Privacy Policy

Last updated: September 29, 2026
This Privacy Policy explains what personal data Haki collects, why we collect it, how we protect it and the choices you have. Haki is a closed network for verified university students, and we collect only what we need to run it safely.
We never sell your personal data. We do not share it with advertisers or data brokers, and Haki contains no advertising or third-party analytics tools. The only diagnostics we use is a crash-reporting service that helps us fix bugs (see below).

1. What we collect

Account data. Your university email address (used to confirm your campus and to sign you in with one-time codes), your name, academic year and major, and your campus.
Profile. Your profile photo, bio and anything else you add to your profile.
Content. Posts, articles, polls, comments, reactions, reposts, bookmarks, follows and Moments — including the photos and videos you upload and content you post anonymously.
Messages. The direct messages you send and receive, including attached photos, and their delivery and read status.
Yin-Yang (only if you create a profile). Your age, gender, photos, bio, interests, dating goal, the lifestyle details you choose to share, and your likes, passes and matches.
Safety records. Reports you file, or that are filed about you or your content, and the users you block.
Technical data. Basic logs created when you use Haki — such as IP address, device and OS type, app version, time stamps and errors — handled by our infrastructure providers to run and protect the service.
Signed-in devices. For each device you are signed in on: its model or browser, operating system, app or browser version and when it was last active. We use this to show your active sessions in Settings, let you disconnect them, and keep each account to one person (at most 2 devices at a time). A device’s record is deleted when you sign out on it or disconnect it.
Crash reports. When the app crashes or hits an error, it sends a diagnostic report: the technical error, the app version, the app’s state at the time (such as whether it was in the foreground) and the last few in-app actions that led to it (such as taps and screen changes), and device details — model, operating system, memory and battery level. A report is linked only to a random account ID. It does not include your name, email address, the text of your posts or messages, or your IP address.
Haki does not access your precise location or your contacts.

2. How we use your data

Run Haki. Verify your campus, sign you in, show your content to the audience you chose, deliver messages and power Yin-Yang matching.
Keep it safe. Moderate content, act on reports, enforce our Terms and prevent spam and abuse.
Contact you. Send verification codes and essential service or safety notices — for example, a launch notice if you joined a campus waitlist.
Comply with the law and respond to valid legal requests.
Yin-Yang orders the profiles you see using your likes and passes and how recently people were active. It uses the age on your profile to keep the pool to students aged 17–28, and to show members under 18 only to people within 2 years of their age.

3. Legal basis and consent

We process your data because you consent to it when you create an account, because we need it to provide Haki under our Terms of Use, and to keep users safe and meet our legal obligations. By creating an account you also consent to your data being transferred to, and processed by, the service providers listed below — including in countries other than yours. You can withdraw your consent at any time by deleting your account; this does not affect processing that has already taken place.

4. Who we share data with

Other students. Posts, comments and Moments are visible to other verified Haki students — on your campus or on all campuses, depending on where you post them. Anonymous posts and comments hide your name from other users. Your Yin-Yang profile is shown to other Yin-Yang users, including students at other universities.
Supabase (hosting). Our database, authentication, file storage, real-time messaging and server functions run on Supabase. It processes your data on our behalf and only to provide the service.
OpenAI (safety screening). To keep explicit, violent and hateful imagery out of Haki, photos you upload for posts, Moments, profile pictures and Yin-Yang — and a few still frames from videos you attach to posts — are sent to OpenAI’s moderation service for an automated check before publication. We send the image, not your name or email address.
Sentry (crash reporting). The crash reports described above are sent to Sentry (Functional Software, Inc.), which stores them on our behalf so we can find and fix problems, and deletes them after at most 90 days. Reports contain no name, email address or message text, and Sentry is set up not to store your IP address.
Law enforcement and authorities. We disclose data — including which account is behind an anonymous post or comment — only when a court, the police, a prosecutor’s office or another competent authority makes a request that is valid under applicable law, or when it is necessary to prevent an immediate threat to someone’s life or safety or to protect children. We check each request and disclose only the data it lawfully requires.
Business changes. If Haki is merged with or acquired by another company, your data may transfer to the new owner, who must honour this policy.

5. Storage and security

Your data is stored with Supabase, protected in transit with TLS and encrypted at rest by our hosting provider. Access controls in our database (row-level security) limit, for example, who can read a conversation and who can edit a profile.
Your sign-in session is kept in your device’s secure storage (iOS Keychain or Android Keystore).
Direct messages are protected in transit and at rest but are not end-to-end encrypted. We do not routinely read them; we may review a conversation when it is reported, or when needed to investigate abuse, protect safety or comply with the law.
Our providers may process data in countries other than yours. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.

6. How long we keep your data

Account and content. Kept while your account is active. Content you delete is removed from Haki straight away.
After account deletion. Your data is erased as described in “Delete your account and data”. Residual copies in encrypted backups are overwritten within a limited time.
Campus waitlist. Joining a waitlist requires a verified email address and stores that address, your campus and the date you joined. We use it only to count sign-ups and to tell you when your campus opens. The entry is deleted automatically together with your account; we also remove it once your campus has launched, or earlier if you ask.
Crash reports. Deleted automatically after at most 90 days.
Server logs. Kept by our infrastructure providers for a short period, then deleted automatically.
Safety records. Reports you filed are deleted with your account. Reports other students filed about you are kept, no longer linked to your account, so that we can finish handling them and prevent repeat abuse.
We may keep specific data for longer only where the law requires it, or while it is needed to answer a lawful request or to establish or defend a legal claim.

7. Your rights and choices

Access and correct. You can see and edit most of your profile in the app. Details taken from your student email, such as your name and academic year, are locked — contact us if they are wrong. To request a copy of your data, contact us.
Control what others see. Choose where each post appears, post or comment anonymously, delete your own posts, comments and Moments, and block any user.
Delete everything. Use the in-app account deletion flow — see the next section.
Withdraw consent or object. You can withdraw your consent, or object to a particular use of your data, at any time. Deleting your account withdraws consent to all processing.
Ask us. Contact us to exercise any other right you have under applicable data-protection law, or to make a complaint. We answer requests within 30 days. You can also complain to the data-protection authority in your country.

8. Delete your account and data

You can permanently delete your account at any time in the app: Profile → Settings → Delete account. You will be asked to confirm twice, because it cannot be undone.
Deletion permanently erases your profile and the content linked to it from our database — including your posts, comments, reactions, Yin-Yang profile and matches, notifications, blocks, the reports you filed and any campus waitlist entry — and deletes the photos and videos you uploaded (profile pictures, post and Moment media, Yin-Yang photos) from our file storage. Messages you sent in direct conversations stay in the other person’s copy of the conversation, shown as from a “Deleted Account” without your name or photo; a conversation is deleted once both people have deleted their accounts. Residual copies may remain in encrypted backups for a limited time, until they are overwritten.
Crash reports, which carry no name or content, expire on their own within 90 days. To have specific data removed without deleting your account, contact us and we will delete it.

9. Age limit

Haki is for people aged 17 and over. We do not knowingly collect data from anyone younger. If you believe someone under 17 is using Haki, tell us and we will remove the account and its data.

10. Changes to this policy

When we update this policy we will change the date at the top, and for material changes we will notify you in the app or by email.

11. Contact

For privacy questions, requests to access or delete your data, or complaints, contact us.
Email us
[email protected]