Privacy Policy

Who we are

Holaris is built and run by the Holaris team (“we”, “us”). For privacy questions or requests, email [email protected].

What we collect

• Account: your email address and password (stored only as a secure hash), or your Google/Apple sign-in, which gives us your email, name and photo.
• Date of birth: used only to check you're at least 16 and to keep members under 18 in their own space. It is never shown to anyone.
• Profile: display name, optional bio and photo, interests, languages, conversation style, and your country and timezone (suggested from your device settings, and editable).
• Gender identity and who you'd like to meet: used only so discovery respects everyone's preferences. Never shown to other members.
• What you create: private messages (text and photos), letters, echoes, replies, spark answers, reactions, connection nicknames and notes, saved items.
• Safety records: blocks, reports you make or that are made about you (including a copy of the reported content), moderation decisions and appeals.
• Activity: when you were last active, streaks, and which days you used the app (kept 7 days), plus aggregate usage counts that aren't linked to you.
• Device: a push notification token and platform (iOS, Android or web) if you turn notifications on.

We don't use advertising, analytics or tracking tools, we don't access your contacts, camera, microphone or precise location, we don't use AI to read or process your conversations, and we don't sell your data. The website only sets the cookies needed to keep you signed in: see the Cookie Policy.

How we use it

• To run Holaris: your account, discovery, letters, conversations and notifications.
• To keep members safe: age separation, spam and abuse prevention, reviewing reports, and enforcing the community guidelines.
• To secure the service and meet legal obligations.

[Legal bases for processing in each launch country — to be completed with legal advice.]

Who processes it for us

We share data only with service providers that process it on our behalf:

• Convex — hosting our database and file storage.
• Resend — sending verification and password-reset emails.
• Expo, Apple and Google — delivering push notifications. Message text is only included if you turn on previews (off by default).
• Google and Apple — only if you choose to sign in with them.
• Sentry — error reports from the website and the apps, if we turn error monitoring on: technical details of the crash only (such as the error, the screen and your device model), with no account identity, device name, cookies, email addresses or message text.

We may also disclose information when the law requires it, or to protect someone from serious harm (for example, reporting child exploitation to the authorities).

What other members see

Your display name, photo and bio, and — only if you choose — your interests, languages and country. Echoes appear under a random alias, and letters can be sent under an alias. Private messages are visible only to the person you're talking with. Messages are protected in transit but are not end-to-end encrypted, so our moderators can review content that is reported to them.

How long we keep it

• Your account, profile and content: until you delete them or your account.
• Private messages: until the sender unsends them or deletes their account; 30 days after you've both deleted the conversation; 180 days after a block or account deletion ends it. Reported messages are kept until the report is resolved.
• Echoes: they fade after 30 days and are deleted 60 days later.
• Notifications: 60 days once read, 120 days if unread. Daily activity records: 7 days.
• Unsent messages are erased immediately.
• Safety records (reports and moderation decisions) are kept after account deletion, linked to an anonymous placeholder instead of your email.
• Backups: up to 30 days.

The full schedule is in the Data retention policy.

Your choices and rights

• Access and export: Settings → Your data downloads a copy of everything you've shared with us.
• Correction: edit your profile and settings at any time.
• Deletion: Settings → Delete account, or see how to delete your account.
• Visibility: Settings → Privacy & discovery controls who can find you and what they see.
• Notifications: turn push notifications and message previews on or off in Settings.
• For anything else, or to object to or restrict processing, email [email protected]. We reply within 30 days. You may also complain to your local data protection authority.

Age

You must be at least 16 to use Holaris. Members under 18 can only discover and talk to other members under 18, and can't share contact details. If we learn someone is under 16, we delete their account. See our child safety standards.

Security and transfers

Data is encrypted in transit, access is restricted to staff who need it, and staff can only see private content when it's reported. Our providers may store data outside your country: [international transfer safeguards — to be completed with legal advice].

Changes

If we change this policy in a meaningful way, we'll tell you in the app before the change takes effect.