Privacy policy

Personalization runs on your device. What hamir learns about your reading — the topics you engage with, the feeds you keep, what you skip — stays encrypted on your iPhone and syncs between your Apple devices through iCloud Keychain. Nothing about that profile reaches hamir's servers by default.

What does reach the server is the minimum to make the app work: your account, the sources you follow, the articles you save, and a small amount of anonymous usage telemetry. Your reading profile and interaction history sync to the server only if you opt in (Settings → Privacy & Security → Sync saved posts to server), so the same profile can follow you to a device on another platform.

hamir is built by one person. hamir doesn't and never will track you for marketing or display ads.

Your reading profile — the topics, tags, domains, and feeds you engage with, and what you skip — is built from your taps and swipes. It's encrypted with AES-GCM-256, the key lives in iOS Keychain, and the encrypted payload syncs between your Apple devices via iCloud Keychain. Apple's end-to-end encryption means neither Apple nor hamir can read it.

Some sources are fetched directly by your device instead of hamir's servers — restricted-tier sources and reading lists you import. Those sources, and the bookmarks you save from them, stay on your device; with sync turned on they replicate between your Apple devices through your iCloud private database (CloudKit), separate from iCloud Keychain. hamir's servers never see this data; with Advanced Data Protection enabled, the records are end-to-end encrypted and even Apple can't read them. (Sources that need a login to fetch are handled differently — see credentials below.)

Your interactions — what you skip, open, and how long you read — are never stored against your account on hamir's servers; they only shape recommendations on your phone. The anonymous usage events described below are the one trace that leaves the device, and they carry no account link.

If you turn on cross-platform sync (Settings → Privacy & Security → Sync saved posts to server), interaction history is written to hamir's servers so other devices in your account can read the same profile. Wiped when the account is deleted.

Restricted Mode (parental controls) is enforced on the device. The guardian PIN is stored only in the device keychain, as a salted hash — it never leaves the device, and hamir cannot see or recover it.

hamir doesn't train models on your reading behaviour or skip history. The topic classifier is trained on labelled articles, not on user activity.

Each entry below lives only as long as your account does, unless noted otherwise.

Account identity — a server-generated UUID, your nickname, and an avatar URL if your sign-in provider sends one.

Sign-in identities — one record per provider you've used (Apple, Google, GitHub): the provider's stable ID and the avatar URL. We don't store the email the provider returns; the app keeps it on your device only, so you can see which account a connection is.

Source subscriptions — the feeds and sources you've added, the folders you group them in, and the review outcome of sources you submit to the public catalog.

Private source credentials (only if you add them) — when a source needs a sign-in or token to fetch, those credentials are stored encrypted at rest and used only to fetch that source for you. Removed when you disconnect them, remove the source, or delete the account.

Saved posts (opt-in sync) — your saved list lives on the device by default; nothing about a save reaches your account unless you enable sync (Settings → Privacy & Security → Sync saved posts to server). With sync on, saves are stored in your account so the list can follow you across devices, and hamir also keeps an end-to-end-encrypted backup of your saved-posts index — the server holds only ciphertext; the key stays on your devices. Bookmarks from device-fetched private sources never reach the server.

Push token (opt-in) — the APNs token, with device locale, timezone, and app version, used to send and localize notifications; kept only if you've enabled push. Cleared on logout or when you turn notifications off, and expires automatically after long inactivity.

Anonymous usage events — impressions, screen views, time-on-card. Stored without a user_id column, so rows can't be re-linked to you after insert. Auto-deleted after 180 days. You can turn this stream off entirely (Settings → Privacy & Security → Analytics); switching it off also discards any events not yet sent.

Content reports — if you report an article, hamir keeps the report (the article, the reason, your account) while it's reviewed. Deleted with your account.

Moderation log — attempts to add blocked sources, linked to the account that made the attempt; used only for abuse prevention. Retained up to 2 years; on account deletion the user attribution is removed and only the anonymized row stays. To stop ban evasion, hamir may also record that the same device appeared on more than one account — stored as a hashed device token, never the raw value.

Audit trail — privacy-relevant events (account deletion, for example) are recorded with a one-way hash of the account ID and no other identifying data, so hamir can prove the event happened after the account is gone.

Crash and error reports — stack traces sent to a self-hosted error tracker. User identifiers, request headers, and cookies are scrubbed before each report is sent — on your device for app crashes, on the server for backend errors. No third-party vendor receives this data.

Operational logs (HTTP requests, background-job traces) — a few days at most, then expire automatically.

Apple processes in-app purchases through StoreKit; card numbers and billing details never reach hamir. hamir checks your supporter status on-device through StoreKit to unlock benefits — no purchase data is sent to or stored on hamir's servers.

Account identity, sign-in identities, subscriptions, private-source credentials, saved posts: Article 6(1)(b) — necessary to provide the service.

Push token: Article 6(1)(a) — consent. Opt in via the system push dialog, revoke any time.

Anonymous usage events, content reports, moderation log, audit trail, crash reports: Article 6(1)(f) — legitimate interest in measuring product performance, preventing abuse, and maintaining stability, balanced by data minimisation (no user_id on telemetry, anonymized retention on moderation, hashed identifiers on the audit trail, scrubbing on crash reports).

Sign-in providers — Apple, Google, GitHub. When you choose one, they handle authentication; hamir keeps the identifier and avatar they share. Any email or name they send is used only to complete sign-in and isn't stored on our servers.

Apple Push Notification service — used only if you've enabled push.

Apple iCloud Keychain + iCloud Key-Value Storage — used for the encrypted on-device profile sync. hamir doesn't see the payload; Apple is the data controller for the sync channel.

Apple StoreKit — handles in-app purchases.

Hosting and infrastructure — a cloud hosting provider in the EU West region runs the servers, databases, and operational logging.

Content delivery network — the app downloads its on-device ML model files from a CDN. Like any web host, the CDN sees your device's IP address for that download and nothing else.

Safety blocklists — hamir's server periodically downloads public blocklists (oisd, StevenBlack hosts, abuse.ch, CERT.PL, OpenPhish, and similar) to rate and block unsafe sources. The lists travel one way — no user data goes to these projects.

hamir doesn't use third-party analytics SDKs, advertising networks, or data brokers, and shows no App Tracking Transparency prompt — nothing here tracks you across other apps.

hamir's servers run in the European Union. Sign-in providers and Apple services process data on their own infrastructure under their own policies; any Apple-side transfers to US infrastructure are covered by Apple's Standard Contractual Clauses with its EU subsidiaries.

The hamir.app website provides sign-in, these legal pages, a status page, and a small signed-in reader (your library and feeds). Signing in on the web sets a strictly necessary session cookie; there are no tracking or advertising cookies.

When you visit the site, the server logs the request (IP address, user-agent, path, timestamp) for a few days for operational and abuse-prevention purposes, then those logs expire automatically. There are no third-party analytics, ad trackers, or session-replay tools. There's no third-party CDN — your browser talks to the hosting infrastructure directly.

Wherever you live, you can export your data (built-in account export), correct your nickname directly in the app, delete your account via the in-app flow, and withdraw consent for push notifications (toggle them off in iOS Settings or in the app). hamir aims to answer data requests within one month, as GDPR Article 12 requires; complex requests can take up to three months, with notice.

When you delete your account, hamir purges all account records (sign-in identities, source subscriptions and folders, saved posts and interaction history, content reports, push registrations, export tokens, encrypted backups, private sources with their credentials) and invalidates your tokens. The moderation log keeps only anonymized rows, and the audit trail keeps only a hashed identifier.

hamir is not for users under 16. If a minor's account is reported, hamir deletes it.

If hamir suffers a data incident that puts your data at risk, hamir notifies affected users within 72 hours of becoming aware, as required under GDPR Article 33, with what happened, what data is involved, and what to do.

GDPR (EU / EEA / UK). If you're in the EU, EEA, or UK, you additionally have access (Article 15), rectification (16), erasure (17), and portability (20) — covered by the export, nickname-edit, and account-delete flows above; restriction or objection to processing (Articles 18 and 21) — email hello@hamir.app; withdrawal of any consent given (Article 7(3)); and the right to lodge a complaint with your local data-protection authority directly.

California (CCPA / CPRA). You also have the rights to know, delete, correct, opt out of sale or sharing (hamir doesn't sell or share for cross-context advertising), limit use of sensitive information (hamir doesn't collect any as California defines it), and non-discrimination for exercising any of these.

Data controller. hamir is built and operated by a private individual based in Lviv, Ukraine. Contact for all data-protection matters: hello@hamir.app, or by post: PO Box 540, 2 Martovycha St., Lviv, Ukraine.

Have additional questions? Email hello@hamir.app. Material changes to this policy land in the app or release notes before they take effect.