally (encrypted preferences). Kai Hana does not see your purchase data.

AllDay

  • On-device by default. Your tasks, lists, settings, activity history, and a local cache of your device-calendar events are stored only on your device. There are no user accounts and no sign-up. Lists you don’t share never touch the network.
  • Calendar (optional, read-only). With your permission, AllDay reads your existing device calendar so it can show your events alongside your tasks. It never creates, edits, or deletes calendar events, and the event details it displays are cached locally and never sent to Kai Hana. (On Android, the calendar library requires the write-calendar permission in order to read; AllDay does not use it to write.)
  • Voice capture (optional). AllDay can request microphone access to turn speech into a task. Speech-to-text is performed on-device by your operating system; audio is not uploaded. Permission can be revoked at any time from your OS settings.
  • Notifications (local). Every notification you see from AllDay — task reminders, daily/weekly/monthly briefings — is scheduled and composed entirely on your device. No reminder content is ever sent through a server. The one exception is silent: when you use a shared list, our sync server sends a content-free background push (it carries only “this shared list changed”) so your other devices know to fetch the update. It displays nothing and contains none of your task data.
  • Shared lists (optional). If you choose to share a list, AllDay syncs that one list through a Kai Hana–operated Cloudflare Worker so the people you share with stay in sync. What leaves your device for a shared list: the shared tasks’ titles, dates, times, and completion state; the display name you enter; a random per-device ID; and — so the silent update push above can reach you — your APNs (iOS) or FCM (Android) push token. Only those fields sync — your tasks’ notes, priority, subtasks, and reminders stay on your device. Authentication uses a token kept in your device Keychain (iOS) or Keystore (Android). On Android, your shared-list membership (that random device ID and token — not your tasks) is also backed up via Google Block Store so it can be restored if you reinstall or change devices; that backup is encrypted by Google and tied to your Google account, and we can’t read it. No email or account is involved. You can leave or delete a shared list at any time, which removes its data from the server and clears the Block Store backup.
  • No analytics, no ads, no tracking. AllDay contains no analytics, crash-reporting, or advertising SDKs. Apart from the optional shared-list sync above, it makes no network requests.
  • In-app purchases. AllDay Pro — a one-time lifetime unlock or a monthly or annual subscription — is handled by Apple StoreKit (iOS) or Google Play Billing (Android). Entitlement is cached locally; the store is the source of truth. Kai Hana does not see your payment details.

Until

  • On-device by default. Your events, reminder rules, settings, and widget data are stored only on your device. There are no user accounts and no sign-up. Events you don’t share never touch the network.
  • Notifications (local only). Event reminders are scheduled and delivered entirely on your device as local notifications. Until uses no push notifications and no server to deliver them.
  • Shared events (optional). If you choose to share an event, Until syncs that one event through a Kai Hana–operated Cloudflare Worker so everyone with the invite code sees edits live. What leaves your device for a shared event: the event’s fields (title, date, and appearance settings), its background photo if you set one, and a random per-device key that marks edits as yours. Sharing uses a 6-character invite code that stops accepting new joins 24 hours after it’s created; you can rotate the code at any time to mint a fresh one (with a new 24-hour window) or to immediately revoke the old one. Join attempts are rate-limited to deter guessing.
  • Shared-event retention. A shared event’s data (including its photo) remains on the sync server so that other participants keep working even when you’re offline. Rotating the invite code cuts off new access but does not erase the data; to have a shared event removed from the server, email support@kai-hana.com.
  • Calendar import (optional). You can connect a calendar feed by giving Until an ICS/iCal URL (for example from Google Calendar, iCloud, or a public schedule). Until fetches that URL directly to read its events — and refreshes it about once a day — so the request goes to whichever calendar provider you point it at, not to Kai Hana, and carries standard HTTP metadata plus any private token embedded in the URL you provide. The feed URL and the events you import are stored on your device; none of it is sent to Kai Hana. Remove a feed at any time to stop the refresh and delete its stored URL.
  • In-app purchases. Until Pro — a one-time lifetime unlock or a monthly subscription — is handled by Apple StoreKit (iOS) or Google Play Billing (Android). Entitlement is cached locally; the store is the source of truth. Kai Hana does not see your payment details.
  • No analytics, no ads, no tracking. Until contains no analytics, crash-reporting, or advertising SDKs. Apart from the optional shared-event sync and calendar import above (and the app store handling your purchase, if you buy Pro), it makes no network requests — and none of those send your data to Kai Hana beyond a shared event you choose to sync.

AdWall

AdWall is the one app that sits in the path of your device’s DNS, so it is the one that most deserves a precise account of where your lookups go. The short version: they do not go to us. Filtering happens on your phone, and the lookups AdWall allows through are resolved by a public DNS provider you choose.

  • What it is. AdWall blocks ads, trackers, and malicious-redirect domains by filtering DNS beneath the browser. The app registers a local VPN service on Android — Android’s standard mechanism for handling DNS on-device — and your operating system shows a one-time permission prompt (“Allow”) to enable it. AdWall captures and handles only DNS traffic; the rest of your network traffic is not routed through it, and no traffic is routed to Kai Hana.
  • Filtering happens on your device. The blocklists ship inside the app and are stored on your phone. When protection is on, every lookup is matched against those lists locally, in the app’s own process. Blocked domains are answered on-device with 0.0.0.0 and never leave your phone at all. Kai Hana operates no DNS resolver in this path and receives none of your lookups — there is no per-query server call, no query log, and no per-user token or device identifier sent to us.
  • Allowed lookups go to a public resolver you choose. A domain that isn’t blocked still has to be resolved by someone. AdWall forwards it over encrypted DNS (DoH) to a public resolver you select in Settings — Cloudflare (cloudflare-dns.com, the default), Google (dns.google), or Quad9 (dns.quad9.net). That provider sees the domain you looked up and your IP address, and handles it under its own privacy policy, not ours. This is the one place your browsing-related data reaches a third party, and it is the trade every DNS-based blocker makes; you control which company it is.
  • Your stats stay on your phone. The blocked-count on the home screen and widget, your all-time totals, your per-day history, your most-blocked domains, and the recent-activity list of lookups are all computed and stored locally on your device (in the app’s own storage) so you can see what AdWall is doing. None of it is transmitted to Kai Hana or anyone else, and it is deleted when you uninstall.
  • What we do receive. Once a week, AdWall asks a Kai Hana server on Cloudflare for updated blocklists — a plain conditional download of the same public list files every user gets. The request carries no account, no token, and no device identifier; like any web request it carries your IP address and is not logged beyond Cloudflare’s ordinary operational logs. That weekly list fetch is the only routine contact between AdWall and Kai Hana.
  • Free tier and subscriptions. AdWall’s core blocking is free, with no account, sign-up, or purchase. AdWall Pro is handled entirely by Google Play Billing: the app checks your active purchases directly with the Play Store on your device. No receipt, purchase token, or subscription identifier is sent to any Kai Hana server, and we never see your name, card, or payment details.
  • Anti-circumvention. To stop apps and browsers from smuggling their own encrypted DNS past the filter, AdWall also blocks lookups for well-known public DoH/DoT resolver hostnames while protection is on. You can exempt specific apps from filtering entirely in Settings; an excluded app’s DNS is neither captured nor filtered.
  • Blocklists. AdWall filters using published open-source blocklists; their maintainers are credited in the app. No data about you is sent to them — the lists are downloaded, never queried.
  • No analytics, no ads, no profiling. AdWall contains no analytics, crash-reporting, or advertising SDKs, and builds no profile of your browsing. We do not sell, use, or disclose your DNS queries — or any data derived from them — to third parties for any purpose. We could not do so even if we wanted to: we never receive them.
  • Setup caveats. Because AdWall uses Android’s VPN service, another active VPN can conflict with or bypass filtering, since Android runs only one VPN configuration at a time. AdWall also can’t hide an ad served from the same domain as the page you’re reading.

Crescent

  • No Kai Hana backend. Crescent runs entirely on your device and does not communicate with any server operated by Kai Hana. Your breathing patterns, session history, notes, and settings stay on your device. The “Information collected automatically” items in the umbrella section below do not apply to Crescent; per the precedence rule above, this section governs.
  • Works offline. Crescent needs no network connection — its breathing patterns, guided meditations, and soundscapes are bundled in the app and play on-device. The only time it touches the network is to complete an in-app purchase through the store.
  • Local storage. Your custom patterns, session log, streaks, and pre/post-session notes are stored on your device and deleted when you uninstall.
  • In-app purchases. Crescent Pro is a one-time lifetime unlock handled by Apple StoreKit (iOS) or Google Play Billing (Android). Entitlement is cached locally; the store is the source of truth. Kai Hana does not see your payment details.
  • No analytics, no ads, no accounts. Crescent contains no analytics, crash-reporting, or advertising SDKs, and has no sign-up.

Inkpaw

  • On-device by default. Your pets’ health records, reminders, weight charts, documents, photos, and memories are stored on your device. There are no user accounts and no sign-up. If you never share, your pet data is never uploaded and your device is never registered with us — the two map features below are the only requests Inkpaw makes on its own, and neither one identifies you.

  • Photos stay on your device. Inkpaw asks for photo access so you can attach pictures to your pets and build memory albums. Grouping and sorting those photos into albums runs on your device; your photos are never uploaded to Kai Hana, and we generate no imagery from them. Turning a photo’s location into a place name (“San Diego”) is done by your operating system’s geocoder, which on iOS and Android may contact Apple or Google to answer — coordinates for that step go to your OS vendor, never to us.

  • Places and map cards (optional). Two features send location data through a Kai Hana–operated Cloudflare worker to Apple Maps, and they work whether or not you share anything:

    • When you type a place into an entry (a vet, a park), Inkpaw asks our worker for matching suggestions; the text you typed is forwarded to Apple Maps.
    • When a memory has a location, the map card on it is an image our worker fetches from Apple Maps; those coordinates are forwarded to render it.

    In both cases we pass the request through only so the Apple Maps key stays off your device. Nothing is stored on our side, and neither request carries a device ID, account, or anything tying it to you or your pets. Both features are additive — skip the place field and don’t open a located memory, and neither request is ever made.

  • Family sharing (optional, Plus). If you start or join a household to share with family or a pet-sitter, your pets’ records and reminders sync through a Kai Hana–operated Cloudflare backend so everyone stays current. What leaves your device: the shared record and reminder data, and a random per-device key that identifies your install (plus a push token, if you enable notifications). No email or account is involved, and your photos are not part of the sync — they stay on your device. Joining a household uses a single-use invite code that expires after 72 hours; join attempts are rate-limited to deter guessing, and you can revoke a code at any time.

  • Notifications. Reminders are delivered on your device as local notifications. When you use family sharing, Inkpaw may register a push token to quietly notify your devices when shared records change, delivered via Apple (APNs) or Google (FCM).

  • In-app purchases. Inkpaw Plus — a one-time unlock or a subscription — is handled by Apple StoreKit (iOS) or Google Play Billing (Android). Your purchase is verified on your device; the store is the source of truth, and Kai Hana does not see your payment details. Your own records, reminders, and a full data export stay free, forever.

  • No analytics, no ads, no tracking. Inkpaw contains no analytics, crash-reporting, or advertising SDKs.

What we collect

Information you provide

We don’t ask for your name, email address, phone number, or financial details. There are no user accounts and no sign-up step. Some apps request access to specific device capabilities (such as location, microphone, calendar, photos, or notifications) to provide their core function — these are detailed per app under Per-app data practices and are only used when you opt in.

Information collected automatically

Most of our apps collect none of the following — several never contact a Kai Hana server at all, and the ones that do only start when you turn on a feature that needs it. The per-app sections above are authoritative for each app; this list describes what those features collect when they apply:

  • Device token — a random ID we generate on first launch. It’s stored only on your device (in iOS Keychain or Android Keystore) and sent to our backend so we can route alerts and IAP entitlements to your install. It cannot be tied to any other identifier we hold about you.
  • Push notification token — issued by Apple or Google when you grant notification permission. We store it alongside your device token so we can deliver alerts.
  • In-app purchase receipts — when you buy a paid feature (e.g. RateGlance Pro), the App Store or Google Play sends us a signed receipt. We forward it to Apple or Google for verification and store the resulting transaction identifier so the same receipt cannot be redeemed by a different device.
  • Alert configuration (Pro tier only) — pair, target rate, and direction. Stored on our server so we can check the rate hourly even when the app is closed.

Information processed by third-party services

  • Apple StoreKit / Google Play Billing — handle purchase and refund flows. We never see your payment details.
  • Apple Push Notification service / Firebase Cloud Messaging — deliver push for the apps that use it: RateGlance (rate alerts) and ClearCast (weather alerts and briefings) send you visible notifications; AllDay (shared lists) and Inkpaw (households) use silent, content-free background pushes that carry no task or pet data and only tell the app to fetch an update. Kaia, AutoPilot, Until, Crescent, and AdWall use no remote push at all.
  • Frankfurter (api.frankfurter.dev) — provides European Central Bank reference rates for RateGlance’s major-currency coverage. We do not send any personal information to this service — only currency codes.
  • Fawazahmed currency-api (latest.currency-api.pages.dev) — provides exchange rates for the long-tail currencies that ECB doesn’t cover (used by RateGlance). Free, open-data feed. We do not send any personal information — only currency codes.
  • Apple WeatherKit (weatherkit.apple.com) — primary forecast source for ClearCast. The request is signed by our Cloudflare Worker (so the Apple Developer key never ships in the app) and includes the approximate coordinates we need to fetch a forecast. Apple’s WeatherKit data handling is governed by Apple’s WeatherKit terms and the Apple Privacy Policy.
  • OpenWeatherMap (api.openweathermap.org) — provides air-quality data and city-name geocoding for ClearCast (proxied through our Cloudflare Worker). Receives approximate coordinates or the city search query you typed. See OpenWeatherMap’s privacy policy.
  • US National Weather Service (api.weather.gov) — provides severe-weather alerts for ClearCast users in the United States. Called directly from your device. Receives latitude/longitude and a User-Agent header containing our support email per NWS policy.
  • Search providers used by Kaia’s web-search tool — Brave Search (api.search.brave.com) and Tavily (api.tavily.com). The provider used depends on your Kaia settings. Each receives only the search query you typed and standard HTTP metadata.
  • Hugging Face (huggingface.co) — hosts the model file Kaia (Gemma) downloads on demand. Standard HTTP metadata only; no account is attached.
  • Webhook destinations you configure — AutoPilot’s optional HTTP-request action sends data to a URL you choose. The destination is entirely under your control; Kai Hana operates no part of it and never sees the request.
  • Apple Maps (maps-api.apple.com) — powers Inkpaw’s place type-ahead and the map images on located memories, proxied through our worker so the Apple Maps key stays off your device. Receives the place text you type or the coordinates being drawn, with no identifier attached. Governed by the Apple Privacy Policy.
  • Public DNS resolvers — Cloudflare (cloudflare-dns.com), Google (dns.google), or Quad9 (dns.quad9.net) — resolve the lookups AdWall allows through, over encrypted DNS. You choose which one in AdWall’s settings (Cloudflare is the default). The provider you pick receives those domain lookups and your IP address under its own privacy policy. Kai Hana operates no resolver and receives none of your lookups.
  • Cloudflare — hosts our backend workers for RateGlance (alert checks + IAP verification), ClearCast (WeatherKit/OWM proxy + push notification dispatch), AllDay (shared-list sync, only when you share a list), Until (shared-event sync, only when you share an event), Inkpaw (family record sync when you share a household, plus the Apple Maps proxy above), and AdWall (weekly blocklist downloads only — not DNS resolution). Standard request logs (IP, user agent, request path) may be retained briefly per Cloudflare’s policies for abuse prevention and operational monitoring. Kaia, AutoPilot, and Crescent do not use a Kai Hana backend at all.
  • Expo — used by RateGlance for push notification delivery infrastructure. Every other app of ours that uses push (ClearCast, AllDay, Inkpaw) delivers it directly via APNs/FCM and does not route it through Expo.

What we do with the data

  • Authenticate your device against our backend so we know which install owns which alerts or notification preferences.
  • Verify in-app purchases and grant the corresponding entitlement (RateGlance).
  • Fetch and deliver rate-target alerts and weather briefings through APNs / FCM push, and tell your other devices when a list, event, or household you share has changed.
  • Serve AdWall’s weekly blocklist updates. (The filtering itself happens on your device — we receive no DNS lookups.)

We do not:

  • Collect analytics or telemetry. None of our apps contain an analytics SDK.

  • Collect crash reports. None of our apps contain a crash-reporting SDK — we learn about bugs when you email us.

  • Sell your data.

  • Share your data with third parties for their own marketing.

  • Build a profile of your behavior across apps or devices.

  • Track you across other apps or websites.

  • Show ads. As of v1.1, no Kai Hana app displays ads — the previous AdMob banner in ClearCast’s free tier was removed.

Data retention

  • On your device: data is stored in the app’s SQLite database and Keychain/Keystore. It is deleted when you uninstall the app.
  • On our server: for RateGlance Pro alerts, your device token, push token, alert configuration, and IAP transaction identifiers persist until you uninstall and the entry is pruned by inactivity, or until you contact us asking for deletion. For ClearCast’s notification features, your user ID, push token, location, and briefing settings persist on the same basis; turning notifications off in the app sends an immediate /unregister that clears the row. For AllDay shared lists, the shared tasks and member display names persist on the sync server until you leave or delete the list, which removes them. For Until shared events, the event fields and background photo persist on the sync server until you ask us to remove them (email support@kai-hana.com); rotating the invite code revokes access but does not erase the data. For Inkpaw households, the shared records and reminders persist on the sync server until you leave or delete the household, which removes them (or email support@kai-hana.com). For AdWall there is nothing to retain: filtering runs on your device, we receive no DNS lookups, and we hold no token, device identifier, or subscription record for your install — your blocking stats live only on your phone and are deleted when you uninstall.

How we protect data

  • In transit. Every request our apps make — to our Cloudflare Workers, to a store, to a third-party provider — uses HTTPS (and, for AdWall’s allowed lookups, encrypted DNS). We ship no plaintext endpoints.
  • On your device. Local data sits in the app’s own sandboxed storage, and the sensitive parts (device tokens, sync tokens, entitlements) are held in iOS Keychain or Android Keystore. Several apps store their database encrypted.
  • On our servers. The little we hold lives in Cloudflare D1, reachable only through our Workers. There are no user accounts to breach — a row is keyed to a random per-install ID that maps to no name, email, or payment detail. Access is limited to the developer operating the service.
  • Secrets stay off your device. Paid API keys (Apple WeatherKit, OpenWeatherMap, Apple Maps) live in our Workers, not in the app binary.
  • The honest caveat. No system is perfectly secure. If we ever learn of a breach affecting data we hold, we’ll say so in the affected app’s release notes and on this page, and notify regulators where the law requires it.

Data deletion

For most of our apps there is nothing for us to delete, because we never had it. Kaia, AutoPilot, Crescent, and AdWall hold no server-side data about you at all — uninstalling removes everything. AllDay, Until, and Inkpaw are the same unless you shared something.

Where we do hold data, you can remove it by:

  1. Doing it in the app — turn ClearCast’s notifications off (this clears your row immediately), or leave/delete a shared AllDay list or Inkpaw household (this removes its synced data).
  2. Uninstalling, which deletes everything stored on your device, or
  3. Emailing support@kai-hana.com — describe the device (and, for a shared Until event, its name) and we’ll remove what we hold. No account or device token is needed; we’ll handle it manually.

Children

Our apps are not directed at children under 13. We do not knowingly collect data from children. If you believe a child has used one of our apps, contact us and we’ll delete any associated data.

International users

Our backend runs on Cloudflare’s global edge network. Data may be processed in any region where Cloudflare operates. We rely on standard contractual clauses for international transfers where applicable.

Who is responsible. KAI HANA LLC is the data controller for the limited data described above. You can reach us at support@kai-hana.com for any privacy question or request; there is no separate postal intake.

Legal bases (EEA / UK). Where GDPR applies, we rely on: contract — to run a feature you asked for, such as delivering a Pro alert, a shared list, or a household sync; consent — for the optional device permissions (location, microphone, calendar, photos, notifications), which you can withdraw at any time in your OS settings; and legitimate interests — to keep the service working and to prevent abuse, such as Cloudflare’s brief operational logs. We do not process any special-category data, and we carry out no profiling or automated decision-making.

Your rights. If you are in the EEA, UK, Switzerland, or California, you have the right to access, correct, delete, or port data we hold about you, to object to or restrict processing, and to lodge a complaint with your local supervisory authority. We will not discriminate against you for exercising any of these rights. Because we hold no accounts and no contact details, we can’t look you up — tell us the app and, where relevant, the device or shared item, and we’ll act on it. We answer within 30 days. We have never sold or shared personal information, and we do not do so now.

Changes

We’ll update this policy when our apps change in ways that affect data practices. The “Last updated” date at the top reflects the most recent change. Material changes will be announced in the affected app’s release notes.

Contact

Email: support@kai-hana.com

The licence terms for our apps — including subscription and refund terms — are on the Terms of Use page.

This policy is provided for transparency and is not legal advice. It describes practices accurately to the best of our knowledge as of the date above.