Privacy Policy for Hetki
Last updated: 26 October 2026
Hetki is a private photo journal. You keep moments — a photograph, a few words, sometimes a mood — and once in a while Hetki weaves a stretch of them into a reflection you can read back.
What you write in Hetki is yours. This policy explains, in plain terms, what is stored, where it goes, and how to get it back or get rid of it.
Who is responsible
Hetki is developed and operated by M. Bagaskoro Triwicaksana S., Indonesia.
For anything in this policy, including any request about your data, write to hello@hetki.app.
What Hetki stores
Your journal. The photographs you add, the text you write, the mood you choose, the place you type if you type one, and the date and time each moment belongs to. A place is only ever what you wrote. Hetki has no map and never asks your phone where it is. If you record a voice note, the audio file and its transcript. Reflections that Hetki has written for you.
Your Private Journal, if you keep one: the pages you write and the pictures you place in them.
My plan, if you use it: the plans you write, when you tick them, and which moment a plan became, if you kept one as a moment.
The version of Hetki you use, written to your account when it changes, so we can help when something goes wrong. Nothing about your phone is recorded with it.
Your PIN, and what it locks. If you make a PIN, it guards your Private Journal and any moment or reflection you choose to lock. The PIN is stored only in a scrambled form that cannot be read back, never as the numbers themselves, and it is checked on Hetki’s servers. So that it also works without a connection, your phone keeps its own scrambled copy, sealed by the phone’s secure hardware. Whether a moment or a reflection is locked is stored with it. A lock keeps something out of sight in the app; it is not encryption — a locked moment is stored exactly like any other.
Hetki also keeps a history of your PIN: when it was made, changed or reset, how it was reset, and the model name of the phone it happened on (for example Samsung Galaxy A15), so you can see in Settings when your lock was touched. It holds no serial number, no location and no IP address, and it cannot be edited or deleted on its own.
If you forget your PIN, you can make a new one with your phone’s screen lock or with a link sent to your email. With the screen lock, Hetki asks Android to check it. Your fingerprint, your face and your phone’s own PIN or pattern are checked by your phone and never reach Hetki, which learns only whether the check passed. To prove that check to the server, your phone makes a key in its secure hardware that only its screen lock can use: the public half is stored with your account, and the private half never leaves the phone. A reset link works once, for one hour, and only a scrambled form of it is stored.
Emails Hetki sends you. Only to the address on your account, and only these: confirming that address, resetting your password, a link to reset your PIN when you ask for one, and a short notice whenever your PIN is changed or reset — so that you would know if it was not you.
Your account. When you first open Hetki, an anonymous account is created so your moments have somewhere to live. It holds no name, no email address, and nothing that identifies you. If you later choose to add an email address and password so your journal can be restored on another device, that email address is stored. Passwords are never stored as written — only as a cryptographic hash that cannot be reversed.
Your name, and a line about yourself — if you write them. Hetki does not ask who you are in order to work. If you choose to add a name, your close friends see it, and it stays on any moment you give them. If you write a line about yourself, only you ever see it: it is never sent to another person, never attached to a shared moment, and never given to the AI.
Your settings. Which theme you have chosen, and whether you have a Hobby subscription.
Your subscription. If you subscribe, Google Play sends a purchase token, the plan you chose, and when it renews or expires. Hetki never sees, receives, or stores your card details or billing address. Those stay with Google.
Technical records. Sign-in attempts are logged with an IP address and a timestamp, which is what makes it possible to notice someone trying to break into an account. Google Play may also provide anonymous crash reports if the app stops unexpectedly.
Usage statistics — only if you turn them on. Hetki can record anonymous counts of which screens are opened and which features are used — for example, that a reflection was created, or that saving to the backup failed and at which step. This is off unless you choose it: the box starts unticked, and nothing is sent until you tick it yourself. You can turn it on or off at any time in Profile, under Data & privacy, and turning it off is exactly as easy as turning it on.
The content of your journal is never part of this, whichever way you set it. No photograph, no sentence you have written, and no mood is ever sent as part of usage statistics.
If you do turn them on, each of those counts arrives alongside ordinary technical details about the device it came from: the phone’s make and model, its Android version, the app version, your language, your time zone, whether you were on Wi-Fi or mobile data, and your mobile operator. There is no advertising identifier and no account details — the app is identified to PostHog only by a random number made on your phone, which is thrown away and made afresh if you ever switch usage statistics off and on again.
Where it is stored
Your journal is stored on servers in Germany, inside the European Union, operated by Supabase. Photographs and voice notes are held in private storage that is not reachable by a public address; the app opens them through short-lived signed links that only your own account can request.
A backup copy of your photographs and voice notes is kept in a private Cloudflare R2 bucket held in the European Union, so they can be recovered if the main storage ever fails. Nobody opens it; it is only ever read to put files back. When you delete something for good, its backup copy is removed within 30 days after.
Artificial intelligence, and exactly what it is given
Three features in Hetki use an AI model operated by OpenAI. Each one runs only when you ask for it. Nothing is sent to any AI model on its own.
Your Private Journal is never sent to any AI model, for any reason. No feature in Hetki reads it except the one you write it in.
My plan is never sent to any AI model either.
Reflections. When you ask Hetki to weave a reflection, it sends the date, time, mood, place and text of the moments in the range you chose, and — since 26 September 2026 — whether you marked each one as a favourite and the name of its label, if it has one, so the reflection can see what you hold close and what you grouped together. The place is only ever what you typed yourself — Hetki has no map, asks for no location permission, and never records where your phone is.
If a moment in that range was given to you by a close friend, their name goes with it, because it is written on the moment and the reflection has to be able to say who was there. If you have given that person a private label, the label goes too, so a reflection can say your mother rather than only their name. Both are sent for that one request and nothing else; the label is still never shown to the person it describes.
A locked moment is left out of a reflection unless you choose to include it, which asks for your PIN first.
Your photographs are never sent. Neither is your email address, your own name, or your account identifier.
Polishing an entry. When you tap the polish button, the text of that one entry is sent, and a suggestion comes back. Your original wording is kept, so you can always return to what you actually wrote.
Voice notes. If you record one, the audio is sent to be transcribed into text. Nothing is saved until you have seen the result.
OpenAI processes this on Hetki’s behalf and is not permitted to use it to train its models. If you never use these features, nothing you write ever leaves the European servers.
Who else receives anything
Nobody buys your data, because it is not for sale. It is never used for advertising, and it is never shared for anyone else’s marketing.
One person can receive something, and only because you send it — see Close friends, and moments you give away below.
Seven companies process data strictly on Hetki’s instructions:
- Supabase — stores your journal, in Germany.
- OpenAI — the AI features described above, and only when you ask.
- Google Play — handles payment and tells Hetki whether a subscription is active.
- PostHog — anonymous usage statistics, never journal content, and only if you have turned them on.
- Cloudflare — serves the website at hetki.app, counts visits to it, and holds the backup copy of your photographs and voice notes, in the European Union.
- Google Firebase Cloud Messaging — delivers the one notification Hetki sends, and only if you have turned it on (below).
- Resend — sends the emails described above, from hello@hetki.app: confirming your address, resetting a password or a PIN, and the notice when your PIN changes. It receives your email address and the message, and nothing from your journal.
Beyond these, information is disclosed only where the law genuinely requires it.
About the website. hetki.app is a handful of plain pages. It has no accounts, no forms and nothing to log in to, and your journal is not reachable from it. Visits are counted using Cloudflare Web Analytics, which uses no cookies, builds no fingerprint of your browser, and creates no identifier that could follow you to another site. It reports only totals — how many people opened a page, and which page. Because none of that is personal data, the site does not ask you to accept anything, and there is no banner to dismiss.
Close friends, and moments you give away
Hetki is a private journal. Nothing in it is shared unless you deliberately send it, one moment at a time, to one person you have already added.
How somebody becomes a close friend. You show a code on your screen and they scan it, standing next to you. There is no directory, no search, and no way for anyone to find you by your name or your email address — a stranger cannot reach you at all. The code lives five minutes and works once. Whoever was scanned then has to accept.
What a close friend can see about you. Your name, and nothing else. Not your email address, not your journal, not the line you wrote about yourself, not what you have kept or when.
What you call them is yours alone. You can add a private label to a close friend — Mama, my brother, whatever helps you know who they are. They never see it. It is stored against your account, not theirs, and no screen in Hetki shows it to anybody but you. It travels in your data export and it is deleted with your account. It never appears on a moment you give them.
The one other place it is used is a reflection: if you ask Hetki to weave one and a moment in it came from that person, the label is sent with their name so the writing can call them what you call them. That is described under AI features above.
What travels when you give a moment. The photographs, the words as they read, the mood, and the date it happened, together with your name. If you write one, a short note of up to 120 characters goes with it, and the envelope you chose. If they keep the moment, your note stays on their copy. Two things stay behind: any voice note, and, if you used Hetki’s writing help, the draft you wrote before it — what travels is the version you kept.
It is a copy, and you cannot take it back. Once they add it to their own moments it is theirs: to keep, to change, to delete, or to share onward. The app says this before you send. If you change your mind before they have added it, deleting the moment withdraws the offer, and otherwise it disappears on its own after seven days — and you can ask them to delete it, exactly as you would about a photograph sent by any other means.
The one notification. Hetki sends a single kind of notification: a close friend gave you a moment. It says who and nothing else — no photograph and no words from the moment, because it appears on your lock screen. It is off until you say yes, and you can turn it off in Settings at any time. While it is on, Hetki keeps a token for your phone from Google Firebase Cloud Messaging, which is the address a notification is delivered to; it identifies the app on this phone, not you. The token is removed when you turn notifications off, when you sign out, and when you delete your account. Nothing else is ever sent to your phone as a notification.
What comes back. When you give a moment, you can see whether they kept it, turned it down, or did not answer within seven days. When they answer, or before they do, they may write you one short note, up to 140 characters. The same is true the other way round: when a close friend gives you a moment, they can see what you chose, and the note if you write one. A note, either way, is only ever shown to the other person in that exchange, and is never sent to any AI model.
If you remove a close friend, they cannot add you again, and no moment can pass between you. Moments either of you has already accepted stay where they are, because by then they belong to the person holding them.
Your name on a moment you gave away outlives your account. If you delete your account, that name stays on their copy — it is part of their moment now, not part of yours. Everything else about you is removed.
We rely on your consent for this, given each time you send. You are never asked to share anything, no part of Hetki is withheld until you do, and the app never suggests it.
Why Hetki is allowed to hold this
Under the GDPR, your journal is stored so that Hetki can do the thing you installed it for — keep and show your moments. That is performance of our agreement with you. The AI features run on your specific request each time. Security logs exist because running a service safely is a legitimate interest.
Usage statistics rest on your consent, and on nothing else. They help us understand which parts of Hetki are worth building on, but that is our reason for asking, not a right to take them. Withdraw it whenever you like; the app works identically either way, and Hetki will never ask you to turn them back on.
How long it is kept
Your moments stay until you delete them.
When you delete a moment it goes to Recently deleted for 30 days, so nothing is lost to a mistaken tap. After 30 days it is permanently removed, including its photographs and any voice note.
Reflections you have already made keep their own copy. When Hetki weaves a reflection it takes a copy of each moment it used — the day, the story, and the cover photograph — so that a piece you have read, exported or shared does not quietly change afterwards. Deleting the moment does not reach back into a reflection that already exists. Those copies live inside the reflection and nowhere else, they are never used to rebuild your journal, and deleting the reflection deletes them, after the same 30 days.
If you delete a moment while an offer of it is still waiting, the offer is withdrawn and deleted straight away, along with everything frozen into it.
When you offer a moment to a close friend, everything frozen into the offer — the words, the formatting, the mood, your note, and where its photographs are — is deleted after 7 days, whether or not they added it. What remains is a small record for you: who it went to, what they chose, and their note if they wrote one. That record is deleted when your moment is permanently deleted, or when either of you deletes your account.
Your PIN history is kept for as long as your account. A PIN reset link stops working after one hour; the record that one was sent stays in your PIN history.
If you delete your account, everything — moments, photographs, voice notes, reflections, your PIN, its history, the keys your phones registered for it, and the account itself — is permanently removed. The one exception is described above: your name stays on a moment somebody else has already accepted, because that moment is theirs.
Your rights
If you are in the European Union or the United Kingdom, you have the right to ask for a copy of your data, to correct it, to delete it, to receive it in a portable form, to restrict how it is used, and to object to that use.
Two of these do not require asking anyone. Export my data in Profile gives you everything you have written, in an open format. Delete account, also in Profile, removes it all.
For anything else, write to hello@hetki.app. You will have an answer within 30 days.
If you believe your data has been mishandled, you may complain to your national data protection authority. You do not need our permission, and you do not need to contact us first.
Children
Hetki is intended for adults. It is not directed at children, and no account is knowingly created for anyone under 18. If you believe someone under 18 has created one, write to us and it will be removed.
Security
Traffic between the app and its servers is encrypted. Every database record is protected by rules that make one account’s rows unreadable to any other. Photographs and voice notes sit in private storage. Passwords are stored only as irreversible hashes. Your PIN is checked on the server, and repeated wrong guesses are first slowed and then stopped until the PIN is reset.
No system is perfect, and anyone who claims otherwise is selling something. If a breach ever affects your data, you will be told, and so will the relevant authority, within the time the law requires.
Changes to this policy
If this policy changes in a way that matters, the date at the top will change and you will be told inside the app before the change takes effect. Changes are never applied retroactively to data already collected.
Contact
M. Bagaskoro Triwicaksana S. Indonesia hello@hetki.app