HACALL Holo

Privacy Policy

Draft prepared 5 October 2026 · Effective date: set before launch

1. Who operates HACALL Holo

Operator / data controller
Legal name not provided — complete before launch
Country of operation
Not provided — confirm before launch
Privacy contact
Public email not provided — add before launch

This draft calls that operator “HACALL,” “we,” or “us.” Those terms must be tied to the correct legal operator before publication.

2. Information the current app handles

3. How information is used

The app uses this information to create accounts, authenticate sessions, show profiles and channels, deliver chats and audio, show recent call activity and missed-call alerts, remember device-side read and key-verification state, enforce account controls, and protect the service against abusive request rates.

4. Private-message encryption

The current client is designed to encrypt private message content and voice-message audio before sending them to the service. The service stores the encrypted payloads alongside sender, recipient, time, type, and key metadata needed for delivery. This policy draft is not a cryptographic audit and does not certify the implementation. Channel episodes, channel descriptions, product details, and images are stored separately as channel content and are not end-to-end encrypted by the chat feature.

5. Providers and sharing

When the operator enables publishing analytics, Replit injects the tracker into the published site. It records page views and receives selected events for account creation, first messages, completed calls, and support form outcomes. HACALL's custom events do not include usernames, account IDs, message contents, or email addresses. Loading Google Fonts and cdnjs can send ordinary browser request information, such as an IP address and user-agent, to those providers. The operator must confirm analytics and provider retention terms before launch.

Private-chat content is intended for the people in that chat. Channel information is available to signed-in users through the app. Do not put private or confidential material in channel descriptions, images, or episodes.

6. Cookies and security

The app uses an essential authentication cookie with HttpOnly and SameSite protections; it is marked Secure in production. The current app code does not include advertising or analytics cookies. Production transport, hosting configuration, backups, and third-party practices must be confirmed by the operator. No online service can promise absolute security.

7. Retention and account deletion

You can hide individual messages or a conversation from your account. These controls do not erase the other participant’s copy or shared attachments. You can request account deletion from the account screen; the current server deletes the account and its associated profile, channel, product, episode, message, and call-activity records from the application database. Call-activity records remain while the accounts exist. The code does not define a backup-retention schedule, a post-deletion backup purge deadline, or an export feature; the operator must confirm these details before launch. Deleting an account does not automatically clear browser local storage on every device you used.

8. Your choices and requests

The app provides controls to change your password, set or replace a private recovery code, change your profile image, sign out sessions, block users, hide messages or conversations from your account, and delete your account. Blocking prevents further messages and calls between the two users until the block is removed. A forgotten password can be reset only with a private recovery code created for that account; accounts without a configured code cannot be recovered. The server stores a derived verifier and an encrypted private-key backup, not the raw code. For privacy requests, use the public privacy email that the operator must add before launch. The operator must confirm which rights and response procedures apply in each launch jurisdiction.

9. Age, location, and policy changes

HACALL Holo is for users aged 18 or older; people under 18 may not create an account or use the service. Users must confirm their age during account setup, sign-in, and password recovery. The production hosting geography has not yet been selected. The operator must confirm international data-transfer and notice requirements before launch. Material policy changes should be dated here and communicated through a method selected by the operator.

10. Items to resolve before publication