Your Data Is a Temple
HEKA Calendar is built on a local-first covenant: by default, everything lives on your device. When you choose cloud, enterprise, or AI features, your data is handled by secure server-side services we control — never sold, never mined, and always auditable.
Data Storage
Your notes, journal entries, birth charts, tracker data, and app preferences are stored in an IndexedDB database on your device using Dexie.js. We cannot access this data, we do not back it up, and it cannot be recovered if you lose your device unless you have enabled cloud sync or performed a manual export.
| Data Type | Purpose | Storage |
|---|---|---|
| Daily Notes | Calendar day notes with categories and timestamps | Device Only |
| Journal Entries | Oracle Journal entries with markdown, tags, mood, and revision history | Device Only |
| Birth Charts | Astrological profiles, natal charts, and transit calculations | Device Only |
| Daily Oracle Cards | Generated oracle cards, celestial snapshots, and draw history | Device Only |
| Reflection Data | Daily mood, rest quality, vitality, and custom reflections | Device Only |
| App Settings | Theme, location, zodiac preferences, notifications, language | Device Only |
| Notifications | Task reminders, celestial alerts, tracker reminders, daily reflections | Device Only |
| Search Index | Full-text search index of journal entries for fast lookup | Device Only |
| PDF Export | Print-to-PDF output generated locally | Device Only |
| Cloud Sync Data | Encrypted copy of selected data for cross-device sync | Firebase Firestore |
| Community Voting | Feature requests, holiday submissions, energy voting | Cloud (with UID) |
| Social Data | Friends, messages, task shares, online presence (Cosmic Circle) | Cloud (encrypted) |
GDPR & CCPA Compliance
What Runs in the Cloud
When you enable cloud, premium, or enterprise features, HEKA Calendar uses serverless Firebase Functions deployed in australia-southeast1. These functions never read your local IndexedDB; they only process data you explicitly send to the cloud.
Account Deletion
The deleteUserData function removes your Firebase Auth account, Firestore documents, subcollections, and shared-data references, then writes an immutable audit log. This ensures deletion is complete and verifiable.
Entitlements
The getEntitlements function validates your active subscription tier against Stripe, RevenueCat, or Firebase custom claims. It returns quota limits and feature flags so the client cannot spoof premium status.
Enterprise SSO
The samlLogin and oidcLogin functions verify SAML assertions and OIDC tokens from your organization’s identity provider, create or link your Firebase user, and set enterprise-tier custom claims. Every SSO login is written to an immutable audit log.
Data Categories
📓 Journal & Notes
Calendar notes and Oracle Journal entries including text (plain or markdown), tags, mood ratings, timestamps, and revision history. Stored in IndexedDB with a full-text search index. AI insights use on-device template analysis by default.
🌙 Daily Oracle
One card per day is generated from a real-time celestial snapshot (moon phase, planetary positions, retrogrades, dominant element) computed on-device using Swiss Ephemeris WASM. If you have a birth chart, a personalized note connects the card to your natal Sun sign. Cards and draw history are stored locally.
📊 On-Device Analytics
Tutorial progress, onboarding funnel completion, and pattern recognition events are tracked strictly on-device to improve the user experience. These analytics are never transmitted to external servers. We do not use Google Analytics, third-party advertising, behavioral tracking cookies, or device fingerprinting.
Sensitive Tracking
HEKA Calendar includes comprehensive wellness tracking that may record health-sensitive information. All tracker data is stored locally on your device by default. If you enable cloud synchronization, this data is encrypted before transmission and stored in Firebase.
Reflection categories include: daily reflection (1-10 rating, emotional tone, triggers), rest (duration, quality, factors), vitality (energy level, type), and custom user-defined reflections.
On-device insights: Cycle predictions, fertility windows, PMS predictions, symptom patterns, and health alerts are generated entirely on your device using local algorithms. No health data is sent to external servers for analysis.
LLM Processing
HEKA Calendar offers optional AI-powered features. AI enhancement is entirely opt-in and disabled by default. Without enabling it, all insights, coaching, and analysis use on-device template-based generation — no data leaves your device.
When AI is enabled through the HEKA AI Proxy (hosted on Vercel), your request is sent to our backend, which verifies your Firebase identity, applies per-user rate limits, and forwards the prompt to the selected provider (Groq, OpenAI, Anthropic, or Moonshot) using server-side API keys. The proxy keeps sanitized audit logs for abuse monitoring and rate-limiting; logs truncate message content and redact obvious email addresses.
Advanced users may still connect their own provider API key; in that case, the request is sent directly from the device to the chosen provider and is governed by that provider’s terms.
Sentiment analysis of journal entries is performed entirely on-device using a local lexicon — no text is transmitted for this purpose.
Celestial Features
The Daily Oracle generates one personalized card per day based on a real-time celestial snapshot. Planetary positions, moon phase, retrogrades, and dominant elements are computed on-device using Swiss Ephemeris WASM. No astronomical data is transmitted to external servers.
Weather data is fetched from Open-Meteo (open-meteo.com) using your
latitude and longitude. Sunrise and sunset times are fetched from NOAA Sunrise-Sunset
(sunrise-sunset.org) using the same location. These services receive only coordinates —
no identifying information.
Location: Your location is stored locally and used for astronomical calculations, weather, and sun times. It is never shared with third parties beyond the coordinate-based API calls described above.
Cosmic Circle
The Cosmic Circle enables social features including friend connections, messaging, task sharing, and collaborative rituals. Social data is stored in Firebase Firestore and requires cloud sync to be enabled.
What is stored: Friend profiles and friendship connections, direct messages, shared tasks and task rituals, online presence and last-active status, invite codes and deep links, community holiday submissions, and feature voting (both associated with your Firebase Auth UID).
Shared tasks create public Firestore documents accessible via share code. They include the task details and creator display name. Energy voting uses a locally-generated device ID for anonymous daily participation.
Crisis Detection
To help protect user safety, journal entries are scanned on-device for crisis indicators including references to self-harm, suicide, severe depression, and violence. This scanning uses a local keyword list and occurs entirely on your device — no journal text is transmitted for this purpose.
If concerning language is detected, the app displays local support resources such as the 988 Suicide & Crisis Lifeline and Crisis Text Line. No alerts are sent to us or any third party. This is a user-safety feature designed to provide immediate access to help.
External Providers
🔥 Firebase (Google Cloud)
Cloud sync, authentication, Firestore data, and Cloud Functions are hosted on Firebase / Google Cloud in australia-southeast1. Encryption keys are generated and stored on your device.
⚡ Vercel
The HEKA AI Proxy runs on Vercel. It verifies Firebase tokens, enforces rate limits, forwards AI requests to providers, and writes sanitized audit logs. Provider API keys are stored as Vercel environment variables, never in the client.
🔭 Swiss Ephemeris
Astronomical calculations run entirely on your device via WASM. No birth chart data, location, or personal information is transmitted for astrological computation.
🌤️ Open-Meteo
Weather data is fetched from open-meteo.com using your latitude and longitude.
No API key is required. No identifying information is transmitted.
🌅 NOAA Sunrise-Sunset
Sun rise and set times are fetched from sunrise-sunset.org using your
coordinates. No identifying information is transmitted.
🤖 LLM Providers (Opt-In Only)
Groq, OpenAI, Anthropic, or Moonshot — only when you enable AI. By default requests are routed through the HEKA AI Proxy using server-side keys. Advanced users may connect their own key and send requests directly.
🔤 Google Fonts
The Print-to-PDF feature loads Playfair Display and other fonts from Google's CDN
(fonts.googleapis.com) for styled PDF output.
What We Don't Do
We Don't Use:
- Google Analytics
- Third-party advertising
- Behavioral tracking cookies
- Device fingerprinting
- Selling your data
Network Requests:
- 1.App updates (manual)
- 2.Cloud sync (if enabled)
- 3.Weather & sun times (coordinate-only)
- 4.HEKA AI Proxy (opt-in only)
- 5.Community & social (if enabled)
Age Requirements
HEKA Calendar is not directed to children under 13 years of age. We do not knowingly collect, use, or disclose personal data from children. The app contains wellness tracking features that are intended for adult users. If you believe a child has provided personal information through our services, please contact us immediately for deletion.
Cross-Border Transfers
By default, all data remains on your device in your jurisdiction. If you enable cloud synchronization, encrypted data is stored on Firebase servers in australia-southeast1. For any transfer outside the European Economic Area, we utilize EU Standard Contractual Clauses and maintain appropriate safeguards.
Updates
We may update this privacy policy from time to time to reflect changes in our practices, features, or legal requirements. We will notify you of significant changes through the app or via email if you have provided one. Continued use of HEKA Calendar after changes constitutes acceptance of the updated policy.
Questions?
Last Updated: June 15, 2026