Legal

Privacy Policy

Last updated: 24 October 2026

Heartstreak is built for people going through a breakup. What you write in it is personal, so the app is designed to keep it on your phone. This policy explains what data the app handles, why, and what your rights are.

Who we are

Heartstreak is published by Medialy, s.r.o., Žitava 1637/47, 952 01 Vráble, Slovakia (“we”, “us”). We are the controller of the personal data described here.

Contact: hello@heartstreak.com

The short version

• There are no accounts. We never ask for your name, email or phone number to use the app.
• Your journal, unsent messages, reality check, notes, photos and voice notes stay on your device. We cannot read them.
• We collect a small amount of technical and usage data (counts and events, never your text) to fix bugs and improve the app.
• Payments are handled by Apple. We never see your card details.
• We do not sell your data and we do not show ads.

Data that stays on your device

The following is stored only on your iPhone, inside the app’s private storage, and is never sent to us:

• journal entries, unsent messages and notes;
• your reality check items, including any photos or voice notes you attach;
• your no contact start date, streak, milestones, patches, Beats and Patch settings;
• the name and phone number of the friend you choose under “My person” (picked from your contacts with iOS’s limited access, so the app sees only that one contact; stored in the iOS Keychain and used only to open a text to them from your phone);
• the usernames you enter under “Their accounts” (stored in the iOS Keychain and used only to open that profile or chat so you can mute or archive it);
• hard dates and your plans for them, letters to your future self, your standards, era goals, and date notes (we suggest nicknames, never full names);
• cycle data, if you turn on cycle insights (see below);
• Guard settings. When you choose apps to shield, iOS gives Heartstreak only anonymous tokens. We never see which apps you chose, your usage, your messages or your contacts.

If you delete the app, this data is deleted with it, and Settings → Delete all data removes it at any time. Photos and voice notes from Reality check are excluded from iCloud backups. Other app data may be included in your own encrypted iPhone backup, which only you control.

Permissions the app asks for

Each one is asked only when you use the feature that needs it, and you can say no and keep using the rest of the app.

• Contacts: to pick one friend for “My person”. Only that contact is shared with the app.
• Calendar (add only): to add your plan for a hard date as an event. The app can’t read your calendar.
• Photos: to attach a photo to Reality check, and to save share cards (add only).
• Microphone: to record an optional voice note in Reality check.
• Notifications: local reminders you set, scheduled on your phone. No push server is involved.
• Screen Time (Guard): see above. Apple gives the app anonymous tokens only.

Location for safety texts

If you use the safety button, Heartstreak asks for your location only at the moment you send a safety text, and only while you use the app. The location goes into the text you send to the person you chose, from your own phone. We don’t receive it, store it or use it for anything else. You can turn location off in the safety settings and still send the text.

Cycle insights and Apple Health

Cycle insights arrive in a later update and are optional. If you connect Apple Health, Heartstreak asks to read only Menstrual Flow, and it never writes to Apple Health. Period days you log manually and the insights computed from them are stored only on your iPhone, in a separate file that is excluded from device backups. Your cycle data is never sent to us, to analytics, to crash reports or to anyone else, and is never used for advertising. Turning cycle insights off deletes this file. Insights describe your own patterns and are not medical advice.

Data we collect

1. Product analytics (PostHog)

To understand which features help and where the app breaks, we record events such as “SOS opened”, “SOS completed”, “paywall viewed” or “patch earned”, together with numbers such as an urge rating from 1 to 10. Events are linked to a random identifier created on your device, not to you. They never contain journal text, names, contact details, dates you enter, cycle data or the content of anything you write.

Legal basis: our legitimate interest in running and improving the app (Art. 6(1)(f) GDPR). You can object at any time by emailing us.

2. Crash reports (Sentry)

If the app crashes, a report with technical details (device model, iOS version, app version and the code location of the error) is sent so we can fix it. Crash reports are filtered so they do not contain your journal content.

Legal basis: legitimate interest in providing a working app (Art. 6(1)(f) GDPR).

3. Purchases (Apple and RevenueCat)

Subscriptions are sold and billed by Apple through the App Store. We use RevenueCat to check whether your subscription is active. RevenueCat receives the anonymous app user identifier, the product you bought, purchase and renewal dates, your App Store country and price. It does not receive your name, email or payment details.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

4. Support emails

If you email us, we use your email address and message only to answer you, and delete them within 24 months.

What we do not do

• We do not sell or rent personal data.
• We do not use your data for advertising or share it with data brokers.
• We do not use data received through Apple’s Screen Time APIs (Family Controls) for anything other than shielding the apps you choose on your own device.
• We do not build profiles of you or make automated decisions about you.

Processors and transfers

We use these service providers, under data processing agreements:

Where data is transferred outside the European Economic Area, we rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep data

• Analytics events: up to 24 months.
• Crash reports: up to 90 days.
• Subscription records: as long as needed for accounting and tax law (up to 10 years in Slovakia).
• On-device data: until you delete it or delete the app.

Your rights

Under the GDPR you have the right to access, correct, delete or restrict the processing of your personal data, to object to processing based on legitimate interest, and to data portability. Because there are no accounts and analytics use a random identifier, we usually cannot tell which data belongs to you (Art. 11 GDPR). Everything you write stays on your device, where you can delete it yourself with Settings → Delete all data.

You can also lodge a complaint with the Slovak data protection authority: Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk.

Children

Heartstreak is not intended for anyone under 16. We do not knowingly collect data from children.

Not medical care

Heartstreak is a self-help tool. It is not therapy, medical advice or a crisis service. If you are in danger or thinking about harming yourself, contact local emergency services or a crisis line immediately. The app shows crisis contacts for your country in the SOS screen.

Changes

If we change this policy, we will update the date above and, for important changes, tell you in the app.