Privacy Policy

How Hexley handles your personal data.

In short

Hexley works without an account. What you choose in the welcome stays on your phone.
With an account, your practice data (witch card, progress, Book of Shadows and the rest) is stored only if you give your consent. Withdrawing it deletes that data everywhere.
Usage data is sent only after your "yes" in the EU, the EEA and the UK. It never holds your notes, your email or your account ID.
We do not sell or share your data for advertising, and show no ads.

Who is responsible

Hexley is made by Lennart Muchow, Programmierbüro Muchow, Mittelgäustrasse 124, 4612 Wangen bei Olten, Switzerland (Legal Notice: You → Legal Notice). For any question about your data or to use your rights, write to [email protected].

This policy follows the Swiss Federal Act on Data Protection (FADP, revDSG) and, for users in the EU, the EEA and the UK, the GDPR. Hexley is open worldwide; what this policy promises applies to everyone, wherever you live.

Without an account

Everything you set in the app stays on your device: your answers from the welcome (name, experience, hopes, interests, daily time, birth date, time and city, hemisphere), the theme, the language, reminders, and the choice about usage data. Your signs are worked out on the device; no birth data leaves it.

Deleting the app removes all of this.

Your account

To create an account we need your email address and a password, or a sign-in with Google or Apple. We store your email, your language, your age group (13–15 or 16 and over) and, when you confirm it, the date on which you confirmed your age. With Apple we also keep the token Apple gives us at sign-in, only to cancel it with Apple when you delete your account. Legal basis: providing the account you asked for (Art. 6 (1) (b) GDPR).

The mails for confirming your address and resetting your password are sent through Brevo (Sendinblue SAS, France).

Age: an account is open from 16, or from 13 with the agreement of a parent or guardian. There is no account under 13.

The consent for your practice data

What you practise and believe can be special category data (Art. 9 GDPR, and sensitive data under the Swiss FADP: religious or philosophical beliefs). So all of it is stored with your account only after a separate, explicit consent (Art. 9 (2) (a) GDPR), which is optional, not ticked in advance, and free: the app's lessons and practices stay open without it.

With the consent we store:

Your witch card: the name on it, your craft (or your own words for it), your element, your motto, the day you sealed it, the seal you chose for it, and how it looks (theme, colours, decoration, frame and card back).
Your progress: finished lessons, Revisit (how often and when you looked back at a lesson's key points), the days you used the app and your points.
What you keep: bookmarks, planned rituals with their notes, notes in the Book of Shadows and your own pages.
The practice log (Premium): your intention, how you felt and how your energy was before and after a practice, your notes, the moon and sabbat it fell on, and your answers to the follow-ups a day and a week later.

You can withdraw the consent at any time in You → Your data. That deletes all of the data above on our server and on your devices. Without the consent your account holds only your email, your language and your age details.

Items you remove are kept marked as deleted, without their text, until the account is deleted, so your other devices know they are gone.

Sharing your card: when you share your witch card, the picture is made on your phone and handed to the app you pick. It does not pass through our server.

Kept on your phone only

Your reminder settings, such as the time of your daily reminder, never reach our server, and every reminder is scheduled on your phone. Only a planned ritual is stored with your account (see above), with its time and whether it should remind you.

Usage data (analytics)

To see where new users get stuck, the app can send usage events to PostHog (PostHog Inc., data stored in the EU): which screens are opened, which lessons, plans and practices are started or finished, sign-up and sign-in steps, errors, and the app's language and theme. Pages and practices are named by their address in the app (for example "rituals/full-moon").

Never sent: your notes, log entries, your email, your account ID or your name. IP addresses are discarded, and autocapture, heatmaps and session replay are off. The one exception to autocapture: if the app crashes, it also sends an error report with the kind of error, where in the code it happened and the app's version, without the error's text.

In the EU, the EEA and the UK (and where the region of your device is unknown), nothing is sent before you say yes at the end of the welcome or in You → Usage data. Legal basis: your consent (Art. 6 (1) (a) GDPR).
Elsewhere it is on until you say no. Legal basis: our legitimate interest in improving the app (Art. 6 (1) (f) GDPR).

A "no" stops it at once and replaces the random ID the events were sent under.

Subscription

Premium is bought through Google Play or the App Store. RevenueCat (RevenueCat Inc., USA) tells us whether your subscription is active; it knows your purchases under your account ID, not under your name or email. We store only that state (until when, which store, whether in trial, whether it renews), never card or payment details. The stores handle the payment under their own privacy policies. When you delete your account, your record at RevenueCat is deleted too.

Services we use

Supabase (Supabase Inc., servers in the EU): accounts and the synced data.
Brevo (Sendinblue SAS, France): the account mails.
Expo / EAS (650 Industries Inc., USA): app updates (the app asks for a new version at start; no account data) and the hosting of the web version.
Google and Apple: only if you sign in with them.
PostHog (PostHog Inc., data in the EU): usage data, as above.
RevenueCat, Google Play, App Store: the subscription, as above.

Each of them processes data only on our instructions, under a data processing agreement. Where a service sits in the USA, the transfer rests on the EU–US and Swiss–US Data Privacy Framework or on the EU's standard contractual clauses.

Links: the links to our community on Instagram and Discord open outside the app; Hexley sends them nothing. Once there, their own privacy policies apply.

Ratings and feedback: now and then the app opens the rating sheet of Google Play or the App Store; your rating goes to the store, not to us, and we see it only as the store shows it. "Send feedback" in You opens your own mail app with a mail to [email protected], below your text the app version, the system and the language, which you can delete before sending. The app stores nothing of it. We receive the mail with your address and keep it until your question is answered, at most 12 months.

How long we keep data

As long as you have the account, or until you withdraw the consent for the practice data. Deleting the account in You → Your data deletes it and everything linked to it from our database at once. We keep no backups of our own. Our host Supabase backs up the database daily for its own operation; deleted data remains in those copies only until they are overwritten by newer ones.

Security

Data travels encrypted (HTTPS). In our database every user can reach only their own rows, and passwords are stored only as a hash by Supabase; we never see them.

Children

Hexley is not meant for children under 13, and we do not knowingly collect their data. If you learn that a child under 13 has made an account, write to us and we delete it.

Your rights

You can see, correct, export and delete your data. The export and the deletion are in the app under You → Your data. You may also object to processing, ask for it to be restricted, withdraw a consent at any time (with effect for the future) and complain to a data protection authority: in Switzerland the FDPIC (EDÖB), in the EU the authority of your country, in the UK the ICO. We make no decisions about you by automated means alone.

Users in California and other US states: you have the right to know what we collect (this policy), to get a copy, to correct and to delete it, and not to be treated worse for using these rights. We do not sell your personal information or share it for cross-context advertising. Hexley does not track you across other apps or websites, so it does not respond to "Do Not Track" signals.

Elsewhere: where the law of your country gives you further rights, write to us and we will honour them.

We answer every request within 30 days.

Changes

When the app starts to handle data in a new way, this policy is updated first.

Last changed: November 2026.