Privacy
What you write in x369 stays in the storage the app uses on your device. It does not go to us and it does not go to third parties. We have no access to it. We cannot read it, hand it over or delete it. This is not a promise about our intentions but a property of the app: there is no server anything could go to.
One thing follows from this that most privacy policies leave unsaid: for your entries we are not the controller within the meaning of Article 4(7) of the GDPR, because we do not process them. We are the controller for this website and for the email you send us. The rest of this text is about that alone.
Ankarina OÜ (osaühing, a private limited company under Estonian law) Sepapaja tn 6 Lasnamäe linnaosa 15551 Tallinn Estonia
Represented by Anna Lippmann. Questions about privacy go to hello@ankarina.com.
We are not required to appoint a data protection officer: the conditions of Article 37(1) of the GDPR are not met.
Your affirmations, written entries, vision board cards, mantras, moon affirmations, your name and your intention are held in the app’s local storage. On the iPhone, x369 additionally keeps a copy in the device settings of the same app, because iOS may clear the storage of an embedded web view under memory pressure, and whole cycles would otherwise be lost.
Both are storage of information on your device within the meaning of Article 5(3) of Directive 2002/58/EC (ePrivacy Directive) and the national laws implementing it, such as § 25 of the German TDDDG. We do not need your consent for this, because the exception for storage that is strictly necessary to provide a service you have explicitly requested applies: without this storage there is no app. That is why x369 shows you no consent dialog. There would be nothing in it to decide.
There is no analytics, no tracking pixel, no advertising identifier, no crash reporting and no fonts loaded from third-party servers.
If you enter the address of an image on a card, your device fetches that image from the third-party server it belongs to. That server sees the IP address of your device and the identifier of your browser and can infer from them when you look at the card. What it does with that is governed by its own rules, not by this text.
We learn nothing of it. You choose the address, your device triggers the request, and the image is visible to you alone. If you would rather avoid this, use a color area for the card. x369 accepts only addresses that begin with https and does not tell the server which page the request comes from.
The backup you create yourself contains your entries in plain text. It is created on your device and goes through the system share sheet to wherever you put it. From then on it is in your hands: whatever ends up in a cloud, in an email or in a messenger is subject to the rules of that provider. We do not receive a copy.
The three reminders at your fixed times are set by your device itself. There is no notification service, no device token and no registration with a server. The times you set are held in the same local storage as everything else.
When you open x369.hekether.com, our hosting provider records the usual access data: IP address, date and time, the address requested, the amount of data transferred, and browser and operating system identifiers. A page cannot be delivered without this.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest is the reliable and secure operation of the site. The only recipient is our hosting provider, which processes the data on our behalf under Article 28 of the GDPR. The records are deleted as soon as they are no longer needed for operating the site and defending it against attacks.
That hosting provider is Cloudflare, Inc., San Francisco, USA. The site runs on their Cloudflare Pages service, and the access data described above arises there while a page is delivered. The legal basis remains Article 6(1)(f) of the GDPR. Cloudflare operates a worldwide network of servers, so this data may be transferred to the United States.
The site loads nothing from third-party servers: no fonts, no scripts, no maps, no embedded videos. It sets no cookies and includes no audience measurement tool.
If you send an email to hello@ankarina.com, we process your address and the content in order to reply. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest is answering your enquiry. We keep such correspondence while the matter is open, and afterwards only as far as a statutory retention duty requires.
If you download x369 from the App Store, Apple processes data of its own, such as your Apple Account and the download itself. Apple is the controller for this, not us. We receive from Apple only aggregated figures from which no individual person can be identified.
You have the rights under Articles 15 to 21 of the GDPR: access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, contact the address above.
For your entries in the app these rights come to nothing with us, and that is to your advantage: we hold nothing we could give you access to. Control lies entirely with you. In the footer of the app, the button Reset app deletes everything x369 has created, and removing the app takes the rest with it.
If you believe we are handling your data incorrectly, you can lodge a complaint with a supervisory authority (Article 77 of the GDPR). The authority responsible for us is the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, info@aki.ee. If you live or work in another EU or EEA country, you can also contact the authority there.
There is no automated decision-making and no profiling within the meaning of Article 22 of the GDPR. x369 evaluates nothing about you and builds no profile.
If anything material changes in these principles, we change this text before the function in question is released. If a transfer to us were ever added, such as an account or a cloud backup, that would be a different promise, and we would ask you first.