Biometric Data Policy

Effective date: 28 October 2026

This Biometric Data Policy (the "Policy") describes how Rekhapalm ("we", "us" or "our") collects, uses, discloses, retains and destroys Biometric Data in connection with the Rekha mobile application (the "App"). It is published to meet, among other laws, the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), Washington's biometric identifiers law (RCW 19.375) and the Colorado Privacy Act as amended for biometric data. It forms part of our Privacy Policy.

1. Definitions

"Biometric Data" means, to the extent treated as such by applicable law: (a) photographs of a user's hands submitted through the App; (b) any record of hand or palm geometry or features derived from them, including the written hand description generated for a reading; and (c) any information based on the foregoing. We treat all such data as Biometric Data whether or not a particular law would classify it as such.

2. Purpose of collection

We collect Biometric Data for one purpose only: to generate the palm reading and daily card that you request, for reflection and entertainment. We do not use Biometric Data to identify, verify or authenticate any individual, or to build any template or database of individuals. We do not use it to infer health, ethnicity or personality for any purpose other than the reading you request. If you turn on the optional Energy & temperament section, that reading includes traditional palmistry readings about energy, strain and temperament. They are composed on your device, are not a medical assessment, and do not change what we collect, why, or for how long.

3. Notice and written release

Before any Biometric Data is collected, the App informs you in writing that Biometric Data will be collected, of the specific purpose and length of term for which it will be collected, used and stored, and of the disclosure to our processor described in section 5. Collection proceeds only after you confirm that you are 18 or older and give your consent by an affirmative act in the App, which constitutes your written release for the purposes of the Illinois Biometric Information Privacy Act and similar laws. The date and time of your release are recorded on your device.

4. No sale or profit

We do not and will not sell, lease, trade or otherwise profit from Biometric Data.

5. Disclosure

We do not disclose Biometric Data to any person except:

1. to Anthropic, PBC, which acts as our processor to generate the hand description, with your consent, under commercial terms that provide that it does not use the data to train its models and that provide for its deletion as described in section 6;
2. to Fly.io, Inc., our hosting provider, on whose infrastructure our server runs while processing your request; and
3. where disclosure is required by federal, state or local law or by a valid warrant or subpoena issued by a court of competent jurisdiction.

6. Retention and destruction schedule

Biometric Data in the possession of us or our processor is permanently destroyed on the earliest of: (a) the date on which the initial purpose of collection has been satisfied; (b) 30 days after your last interaction with the App; and (c) any earlier date required by applicable law. In no event will we retain Biometric Data for longer than three years after your last interaction with us. In practice:

• Photographs on our server: held in memory only for the duration of the request and destroyed when the response is sent. They are never written to disk, a database or logs.
• Hand descriptions on our server: held in memory for no more than 24 hours, to avoid processing an identical upload twice, and then destroyed.
• Anthropic: deleted under Anthropic's commercial terms, which as at the effective date provide for deletion within 30 days, save where a longer period is required for the enforcement of its usage policies or by law.
• Your device: your photographs and hand description remain in the App's private storage, under your control, until you tap Settings › Delete my data or uninstall the App, either of which destroys them immediately, unless you have included the App's data in a device backup (for example iCloud or Google backup), which is under your control and outside our systems.

7. Storage and security

We store, transmit and protect Biometric Data using the reasonable standard of care within our industry and in a manner that is the same as or more protective than the manner in which we store, transmit and protect other confidential and sensitive information. Biometric Data is encrypted in transit with TLS and is not stored at rest on our systems. If we become aware of a security incident that may have affected Biometric Data, we will investigate and contain it and notify affected individuals and authorities as required by applicable law.

8. Your rights

You may decline to give consent. If you do, the App will not collect Biometric Data and you will not be able to use its reading features; you may still read this Policy, the Privacy Policy and the Terms of Use in the App. You may delete Biometric Data on your device at any time as described in section 6, and you may contact us with any question or request concerning this Policy.

9. Changes

We will post any changes to this Policy on the Website and in the App and revise the effective date. We will not use Biometric Data for a new purpose without first obtaining your consent.

10. Contact

Rekhapalm · support@rekhapalm.com · https://rekhapalm.com