EcoHalo privacy policy

age and supervised use

the current public release is intended for adults aged 18 or older · a local supervised child-use mode is being developed and evaluated, but is not yet qualified for public child use · see the age and user policy and terms of service

an adult configuring guardian protection does not create a child cloud account or provide blanket consent for a child's online data collection · our current technical-service and SDK disclosures below still matter; on-device processing is not a promise that every provider makes no network requests · do not send a child's private information through support or training contributions

if you believe a child has supplied personal information to an EcoHalo-operated service, contact the privacy address above with the minimum information needed to explain the concern so we can assess and address it · do not email passwords, recovery keys or identity documents

information used on your device

EcoHalo uses the information needed for features you choose · Android permissions, guardian authorization and feature consent remain separate from payment

• installed app identities, your folders, hidden apps, favorites and widgets support the launcher and your organization
• optional accessibility and usage access identify foreground apps and usage events, including in the background, to enforce your configured protection and app limits · the accessibility service cannot retrieve window contents or read typing or touches
• optional notification access reads sending apps, visible titles and text, actions and status to organize pulses · compatible media sessions supply current playback state, metadata, artwork and controls · source apps own playback and accounts · EcoHalo does not create a listening-history service
• guardian settings, local passcode verifiers, recovery material and vault records stay local · vault secrets and protected attachments use their existing local encryption · Android biometrics provides an authentication result, not biometric templates to EcoHalo · billing cannot unlock your vault or replace security proof
• alarms, timers, schedules, notes, shop results, saved places, video watchlists and room records are stored locally · kitchen nutrition and gym activity are user-entered records, not medical monitoring · garden photos are local attachments
• selected photos or optional device-library access supply readable images and metadata for browsing, albums and local search · photo Exhibit and room preview use currently readable images · an explicitly confirmed home photo creates a separate encrypted, metadata-free private display copy that remains after source disconnect until removed · originals stay unchanged · no photo recognition, cloud photo sync or remote plant identification is provided
• camera and microphone access support explicit shop capture, scanning and relative sound readings · on supported devices serena voice uses Android on-device speech recognition · unavailable recognition leaves keyboard input available
• serena and guardian retain native factual assistance; a future qualified internal model may provide separately enabled Premium interpretation on your device · EcoHalo is developing its own internal model; this build offers no external model, AI plugin or qualified model download; any future download needs a separate explicit choice and a declared delivery source · no hosted inference or remote fallback receives conversation, feature facts or supplied text · interpretation can be wrong; native controls retain all actual effects and security proof · supplied passages do not execute feature commands
• the shared system view exposes bounded current native facts, sources and unknowns without creating a private profile · bounded ordinary dialogue continuity is process memory and is cleared on background · attention agreements use the existing foreground-app identity stream for the apps, intention and threshold you explicitly accept, storing minimal local counters rather than an activity timeline · no other app's screen contents or typing are read
• when a qualified model is released, you may separately review and edit an excerpt of a generated response and explicitly send an in-app report to Intekoa · only that excerpt, an optional reason, the model identifier and a random request identifier are submitted through the existing authenticated support service; no original prompt, other conversation or system view is automatically attached · this can establish a technical Firebase identity and App Check request and involves ordinary network metadata · report content is encrypted for restricted developer review and is never used for hosted inference or model training
• training contributions are separately optional and off until you agree in serena settings → local intelligence · after consent, eligible future ordinary question/reply exchanges with serena or guardian can be kept in a separate encrypted no-backup local file for developing and evaluating Intekoa's own AI through its training process only · up to 16 complete examples expire after seven days and are removed on next use · protected/private-source flows, voice audio and system snapshots are excluded · ordinary text can still contain personal information; review, edit and approve each example before deliberately exporting a readable JSON file to the document provider/location you choose · there is no automatic transfer to Intekoa, hosted inference, advertising use, sale, analytics use or on-device model retraining · you may stop collection or withdraw consent and delete local training examples independently of other data or Premium · exported copies remain outside app controls; contributor approval does not make an answer a verified training target · this contribution flow does not reuse support reports
• sensor readings, Bluetooth device names and connection/battery state support the controls you use · EcoHalo does not independently scan Bluetooth devices · ordinary Maps handoffs use your chosen recipient app, without EcoHalo tracking a location history
• no customer account, online profile or settings backup is provided

the commercial backend does not receive these local feature contents · exporting, copying, sharing, opening a provider or sending a support report can intentionally pass the information you choose to the selected recipient · that recipient has its own data practices

commercial identity and subscription verification

explicit commercial actions can use Firebase anonymous authentication, Firebase App Check with Play Integrity and our Google Cloud service · this technical identity is not an email account, a cloud profile or proof of your Google Play account

the service processes the anonymous identity identifier, an installation registration and public-key digest, authenticated request identifiers, Google Play purchase tokens and normalized subscription state, product, renewal and access dates · purchase tokens are encrypted on the server · signed access receipts are bound to the registered installation

private Halo token redemption also processes a high-entropy credential for verifier comparison, grant/binding state and the exclusive Halo Creator or Halo Founder recognition, where applicable · the server retains only a domain-separated token verifier, at most three active installation bindings per grant and minimal award information and permanent nonidentity title reservations; no recipient name or email is required · a token is an access credential, not a payment or personal profile

when private invitations are enabled, explicit in-app activation processes a one-use invitation, request/challenge identifiers, the installation public key and its purpose-bound signature · the server stores a verifier rather than the invitation secret · reviewing a link or QR in the browser does not claim it or create a technical identity · an explicitly accepted attempt can be kept in excluded encrypted device storage until verified or deliberately dismissed · a forwarded unclaimed invitation is a bearer credential, not verified personal or email identity

the private owner console uses separate Google/IAP authentication and security cookies, not a customer account · Intekoa may keep an optional erasable operational label separately from an unlabelled grant · labels are not required, verified identity, award data or part of invitation links or audit messages

Google Play handles checkout, payment methods, renewals, cancellation and refunds · EcoHalo does not collect your payment-card or bank details through its billing API · Google and Firebase also process technical information needed to operate and protect their services, such as network addresses, app/device information and integrity signals

this information is used to verify and restore access, acknowledge purchases, prevent replay and abuse, handle deletion and operate the service · it is not an advertising profile · EcoHalo does not request an advertising identifier or hardware fingerprint to enforce its local preview

providers, website and contact

Porkbun hosts the public EcoHalo website · Google/Firebase provides authentication, app verification, the existing invitation-link hosting, managed backend storage, processing and payment infrastructure · see Porkbun privacy information, Google privacy information and Firebase privacy information · commercial backend resources are configured in the United States, with regional compute and database storage in us-central1 · global delivery and provider processing are not a promise that every technical record stays in that region

these pages use no advertising, analytics scripts, tracking cookies or external font services · the website may save your chosen day/night and motion preferences locally in your browser · hosting and network providers can process technical request information to deliver and protect the site · the deletion form sends its code only in an HTTPS request body to EcoHalo's existing Google Cloud API and does not save it in browser storage

when you email us, we process your email address, message and information you choose to send to respond and handle the request · our contact addresses forward to the operator's Google-hosted mailbox · do not send vault passwords, passcodes, recovery keys, Halo tokens, purchase tokens or deletion codes by email

we do not sell personal information or use local sensitive information for advertising · information may be processed by the service providers described here, by recipients you choose, or where required by applicable law · no optional cloud backup or remote family profile is currently provided

retention and deletion

• local records generally remain on your device until you use the relevant delete controls or remove app data, except their stated expiry such as the seven-day local training-example limit · app-private data is excluded from Android automatic backup · copies you export or share remain with their chosen destination
• purchase-chain evidence is retained while active and for up to 180 days after final end · unresolved purchase and acknowledgement work is kept until resolved
• inactive, unlinked technical identity associations can be removed after 180 days when no grant or outstanding work depends on them
• notification deduplication and redacted backend diagnostics are retained for 30 days, completed outbox jobs for seven days and managed database backups for seven rolling days · the minimal deletion journal prevents erased associations from being restored
• valid cloud deletion requests remove the technical identity and its installation, recipient-token, recognition, reviewer and projection associations within 30 days, normally sooner · minimal billing, security and anti-abuse evidence may remain for the purposes and periods above, without keeping the deleted identity association
• unlabelled private recipient grant and award records remain while administered for access recovery and recognition · cloud deletion removes the identity/installation links and releases slots; later token redemption explicitly creates new links · redacted owner audit events are retained for 30 days
• invitations normally expire after seven days, verification challenges after five minutes, and terminal invitation/outcome/owner-request/audit records within 30 days · scoped cloud deletion removes technical invitation, challenge, recovery and approved-target associations and conservatively erases associated owner labels · explicit label deletion is also available · seven-day managed backups retain their existing deletion-journal replay protection
• support correspondence is kept while handling the request and where reasonably needed for follow-up or applicable legal obligations · it is separate from the commercial database
• explicit generated-response reports expire 30 days after receipt and are removed by managed expiry and service cleanup · they contain no raw identity association; minimal keyed abuse/idempotency evidence follows the same expiry · managed seven-day database backups retain their existing schedule
• the commercial deletion endpoint does not erase records independently retained by Google for SDK diagnostics, Google Play transactions or other provider purposes · those providers' policies and applicable rights procedures govern their records

use support → your plan → delete cloud data in the app, or the external deletion page · cloud deletion does not delete your local vault or room data, reset the preview or cancel Google Play renewal · subscription expiry never removes retained Free data access and safety controls

your choices and questions

review or revoke Android access in the app and Android settings · use feature controls to inspect, export where supported or delete local records · only manage devices and information you are authorized to manage, including when configuring guardian for a child

contact privacy@intekoa.io for privacy questions, applicable rights or help when your cloud deletion code is lost · email alone cannot prove ownership of an anonymous identity or recover vault credentials

we will update this page when actual handling changes · its effective date identifies the current policy

Halo recognition

verified recognition appears privately in EcoHalo support without an account or avatar · the paid cohort ledger holds a pseudonymous history reference, position and award/removal times, with no raw token, email or personal identity · cloud-data deletion removes technical installation links while retaining the anonymous consumed cohort place · recognition is separate from access; offline display is last verified