Plain-language facts about how Haps handles data.
Haps stores calorie-ledger records in encrypted local storage before synchronising them with its service. Optional analytics stays off until you allow it and excludes food names, calorie values, targets, dates, identity, and free text. Verified export and deletion journeys give you a documented way to act on your account data.
Haps at a glance
- Local records
- Encrypted mobile database with keys held in Keychain or Keystore
- Offline changes
- Saved locally first and queued until synchronisation resumes
- Optional analytics
- Off until consent; sensitive ledger and identity fields are excluded
- Data export
- CSV-only ZIP; private one-use link expires after 72 hours
- Account deletion
- Access revoked immediately; 30-day recovery window before live-data purge
- Legal detail
- The privacy policy remains the authoritative privacy notice
Local-first does not mean device-only
Haps renders from an encrypted database on the phone and keeps a durable queue so core logging can continue without a connection. Pending records are sent to the Haps API when synchronisation resumes. Haps should therefore be described as local-first and offline-capable, not as a service where data never leaves the device.
Analytics is optional and restricted
Mobile product analytics and public-website analytics remain off until the relevant consent allows them. The shared telemetry boundary removes food names, calories, targets, dates, email addresses, account identifiers, routes, URLs, query strings, and free text.
The website can measure sanitised page lifecycle and aggregate content depth after consent. You can change the website choice at any time through Analytics settings in the footer.
Export, deletion, and recovery
A verified export is delivered as a CSV-only ZIP through a private link that works once and expires after 72 hours. A verified deletion request deactivates the account and revokes active sessions and devices immediately.
Deletion can be cancelled by reauthenticating within 30 days. After that window, live account data is purged, while encrypted rolling backups expire within a further 30 days and must replay the deletion ledger if restored.