Privacy Policy

1. Introduction

This Privacy Policy describes how Hefoya Studio ("we," "us," "our") collects, uses, and protects information when you use the Vexale Keyboard application for Android ("Application"). We are committed to protecting your privacy and ensuring transparency about our data practices.

As a keyboard application, Vexale Keyboard processes the text you type to provide text input, autocorrect, word suggestions, and next-word prediction. This processing and personalized learning occur on your device. The Application does not send your typed text or learned words to Hefoya Studio or its analytics services. The suggestion engine may retain words and related learning data in the Application's local storage to improve future suggestions. Android system backup and device transfer may also copy local app data, as explained in Section 3.4.

2. Data Controller

The data controller responsible for your personal data is:

Hefoya Studio
Poland
Email: hefoyastudio@gmail.com

3. Information We Collect

We organize the information associated with the Application into the following categories:

3.1. Information We Do NOT Collect

To be explicitly clear about the boundaries of our data collection:

• Keystrokes or typed text sent to us: The Application does not send your keystrokes, typed text, or learned words to us or to analytics services. Input is processed locally, and the suggestion engine may save words and related learning data on your device as described in Section 3.3.
• Clipboard contents sent to us: Clipboard history is stored locally. The Application does not upload clipboard contents to our servers or analytics services. Android system backup and device transfer are described in Section 3.4.
• Password fields and restricted learning: The Application disables personalized learning in fields identified by the host app as password fields, including numeric and visible-password fields. It also respects Android's IME_FLAG_NO_PERSONALIZED_LEARNING flag. These protections depend on the host app correctly identifying its input fields.
• Contacts, call logs, photos, files, or location data.
• Audio, camera, or biometric data.
• Account credentials or personal profiles (the Application has no user account system).

3.2. Information Collected Automatically

When you use the Application, the following information may be collected automatically through integrated third-party services:

Analytics event design note: Our analytics events are intentionally designed to protect your privacy. For example, when you tap an emoji, we record only that an emoji was selected — never which emoji. When a suggestion is used, we log only the position index (1st, 2nd, or 3rd suggestion) — never the word itself. Theme and language changes log only the theme or language identifier, not any personal data.

3.3. Information Stored Locally on Your Device

The following data is stored in the Application's local storage. The Application does not upload your clipboard contents or personalized learning data to our servers or analytics services. Android system backup and device transfer are addressed separately in Section 3.4:

• Keyboard settings: Theme preferences, language selection, autocorrect toggle, number row toggle, sound/vibration settings, keyboard height, toolbar configuration.
• Clipboard history: Up to 50 recent clipboard entries, including pinned items, stored in an encrypted local file (user_clipboard_50.pack).
• Recently used emojis: A local record of your emoji usage for the "recent" category.
• Onboarding state: Whether you have completed the initial setup and accepted the Terms.
• Language dictionaries: Bundled dictionaries and downloaded language packs, together with catalogue and version information used to display installed and available languages and to check for newer packs. These language resources are separate from your personalized learning data.
• Personalized autocorrect and suggestion data: The engine may save words you type or select, correction choices, word-use information, and word combinations or surrounding word context used for learning. This data can improve word ranking, autocorrect, and next-word suggestions across typing sessions. Learned entries may contain personal information if you type it into an ordinary text field. Learning is restricted in password fields and fields requesting no personalized learning, as described in Section 3.1.

Personalized learning data is stored in the Application's private files and is not synchronized through a Vexale account. To remove it, you can clear the Application's data in Android settings or uninstall the Application. These actions also remove other local app data; backup copies may need to be managed separately.

3.4. Android System Backup and Device Transfer

The Application allows Android system backup. Depending on your Android version, device manufacturer, and system settings, local app data, including learned words, settings, and clipboard history, may be included in a system-managed cloud backup or transferred to another device. Such copies are handled by Android or your backup provider under their own settings and privacy policies; they are separate from the Application's analytics and our backend services. We do not receive these backup copies. You can manage backup and restore through your device or backup provider's settings. Restoring a backup may restore previously saved local data.

4. Android Permissions

The Application requests the following Android permissions:

The Application does not request permissions for camera, microphone, location, contacts, phone, storage, Bluetooth, or any other sensitive resource.

5. How We Use Your Information

We use the collected information solely for the following purposes:

• To provide and maintain the Service: Ensuring the keyboard functions correctly on your device.
• To improve the Application: Analyzing anonymous usage patterns (which features are used, how often) to prioritize development efforts.
• To fix bugs and improve stability: Using crash reports to identify, diagnose, and resolve technical issues.
• To monitor performance: Identifying performance bottlenecks and optimizing the user experience.
• To deliver notifications: Informing you about available updates or important announcements via push notifications.
• To check for updates and provide resources: Communicating with our server to check for app and dictionary updates and to download language packs and theme resources.

6. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data based on the following legal grounds under the General Data Protection Regulation (GDPR):

• Consent: By accepting these terms during onboarding, you consent to the data processing described in this policy. For push notifications on Android 13+, you provide separate consent through the system permission dialog.
• Legitimate interest: We have a legitimate interest in collecting anonymous analytics data and crash reports to improve the Application's quality, stability, and user experience, provided this does not override your fundamental rights and freedoms.
• Contract performance: Processing necessary to deliver the service you requested when you installed and activated the Application.

7. Third-Party Services and Data Sharing

We integrate the following third-party services that may receive data as described:

7.1. Firebase (Google LLC)

• Firebase Analytics: Collects anonymous usage data, device information (model, OS version), and app instance identifiers. Google's data practices are governed by the Google Privacy Policy.
• Firebase Crashlytics: Collects crash logs including stack traces, device state, and OS version. No user-typed content is included in crash reports.
• Firebase Performance Monitoring: Collects performance traces and network request metrics.
• Firebase Cloud Messaging: Google processes device tokens necessary for push notification delivery.

Firebase data may be processed by Google on servers located in the United States or other countries. Google is certified under the EU-U.S. Data Privacy Framework. For more information, see Firebase Privacy Information.

7.2. Our Backend Server

The Application communicates with our backend server to check for application updates and to retrieve catalogues, language dictionaries, dictionary updates, and theme resources. App update-check requests include your Android ID, device language, app version, and package name. Resource requests identify the requested catalogue or pack, and the server receives ordinary connection information such as your IP address. The Application does not include typed text, clipboard contents, or personalized learning data in these requests. We may retain the Android ID for troubleshooting, analytics, or abuse prevention; this data is not sold or rented.

7.3. No Advertising

The Application does not contain advertisements. We do not use advertising SDKs, advertising identifiers, or any ad-tracking technology. We do not share your data with advertising networks.

7.4. No Data Sales

We do not sell your personal information to any third party. We do not participate in data brokerage or share personal data for monetary consideration.

8. International Data Transfers

Your data processed through Firebase services may be transferred to and processed in the United States or other countries where Google operates. These transfers rely on appropriate safeguards, including Google's compliance with the EU-U.S. Data Privacy Framework and Standard Contractual Clauses where applicable.

Data sent to our backend server may be processed in Poland. We implement appropriate technical and organizational measures to protect data during transfer.

9. Data Retention

• Firebase Analytics data: Retained by Google according to their standard retention policies (typically 14 months for user-level data, 2 months for event-level data, configurable).
• Firebase Crashlytics data: Crash reports are retained by Google for 90 days.
• Firebase Performance data: Retained by Google for 90 days.
• FCM tokens: Retained while the Application is installed. Tokens are automatically invalidated when the Application is uninstalled.
• Android ID on our server: Retained for the duration of the update-check request. We may also persist it in a database for troubleshooting, analytics, or abuse prevention.
• Local device data: Settings, clipboard history, downloaded resources, and personalized learning data may remain across app restarts and updates until removed or until you uninstall the Application or clear its data. Android system backup copies are managed separately and may restore this data later.

10. Data Security

We take the security of your data seriously and implement appropriate measures:

• On-device processing: Text input processing, autocorrect, suggestions, and personalized learning run on your device. The Application does not send typed text or learned words to our backend or analytics services. System backup and transfer are described in Section 3.4.
• Signed API requests: Communication with our backend server uses cryptographic request signing (SHA-256 based) to prevent tampering and unauthorized access.
• App integrity checks: The Application includes runtime security measures such as APK signature verification, debugger detection, and tampering detection.
• Code protection: The Application employs code obfuscation and minification to protect against reverse engineering.
• Local data storage: Clipboard history, preferences, and personalized learning data are stored in the Application's private storage area, subject to Android's app-storage protections and system backup or transfer mechanisms.
• Transport security: Network communications use HTTPS in production. Cleartext traffic is restricted to development environments only.

While we implement commercially reasonable security measures, no system can guarantee absolute security. We cannot ensure or warrant the security of any information transmitted to or from the Application.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

For All Users:

• Opt out of analytics: You can disable Firebase Analytics data collection by restricting the Application's internet access in your device settings, or by uninstalling the Application.
• Control notifications: You can disable push notifications through your device's notification settings or by denying the POST_NOTIFICATIONS permission.
• Delete local data: You can clear all locally stored data (settings, clipboard history, preferences) by clearing the Application's data in your device settings, or by uninstalling the Application.

For EEA/UK Users (GDPR):

• Right of access: You may request information about what personal data we process about you.
• Right to rectification: You may request correction of inaccurate personal data.
• Right to erasure: You may request deletion of your personal data.
• Right to restrict processing: You may request restriction of the processing of your data.
• Right to data portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to the processing of your personal data based on legitimate interest.
• Right to withdraw consent: You may withdraw consent at any time by uninstalling the Application or contacting us.
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection authority.

For California Users (CCPA/CPRA):

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected.
• Right to delete: You may request deletion of personal information we have collected.
• Right to opt out of sale: We do not sell personal information. No opt-out action is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at hefoyastudio@gmail.com. We will respond within the timeframe required by applicable law (typically 30 days for GDPR, 45 days for CCPA).

12. Data Deletion

Since the Application does not have user accounts, data deletion is straightforward:

• Uninstalling the Application removes its local app data, including settings, clipboard history, and learned words. Existing system backup copies may remain and can restore data after reinstallation.
• Clearing app data in your device's Settings > Apps > Vexale Keyboard > Clear Data deletes local app data, including personalized learning, without uninstalling. This also resets your settings and removes local clipboard history and downloaded app resources.
• System backup copies: Manage or delete these through your device or backup provider's settings. Clearing app data or uninstalling does not by itself guarantee deletion of existing backup copies.
• Firebase data: Analytics and crash data associated with your device instance will be automatically purged according to Google's retention policies. You may also contact us to request deletion of any Firebase data linked to your device.

13. Children's Privacy

The Application is not specifically directed at or designed for children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children.

The Application does not contain age-gated content, social features, or mechanisms that would specifically attract children. It is a general-purpose keyboard tool.

If we become aware that we have inadvertently collected personal data from a child under the applicable minimum age without verified parental consent, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please contact us at hefoyastudio@gmail.com.

14. Cookies and Tracking Technologies

The Application is a native Android app and does not use cookies. However, Firebase services may use device-level identifiers (such as Android Advertising ID or app instance ID) for analytics purposes. The Application does not use any advertising identifiers for ad targeting, as it contains no advertising.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Application features. When we make material changes:

• We will update the "Effective Date" at the top of this page.
• We may notify you through a push notification or an in-app notice.
• The updated policy will be made available at the same URL.

We encourage you to review this Privacy Policy periodically. Your continued use of the Application after any changes constitutes your acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Hefoya Studio
Poland
Email: hefoyastudio@gmail.com

For EEA/UK users: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.