Privacy Policy
Effective date: 12 November 2026
This Privacy Policy explains how Rekhapalm ("Rekhapalm", "we", "us" or "our") collects, uses, discloses and retains information in connection with the Rekha mobile application (the "App") and the website at https://rekhapalm.com (the "Website", and together with the App, the "Services"). It should be read together with our Terms of Use and our Biometric Data Policy, which forms part of this Privacy Policy.
1. Summary
- The App does not require an account. We do not ask for your name, email address, telephone number or precise location.
- Hand photographs leave your device only when you tap Read my hand. Our server holds them in memory solely to produce your reading and does not write them to disk, to a database or to logs.
- We do not sell or rent personal information, share it for cross-context behavioural advertising, or use it to identify you.
- Your reading, your photographs and your journal are stored on your device, and you may delete them at any time in Settings › Delete my data.
2. Information we process
(a) Hand photographs. When you request a reading, the App transmits up to three photographs of your hands (both palms and, optionally, the back of one hand), together with close-up sections cut from those same photographs (such as the fingers, the mounts and the nails) so that finer features can be seen. Before transmission the App re-encodes each image on your device, which removes location data and other embedded metadata. Photographs may constitute biometric information under certain laws; our handling of them is governed in addition by our Biometric Data Policy.
(b) Hand description. From the photographs, our processor generates a written description of visible features of your hands (for example, "a long head line" or "a curved heart line"). The description is returned to your device, which uses it to compose your reading and your daily card.
(c) Install identifier. On first launch the App generates a random identifier that is not derived from your device hardware, your advertising identifier or any account. It is sent with each reading request so that we can apply daily usage limits.
(d) IP address. Our server receives the IP address of each request, as all internet services do. We use it only to apply daily usage limits and to protect the Services against abuse.
(e) Purchase information. The App's purchase library contacts our subscription-management provider, RevenueCat, Inc., each time the App opens to check whether this install holds a purchase, whether or not you have bought anything. RevenueCat assigns an anonymous identifier to this install and receives basic device information (such as device model, operating system and store country). If you buy Rekha Plus or the Full reading, the purchase is processed by Apple or Google and RevenueCat receives the purchase receipt. We never receive your payment card details. The App shows this identifier in Settings › Share my Rekha ID; if you choose to send it to us (for example, to receive Rekha Plus as a gift), we use it only to grant that access through RevenueCat.
(f) Information kept only on your device. Your hand preference, your consent and age confirmations (with the time given), your reminder setting, your reading, which of its insights the daily card has shown you, your answers to the touch questions and to the hand tour's questions about your own hand, whether you have turned on the Energy & temperament section, your photographs and your journal entries are stored in the App's private storage on your device and are not transmitted to us. If you include the App's data in a device backup (for example iCloud or Google backup), that copy is under your control and outside our systems.
(g) Support correspondence. If you email support@rekhapalm.com, we receive your email address and the contents of your message.
(h) Website. The Website sets no cookies and uses no advertising or tracking technologies. It is hosted by Cloudflare, Inc., which processes IP addresses and request data to deliver and secure the Website, and it uses Cloudflare Web Analytics, a cookieless service that records aggregate page-view statistics without identifying individual visitors. The interactive features of the Website (such as the hand quiz) run entirely in your browser; your answers are not transmitted to us.
(i) Energy & temperament section. If you turn this optional section on in Settings, the App shows traditional palmistry readings about energy, strain and temperament. They are composed on your device from the hand description already described in (b); nothing further is collected or sent to us, and we never learn whether the section is on. These readings are a cultural tradition offered for reflection. They are not medical information, do not assess any condition, and should not be relied on for any decision about your health. The section is off unless you turn it on, and you can turn it off at any time.
(j) Error reports. If the App stops unexpectedly or a reading fails, it sends our server a short report: the kind of problem, the App version, whether the device runs iOS or Android, the outcome of a failed reading request (for example, that the connection was lost), and, for an unexpected stop, a short error message from which web addresses, file paths and identifiers are removed. Reports never contain your photographs, your hand description, your install identifier or your purchase identifier. Our server writes each report as one line in its application logs.
(k) Usage counts. For each reading request our server writes one line in its application logs recording whether the reading succeeded, how many times the photographs were read, how many tokens our processor counted, which model was used and how long the request took. This line contains no photographs, hand description, install identifier, purchase identifier or IP address, and is used only to understand running costs and fix faults.
3. On-device processing
Before any photograph is sent, the App checks on your device that it shows the correct hand and side, using Apple Vision on iOS and Google MediaPipe on Android. This check runs entirely on your device, and neither the images nor the results of the check are transmitted. The daily card works out the time of sunrise from your device's time zone, on your device; the App does not request your location. Daily-card reminders are scheduled locally by your device's operating system; we do not use push notification services and do not receive a push token.
4. How we use information
We use the information described above only to:
- produce your palm reading and daily card;
- apply daily usage limits and protect the Services against abuse, fraud and overload;
- provide and restore purchases;
- find and fix faults in the Services and understand their running costs;
- respond to support requests; and
- comply with law and enforce our Terms of Use.
We do not use your information for advertising, profiling, automated decisions with legal or similarly significant effects, or to identify or authenticate any individual. We do not use your photographs or hand descriptions to train artificial-intelligence models, and Anthropic's commercial terms provide that it does not use inputs or outputs to train its models.
5. Disclosures to service providers
We disclose information only to the following service providers, each acting on our behalf and under written terms that restrict its use of the information:
- Anthropic, PBC (artificial-intelligence processing): receives your hand photographs to generate the hand description. Under Anthropic's commercial terms, inputs and outputs are not used to train its models and, as at the effective date, are deleted within 30 days, save where a longer period is required for the enforcement of its usage policies or by law.
- Fly.io, Inc. (server hosting, United States): hosts the server that receives reading requests.
- RevenueCat, Inc. (purchase management): as described in section 2(e).
- Apple Inc. and Google LLC: process purchases under their own terms and privacy policies, and Google provides our email service for support correspondence.
- Cloudflare, Inc.: hosts and secures the Website, provides Web Analytics, and routes email sent to support@rekhapalm.com.
We may also disclose information where we believe in good faith that disclosure is required by law, subpoena or other legal process, or is necessary to protect the rights, property or safety of any person; and to a successor in connection with a merger, acquisition or sale of assets, in which case the successor will be bound by this Privacy Policy.
6. Retention
| Information | Retention |
|---|---|
| Hand photographs (our server) | Held in memory only for the duration of the request, then discarded. Never written to disk or logs. |
| Hand description (our server) | Held in memory for up to 24 hours, keyed to a one-way fingerprint of the photographs, so that an identical upload is not processed twice; then discarded. |
| Install identifier and IP address (our server) | Held in memory in daily usage counters that reset daily. |
| Server logs | Our application logs record the type of any processing error, the error reports described in section 2(j) and the usage line described in section 2(k), never photographs, hand descriptions or identifiers. Our hosting provider keeps application logs for a short period, and may keep routine infrastructure logs (including IP addresses), under its own terms. |
| Anthropic | As stated in section 5. |
| Information on your device | Until you tap Delete my data or uninstall the App. |
| Support correspondence | For as long as needed to resolve your request, and in any event no longer than two years. |
| Purchase records | As required by Apple, Google and RevenueCat under their own terms. |
Because our server restarts and stops when idle, in-memory information may be discarded sooner than the periods stated above.
7. Your choices and rights
- Deletion. Settings › Delete my data permanently erases your reading, photographs, journal and settings from your device and issues a new install identifier. Uninstalling the App has the same effect. Neither affects a device backup you have made.
- Reminders. You may turn daily reminders on or off at any time in Settings or in your device's notification settings.
- Energy & temperament. You may turn this optional section on or off at any time in Settings. Turning it off hides it immediately; it is composed on your device, so there is nothing for us to delete.
- Withdrawal of consent. You may withdraw your consent to the processing of hand photographs at any time by not requesting further readings and deleting your data. Withdrawal does not affect processing that has already occurred.
- Requests. Depending on where you live, you may have the right to know, access, correct or delete personal information, to receive it in a portable format, to opt out of its sale or sharing, to limit the use of sensitive personal information, and to appeal a decision we make about your request. Because we do not maintain accounts or keep photographs, hand descriptions or identifiers beyond the periods in section 6, other than support correspondence you send us, we generally hold no personal information about you that we could retrieve; the information on your device is under your control. To make a request or an appeal, email support@rekhapalm.com. We will respond within the period required by applicable law and will not discriminate against you for exercising any right.
- Sale and sharing. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act or similar laws, and we have not done so in the preceding twelve months. Because we do not sell or share personal information, a Global Privacy Control signal does not change how we process it.
- Sensitive personal information. We use hand photographs and descriptions only to provide the reading you request and not to infer characteristics about you or to identify you.
8. Age restriction
The Services are intended solely for persons aged 18 or over. The App requires users to confirm that they are 18 or older before any photograph is taken. We do not knowingly collect information from anyone under 18. If you believe a minor has used the App, please contact us and we will take appropriate steps.
9. Security
Information in transit between the App and our server is encrypted with TLS (HTTPS). Our server does not store photographs, and access to our hosting and service-provider accounts is restricted to us. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Where information is processed
We operate from the United States, and information is processed in the United States by us and by our service providers. The Services are not currently offered in the European Union.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on the Website and in the App and revise the effective date above. If a change materially affects how we process hand photographs or other personal information already collected, we will seek your consent where required by law.
12. Contact
Rekhapalm · support@rekhapalm.com · https://rekhapalm.com