Privacy policy

Personalization runs on your device. What hamir learns about your reading — the topics you engage with, the feeds you keep, what you skip — stays encrypted on your iPhone. That profile never reaches hamir's servers.

What does reach the server is the minimum to make the app work: your account, the sources you follow, and a small amount of anonymous usage telemetry. If you turn on Cross-device sync (Settings → Privacy & Security → Cross-device sync), your profile also syncs between your Apple devices through iCloud, and the articles you save are kept in your account so they can follow you to a device on another platform.

hamir is built by one person. hamir doesn't and never will track you for marketing or display ads.

Your reading profile — the topics, tags, domains, and feeds you engage with, and what you skip — is built from your taps and swipes. It's encrypted with AES-GCM-256 and the key lives in iOS Keychain. With Cross-device sync on, the encrypted profile syncs between your Apple devices through iCloud Key-Value Storage and its key through iCloud Keychain; Apple's end-to-end encryption means neither Apple nor hamir can read it.

Some sources are fetched directly by your device instead of hamir's servers — restricted-tier sources, sources hamir won't carry, private sources in a folder someone hands you, and reading lists you import. Those sources, the folders you file them in, the bookmarks you save from them, and your highlights and watched keywords stay on your device; with sync turned on they replicate between your Apple devices through your iCloud private database (CloudKit), separate from iCloud Keychain. hamir's servers never see this data; with Advanced Data Protection enabled, the records are end-to-end encrypted and even Apple can't read them. (Sources that need a login to fetch are handled differently — see credentials below.)

When you hand a folder to someone, the app seals it — its name, its sources, and any private addresses in it — into a file or QR code, encrypted with a code you pass on separately. hamir's servers never receive the file or the code. The recipient's device opens it: catalogue sources are then followed through their account like any other, and private addresses stay on their device.

The app carries hashed signatures of child sexual abuse material and refuses a matching source before any request is made. They are digests, not words, and a refusal sends nothing anywhere.

Your interactions — what you skip, open, and how long you read — are never stored against your account on hamir's servers; they only shape recommendations on your phone. The anonymous usage events described below are the one trace that leaves the device, and they carry no account link.

With Cross-device sync on, the only reading signal written to hamir's servers is the articles you save (see Saved posts below), which the server also uses to rank recommendations for your account. Skips, opens, and reading time stay on the device either way.

Restricted Mode (parental controls) is enforced on the device. The guardian PIN is stored only in the device keychain, as a salted hash — it never leaves the device, and hamir cannot see or recover it.

hamir doesn't train models on your reading behaviour or skip history. The topic classifier is trained on labelled articles, not on user activity.

Each entry below lives only as long as your account does, unless noted otherwise.

Account identity — a server-generated UUID, your nickname, and an avatar URL if your sign-in provider sends one.

Sign-in identities — one record per provider you've used (Apple, Google, GitHub): the provider's stable ID and the avatar URL. We don't store the email the provider returns; the app keeps it on your device only, so you can see which account a connection is.

Source subscriptions — the feeds and sources you've added, the folders you group them in, and the review outcome of sources you submit to the public catalog.

Private source credentials (only if you add them) — when a source needs a sign-in or token to fetch, those credentials are stored encrypted at rest and used only to fetch that source for you. Removed when you disconnect them, remove the source, or delete the account.

Saved posts (opt-in sync) — your saved list lives on the device by default; nothing about a save reaches your account unless you enable sync (Settings → Privacy & Security → Cross-device sync). With sync on, saves are stored in your account so the list can follow you across devices, and hamir also keeps an end-to-end-encrypted backup of your saved-posts index — the server holds only ciphertext; the key stays on your devices. Bookmarks from device-fetched private sources never reach the server.

Push token (opt-in) — the APNs token, with device locale, timezone, and app version, used to send and localize notifications; kept only if you've enabled push. Cleared on logout or when you turn notifications off, and expires automatically after long inactivity.

Anonymous usage events — impressions, screen views, time-on-card. Stored without a user_id column, so rows can't be re-linked to you after insert. Auto-deleted after 180 days. You can turn this stream off entirely (Settings → Privacy & Security → Analytics); switching it off also discards any events not yet sent.

Content reports — if you report an article, hamir keeps the report (the article, the reason, your account) while it's reviewed. Deleted with your account.

Moderation log — when a source you submit to the public catalogue matches a safety blocklist, the attempt is recorded against your account and used only for abuse prevention. Adding a source for yourself leaves no record: a child sexual abuse source is refused outright, and any other blocked source is handed back for you to keep on your device. Retained up to 2 years; on account deletion the user attribution is removed and only the anonymized row stays. To stop ban evasion, hamir may also record that the same device appeared on more than one account — stored as a hashed device token, never the raw value.

Audit trail — privacy-relevant events (account deletion, for example) are recorded with a one-way hash of the account ID and no other identifying data, so hamir can prove the event happened after the account is gone.

Crash and error reports (optional) — stack traces sent to a self-hosted error tracker. You can turn them off at any time (Settings → Privacy & Security → Crash & performance reports); while they're off, neither the app nor hamir's server reports errors from your requests. User identifiers, IP addresses, request headers, and cookies are removed before each report is sent — on your device for app crashes, on the server for backend errors — and the server also masks what you searched for. The server's own warning and error log lines go to the same tracker, under the same switch and with the same identifiers and addresses removed. No third-party vendor receives this data. Deleted after 90 days.

Operational logs (HTTP requests with IP address, user-agent, path, and timestamp; background-job traces) — deleted automatically after 30 days.

Apple processes in-app purchases through StoreKit; card numbers and billing details never reach hamir. hamir checks your supporter status on-device through StoreKit to unlock benefits — no purchase data is sent to or stored on hamir's servers.

Account identity, sign-in identities, subscriptions, private-source credentials, saved posts: Article 6(1)(b) — necessary to provide the service.

Push token: Article 6(1)(a) — consent. Opt in via the system push dialog, revoke any time.

Anonymous usage events, content reports, moderation log, audit trail, crash reports: Article 6(1)(f) — legitimate interest in measuring product performance, preventing abuse, and maintaining stability, balanced by data minimisation (no user_id on telemetry, anonymized retention on moderation, hashed identifiers on the audit trail, scrubbing on crash reports). Usage events and crash reports each have their own switch, so you can object to either at any time (Article 21).

Sign-in providers — Apple, Google, GitHub. When you choose one, they handle authentication; hamir keeps the identifier and avatar they share. Any email or name they send is used only to complete sign-in and isn't stored on our servers.

Apple Push Notification service — used only if you've enabled push.

Apple iCloud — Key-Value Storage and Keychain for the encrypted profile, and your iCloud private database (CloudKit) for device-only sources, bookmarks, highlights, and watched keywords. Used only with Cross-device sync on. hamir doesn't see the payload; Apple is the data controller for the sync channel.

Apple StoreKit — handles in-app purchases.

Hosting and infrastructure — a cloud hosting provider in the EU West region runs the servers, databases, and operational logging.

Content delivery network — the app downloads its on-device ML model files from a CDN. Like any web host, the CDN sees your device's IP address for that download and nothing else.

Safety blocklists — hamir's server periodically downloads public blocklists (oisd, StevenBlack hosts, abuse.ch, CERT.PL, OpenPhish, and similar) to keep unsafe sources out of the public catalogue. The lists travel one way — no user data goes to these projects.

hamir doesn't use third-party analytics SDKs, advertising networks, or data brokers, and shows no App Tracking Transparency prompt — nothing here tracks you across other apps.

hamir's servers run in the European Union. Sign-in providers and Apple services process data on their own infrastructure under their own policies; any Apple-side transfers to US infrastructure are covered by Apple's Standard Contractual Clauses with its EU subsidiaries.

The hamir.app website provides sign-in, these legal pages, a status page, and a small signed-in reader (your library and feeds). Signing in on the web sets a strictly necessary session cookie; there are no tracking or advertising cookies.

When you visit the site, the server logs the request (IP address, user-agent, path, timestamp) for 30 days for operational and abuse-prevention purposes, then those logs are deleted automatically. There are no third-party analytics, ad trackers, or session-replay tools. There's no third-party CDN — your browser talks to the hosting infrastructure directly.

hamir offers a public connector (an MCP server at hamir.app/mcp) so AI assistants such as Claude or ChatGPT can search hamir's public catalogue of sources, articles, and packs. It needs no account and can't see your library, your sources, or your reading profile.

Each call carries what the assistant asked for, such as a search, and a language. hamir uses it to answer the call and keeps it out of storage, logs, and error reports. Like any request, the call is logged with IP address, user-agent, path, and timestamp for 30 days, and the IP address counts toward rate limits that reset within five minutes.

Error reports from these calls are off unless you turn them on in the hamir desktop extension. Your conversation stays with the assistant's provider, under its own policy; hamir never receives it.

Wherever you live, you can export your data (built-in account export), correct your nickname directly in the app, delete your account via the in-app flow, and withdraw consent for push notifications (toggle them off in iOS Settings or in the app). hamir aims to answer data requests within one month, as GDPR Article 12 requires; complex requests can take up to three months, with notice.

When you delete your account, hamir purges all account records (sign-in identities, source subscriptions and folders, saved posts and interaction history, content reports, push registrations, export tokens, encrypted backups, private sources with their credentials) and invalidates your tokens. The moderation log keeps only anonymized rows, and the audit trail keeps only a hashed identifier.

hamir is not for users under 16. If a minor's account is reported, hamir deletes it.

If hamir suffers a data incident that puts your data at risk, hamir notifies affected users within 72 hours of becoming aware, as required under GDPR Article 33, with what happened, what data is involved, and what to do.

GDPR (EU / EEA / UK). If you're in the EU, EEA, or UK, you additionally have access (Article 15), rectification (16), erasure (17), and portability (20) — covered by the export, nickname-edit, and account-delete flows above; restriction or objection to processing (Articles 18 and 21) — email hello@hamir.app; withdrawal of any consent given (Article 7(3)); and the right to lodge a complaint with your local data-protection authority directly.

California (CCPA / CPRA). You also have the rights to know, delete, correct, opt out of sale or sharing (hamir doesn't sell or share for cross-context advertising), limit use of sensitive information (hamir doesn't collect any as California defines it), and non-discrimination for exercising any of these.

Data controller. hamir is built and operated by a private individual based in Lviv, Ukraine. Contact for all data-protection matters: hello@hamir.app, or by post: PO Box 540, 2 Martovycha St., Lviv, Ukraine.

Have additional questions? Email hello@hamir.app. Material changes to this policy land in the app or release notes before they take effect.