Privacy Policy: MarkhorSol

This privacy policy explains how Markhor Solutions (“MarkhorSol”, “we”, “us”) collects, uses and shares information when you use our apps and our website, and the choices and rights you have. “Applications” means any mobile, tablet, web or desktop app we publish now or in the future, including its updates and features. Our website is https://markhorsol.com/. Together, the Applications and the website are the “Service”.

MarkhorSol is based in Delaware, United States, and is responsible (the “controller”) for the personal data described here. “Personal data” means any information about an identified or identifiable person.

What we collect differs between Applications, and many keep what you create only on your device. Details for specific apps are in App-specific details. By using the Service, you agree to the collection and use of information as this policy describes.

1. Information we collect

Information you give us

When you create an account, contact us or use a feature that needs it, we may ask for personal data such as your email address and your first and last name.

Information collected automatically

When you use the Service, some information is collected automatically (“usage data”): your device’s IP address, browser type and version, operating system and device model, unique device identifiers (including advertising identifiers; see Advertising), the screens or pages you visit and the features you use, the date and time of your visit and how long you spend, and diagnostic data such as crash reports and performance information.

Information from your device, with your permission

Depending on the Application, and only after you allow it, we may access:

your location;
your camera and photo library;
your microphone and voice recordings, in Applications with voice input or transcription;
your calendar;
content you enter yourself, such as journal entries, notes and check-ins, including content you submit to AI-powered features (see AI and large language model features).

Depending on the Application, this information is stored only on your device, or uploaded to our servers or a service provider’s servers. You can turn off access at any time in your device settings.

Cookies and similar technologies

Our website uses cookies and similar technologies (beacons, tags and scripts) to keep it working, remember your preferences and your cookie-consent choice, and improve it. Session cookies are deleted when you close your browser; persistent cookies stay until they expire or you delete them. You can tell your browser to refuse cookies, but parts of the website may not work without them.

In the Applications, our advertising and analytics providers use software development kits (SDKs), device identifiers and storage on your device for similar purposes, as described below.

2. How we use information

We use information to:

provide, maintain and improve the Service, including AI-powered features;
manage your account, where an Application has one;
process purchases and subscriptions, and restore them on your devices;
show ads in free versions of our Applications, measure them, prevent ad fraud and, with your consent where the law requires it, personalise them;
understand how the Service is used (analytics), spot trends and fix problems;
contact you about updates, security and other service matters and, unless you have opted out, about news and offers;
respond to your requests and support questions;
keep the Service safe, prevent fraud and abuse, and comply with the law;
evaluate or carry out a merger, acquisition or sale of assets.

3. Advertising

Free versions of our Applications show ads served by Google AdMob, Google’s mobile advertising service. To choose, deliver and measure ads and to prevent ad fraud, Google’s Mobile Ads SDK collects from your device:

device identifiers: on Android, the advertising ID and app set ID; on iPhone and iPad, the Identifier for Advertisers (IDFA), only if you allow tracking;
your IP address, which Google may use to estimate your general location;
how you interact with the app and its ads, such as app launches, ad views and taps;
diagnostic and performance information, such as crash data, app launch time and hang rate.

Google uses this information as described in the Google Privacy Policy and in How Google uses information from sites or apps that use our services, and acts as an independent controller for some of it. We never pass Google anything you write, record or photograph in our Applications.

Personalised ads and consent

If you are in the European Economic Area (EEA), the UK or Switzerland, we use Google’s consent tool to ask for your consent before ads are personalised and before information is stored on or read from your device for advertising. If you don’t consent, you may still see non-personalised or limited ads, which are not based on your past activity. Where an Application offers privacy choices in its settings, you can change your decision there at any time; you can also contact us.

App Tracking Transparency (iPhone and iPad)

Before your IDFA can be used to track you across apps and websites owned by other companies, Apple’s tracking prompt asks for your permission. If you choose “Ask App Not to Track”, the IDFA is not available and the ads you see are not based on tracking. You can change this at any time in Settings → Privacy & Security → Tracking.

Android advertising ID

You can reset or delete your advertising ID in your device settings (usually Settings → Google → Ads, or Settings → Privacy → Ads). You can also manage the ads Google shows you in My Ad Center.

Ad-free subscriptions

Where an Application offers a paid subscription that removes ads (for example, Hafta Pro), no ads are shown while it is active.

4. AI and large language model features

Some Applications include features powered by artificial intelligence and large language models (LLMs). To provide them, we send the relevant content to third-party AI providers, currently:

Google (including the Gemini API);
OpenAI (including its API services);
Anthropic (including the Claude API).

When you use an AI-powered feature, what you submit, such as text, prompts, voice transcriptions, images or other input, may be sent to an AI provider to generate a response or complete the task. This applies whether we use a free or a paid tier of that provider’s API, and whatever your own subscription status in the Application.

Each AI provider handles data under its own privacy policy and terms, which we don’t control. Please review them directly: Google Privacy Policy, OpenAI Privacy Policy, Anthropic Privacy Policy.

Please note:

Once data reaches an AI provider, we generally can’t access, change or permanently delete it, except as that provider’s own tools or policies allow.
Depending on the provider, tier and terms, data sent through an API may be kept for a limited time for abuse monitoring, safety and legal compliance, even where the provider says it does not use API data to train its models.
We can’t guarantee or require that an AI provider deletes, restricts or returns your data. To make a deletion or access request directly, you may need to contact that provider yourself.
If you don’t want your content processed by a third-party AI provider, please don’t use AI-powered features.

We choose AI providers that publish data protection and security commitments and, where available, set up our use of their APIs to limit data retention and opt out of model training. We don’t guarantee any AI provider’s data handling, security or availability and, to the fullest extent the law allows, we are not liable for their acts, omissions or data practices.

5. Service providers

We use these third parties to run, secure, analyse and improve the Service. Which ones an Application uses depends on its features (see App-specific details). Each processes data under its own privacy policy and data-processing terms.

Google AdMob (Google LLC): ads in free versions of our Applications; see Advertising.
RevenueCat: manages subscriptions and in-app purchases. It receives your purchase receipts, transaction details and a random app user ID, so it can unlock, sync and restore what you have bought. It never receives your payment card details. RevenueCat Privacy Policy.
Firebase (Google): backend infrastructure, authentication, crash and error reporting, cloud storage and push notifications, in Applications that use them. Privacy and Security in Firebase.
Mixpanel: product analytics and feature usage. Mixpanel Privacy Policy.
Apple Inc.: app distribution, and in-app purchase and subscription billing through the App Store. Apple Privacy Policy.
Google LLC: app distribution, and in-app purchase and subscription billing through Google Play.
Cloud hosting and infrastructure providers that store and process Service data.

Where a provider combines data across many customers, as analytics providers do, individual records can’t always be deleted completely or immediately. We make commercially reasonable efforts to honour deletion requests within what each provider’s platform allows, but we can’t guarantee complete deletion from every third-party system that has processed your data.

6. Purchases and subscriptions

Purchases and subscriptions in our Applications are billed and processed by Apple (App Store) or Google (Google Play), depending on your device. We never collect or store your full payment card details; Apple or Google handle them under their own privacy policies. We use RevenueCat to confirm purchases and to unlock, sync and restore subscriptions.

To manage, renew or cancel a subscription, or to ask for a refund, use your Apple ID or Google Play account settings. We can’t cancel subscriptions or issue refunds on Apple’s or Google’s behalf.

7. Legal bases (EEA, UK and Switzerland)

If you are in the EEA, the UK or Switzerland, we rely on these legal bases:

Contract: to provide the Applications and the features you ask for, including purchases and subscriptions.
Consent: for personalised ads; for storing or reading advertising information on your device where the law requires consent; for tracking on Apple devices; and for optional device permissions such as camera, microphone, location and calendar. You can withdraw consent at any time (see Your rights and choices).
Legitimate interests: to understand how the Service is used through analytics, to keep it secure, to prevent fraud and abuse, and to show the ads that fund free versions of our Applications. You can object to this processing.
Legal obligation: where the law requires us to keep or disclose information.

8. How long we keep information

We keep personal data only as long as needed for the purposes in this policy, to meet legal obligations, resolve disputes and enforce our agreements. Usage data is usually kept for a shorter time, unless we need it for security, functionality or legal reasons. Content that an Application keeps only on your device stays there until you delete it or remove the Application. Our service providers keep data under their own retention policies.

9. International transfers

Your information may be processed wherever we or our service providers operate, including the United States, which may be outside your state, province or country and where data protection laws may differ. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the Standard Contractual Clauses our providers offer. By using the Service, you consent to this transfer, and we take reasonable steps to keep your data secure and handled in line with this policy.

10. When we disclose information

Besides the service providers and advertising partners described above, we may disclose personal data:

as part of a merger, acquisition or sale of assets;
when required by law or by a valid request from a public authority;
when we believe in good faith that it is needed to comply with a legal obligation, protect our rights or property, investigate wrongdoing, protect the safety of users or the public, or defend against legal liability.

11. Security

We care about the security of your personal data, but no method of transmission over the internet or of electronic storage is completely secure. That applies to our own systems and to those of our service providers, hosting providers and AI providers. We use commercially reasonable safeguards and work with reputable providers, but we can’t guarantee absolute security.

12. Third-party systems and liability

You acknowledge and agree that:

we rely on third-party providers, including hosting, AI, analytics and advertising providers, to run the Service, and we don’t own or directly control their servers, networks or systems;
to the fullest extent the law allows, we are not liable for unauthorised access, data breach, loss, corruption or misuse of data on a third-party provider’s systems, except where directly caused by our own gross negligence or wilful misconduct;
we are not responsible for the accuracy, appropriateness or reliability of output from AI-powered features, which is provided “as is”, without warranty of any kind;
nothing in this section limits any right you have under data protection law that cannot be waived by agreement, such as our duty, as a controller, to notify you and the authorities of a qualifying data breach.

13. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict or receive a copy of your personal data, and to object to certain processing. You can also:

withdraw consent at any time: for personalised ads, through an Application’s privacy choices where available or by contacting us; for tracking on Apple devices, in Settings → Privacy & Security → Tracking. Withdrawing consent doesn’t affect processing that took place before;
turn off device permissions such as camera, microphone, location or calendar in your device settings;
reset or delete your advertising identifier, as described in Advertising;
complain to your local data protection authority.

US state privacy rights

Residents of some US states, including California, may have the right to know what personal data we collect, to access, correct and delete it, and to opt out of the “sale” or “sharing” of personal data and of targeted advertising. We don’t sell personal data for money. Letting Google collect device identifiers to personalise ads may count as “sharing” or “targeted advertising” under some of these laws; you can opt out with the device controls in Advertising or by contacting us. We won’t treat you differently for using these rights.

Deleting your data

Some Applications let you delete your data within the Application, and data kept only on your device is removed when you delete it there or uninstall the Application. You can also contact us to ask for access to, correction of or deletion of personal data we hold. These rights don’t extend to data already processed by an AI provider or another independent third party, which follows that party’s own retention and deletion policies, and we may need to keep some information where the law requires it.

To use any of these rights, contact us. We will respond as applicable law requires.

14. Children

The Service is not directed to anyone under 13, and we don’t knowingly collect personal data from anyone under 13. Ads in our Applications are not directed to children. If you are a parent or guardian and believe your child has given us personal data, please contact us so we can remove it. If your country’s laws require a parent’s consent, we may ask for that consent before collecting and using information.

15. Links to other websites

The Service may link to websites we don’t operate. We have no control over, and take no responsibility for, their content, privacy policies or practices.

16. App-specific details

Hafta (Android and iPhone)

No account. Hafta has no sign-up and no server of its own.
What you write stays on your device. Your stones, notes, intentions and snapshots are stored only on your phone and in its widgets. Hafta never uploads them.
Calendar (optional). If you turn on “Show my calendar”, Hafta reads your calendar on your device to show what your week already holds. It never changes your calendar or sends it anywhere.
Camera and photos (optional). Used only when you take a snapshot or choose a cover photo. Photos stay on your device, and the system photo picker gives Hafta only the photo you pick.
Notifications (optional). Reminders are scheduled on your device; Hafta uses no push server.
Do Not Disturb (Android, optional). If you allow it, Hafta turns Do Not Disturb on during Reset Mode and off afterwards.
Backups. If you export a backup, the file goes only where you choose to save or share it.
Analytics (Mixpanel, stored in the EU). Which features you use and when; your setup (reset day, time window, ritual size, Pro status, appearance and weeks since install); a random ID created for each installation; and device details Mixpanel adds (device model, OS version, screen size, app version, mobile carrier, and whether Wi-Fi is on). Hafta never sends what you write, your photos or your calendar, and IP-based location is turned off.
Subscriptions (RevenueCat). Store receipts and a random app user ID, to unlock and restore Hafta Pro.
Ads (Google AdMob). The free version shows banner ads, and occasionally a full-screen ad when you leave some screens, as described in Advertising. Where required, Google’s consent form and, on iPhone, Apple’s tracking prompt appear once, after setup. Hafta Pro removes ads.
Deleting your data. Settings → Erase everything deletes every reset, photo and setting on your device, and uninstalling Hafta does too. Analytics data is not linked to your name or an account.
Hafta has no AI features and doesn’t use Firebase.

17. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date and, where required, tell you by email or with a clear notice in the Service before the change takes effect.

18. Contact us

If you have questions about this policy or want to use your rights, contact us:

By email: [email protected]
Through our website: https://markhorsol.com/#contact