Privacy Policy

Appskit ("we") provides Halkit (the "Service") in compliance with the Personal Information Protection Act of Korea and other applicable laws. This policy explains what information the Service handles and where.

Article 1 (Information we handle and where)

1. Processed only on your device — never sent to us.

• Records from the Apple Health app: Halkit reads only the items you allow in the Health app (such as steps, heart rate, sleep, blood pressure, blood glucose, weight, workouts, and workout routes) and calculates and displays them on your device. Values you enter are saved to the Health app when you allow it. For a food you pick from the food composition table, the nutrients calculated for the amount eaten (carbohydrates, protein, fat, sugar, and sodium) are saved with it — only those you allow.
• Lab records: lab values, reference ranges, and notes you enter — or read from a results-sheet photo and confirm — are stored only in the app's storage on your device.
• App settings: Home layout, display units, pinned items, your Daily tab plan (goals, items, times, and reminder settings), and similar settings.
• Summaries shown in widgets and on Apple Watch: these stay on your device and travel only between your iPhone and your paired Apple Watch.
• Siri, Shortcuts, and Control Center: the Control Center button and the logging shortcut only open the entry form. When you ask Siri or Shortcuts for a metric, the app answers with the last value it kept on your device and does not send it to us. Apple's privacy policy applies to Siri's own processing.
• Today's message: once a day, the app makes a short message from records it has already calculated. If Apple Intelligence is available, the Apple model on your device picks the story and polishes the wording. The message and what it's made from stay on your device and are not sent to a server. If you turn on the morning notification, your device schedules it itself, and it shows no numbers on the Lock Screen.
• Last week in review: the app calculates last week and the week before from the recent summaries it keeps on your device. It does not use the on-device model and sends nothing to a server.
• Daily tab and weekly review notifications: if you turn them on, your device schedules them itself, and they contain no health values or metric names.
• Meter photos: when you photograph the screen of a blood pressure monitor, scale or glucose meter, or choose such a photo, the Apple model on your device reads the numbers to fill in the form (on devices where Apple Intelligence is available). The photo is not sent to a server and is not saved — it's discarded when you close the entry screen. The numbers are written to the Health app only when you check them and save. Only the photo's pixels go to the model — not its location or capture details.
• Lab results-sheet photos and PDFs: when you photograph a lab results sheet or choose a photo or PDF of one, your device reads the text to fill in a review screen (photos with on-device text recognition, Apple Vision; PDFs that contain text as they are). The photo or PDF is not sent to a server and is not saved — it's discarded right after the text is read. The password of a locked PDF isn't saved either. Other details printed on the sheet, such as your name, date of birth, or clinic, are not saved; only the lab values and printed reference ranges you confirm and choose are saved to the lab records on your device. Health app items on the sheet, such as blood pressure, weight, and blood glucose, are saved to the Health app only if you choose them and allow it.

2. Processed by services built into the app — requests to these services never include your health records.

3. Apple handles payments. We never receive your credit card number or other payment details.

4. Share cards — When you make and send a share card, the values shown on it (and a background photo, if you pick one) are drawn into a single image. A background photo reaches the app only as the one photo you pick in the system photo picker (the app doesn't access your photo library), is drawn into the image on your device, and isn't kept. The image carries no location or camera details from the photo. A workout share card also draws the workout route and a map of that area unless you turn on Hide route (the map image comes from Apple Maps). You choose where it goes in the system share sheet; we don't receive or keep the image or the photo. App analytics note only that a card was shared (one event name), not which card or whether a photo was used.

5. Website access logs — When you visit the website (halkit.web.app), Google Firebase Hosting, which serves it, records each request (IP address, browser and device information (User-Agent), the page requested, the referring page, the time, and the response), and we keep these records in Google Cloud Logging for 30 days. A copy of part of the crash diagnostics information in paragraph 2 (app launch and crash records) is kept there for 30 days as well.

Article 2 (Why we process it)

• On-device information: to organize your health records (including today's message, Last week in review, the Daily tab, and their notifications) and save the values you enter to the Health app
• Advertising: to show banner ads in the free version and measure their performance
• Subscriptions: to confirm and restore subscriptions and remove ads
• App analytics: to improve the Service through usage statistics
• Crash diagnostics: to improve the Service by finding and fixing the causes of crashes
• Maps: to show workout routes on a map
• Support: to receive, handle, and answer your questions
• Website access logs: to run and secure the website (spotting abnormal access), diagnose outages, and confirm the authorized-seller file for advertising (app-ads.txt)

Article 3 (How long we keep it)

1. On-device information is deleted when you delete the app. Values saved to the Health app stay there and are managed in the Health app.
2. Information processed by the services above is kept and deleted according to each service's retention settings and privacy policy.
3. Support emails are deleted once handled, except where the law requires us to keep them (records of consumer complaints or disputes: 3 years under Korea's Act on Consumer Protection in Electronic Commerce).
4. Website access logs, and the crash diagnostics copy kept in Cloud Logging, are deleted automatically after 30 days.

Article 4 (How we delete it)

We delete information without delay once its retention period ends or its purpose is fulfilled. Electronic files are deleted so they cannot be recovered.

Article 5 (Sharing with third parties)

We don't share your personal information with third parties, except:

• Google LLC (United States): to show ads in the free version, the advertising information in Article 1(2) is sent to Google, which uses it to serve and measure ads under its own privacy policy. We request non-personalized ads only.
• Apple Inc.: information is sent to Apple when you use payments (App Store) and maps (Apple Maps).
• Where required by law, or when law enforcement requests it through legal procedures.

Article 6 (Processors)

Article 7 (International transfers)

Information is transferred over the network from time to time while you use the Service.

If you don't want these transfers, you can decline tracking in App Tracking Transparency (your advertising identifier is then not sent), advertising does not run while you subscribe, and deleting the app stops all transfers. Transfers for subscription checks are needed to provide the Service; transfers for app analytics and crash diagnostics improve the Service and happen while you use the app. Website access logs are recorded only when you visit the website.

Article 8 (Automatic collection)

• Advertising identifier (IDFA): the app asks through App Tracking Transparency before advertising starts, and sends it only if you allow. You can change this at any time in Settings > Privacy & Security > Tracking.
• App instance identifier: created at random for each installation for app analytics, and removed when you delete the app.
• Crash reports and installation identifier: the app sends launch statistics when it opens, and if it quits unexpectedly, it creates a crash report for diagnostics and sends it the next time the app opens. The installation identifier is created at random for each installation and removed when you delete the app.
• The website (halkit.web.app) uses no cookies or analytics tools. Its server does record each request automatically (access logs, Article 1(5)), and these are deleted after 30 days.

Article 9 (Children)

The Service is not directed to children under 14. It doesn't ask for names or dates of birth. If we learn that information about a child under 14 was collected, for example through a support email, we delete it without delay.

Article 10 (Your rights)

1. You can ask us to access, correct, delete, or stop processing your personal information.
2. We keep no account information, so we hold no information that identifies you directly. You can review and delete on-device information yourself in the app and the Health app, and deleting the app removes it all.
3. You can change what Halkit may read and write in the Health app (Profile > Privacy > Apps > Halkit) and tracking permission in your device Settings at any time.
4. For other requests, email support@tickkit.app. We act within the time limits set by law. You may also make requests through a legal representative or an authorized person.

Article 11 (Security)

• We don't send health records to a server, and we don't run a server.
• Requests for ads, subscriptions, and analytics are built only from predefined values so they carry nothing about your health, and automated checks enforce this.
• We don't attach a user ID or custom values to crash reports. The only records attached automatically are predefined app usage event names.
• Communication with these services is encrypted (HTTPS).
• On-device information is protected by iOS data protection.

Article 12 (Privacy officer and remedies)

• Company: Appskit (앱스키트)
• Privacy officer: Young-Hee Jang (CEO)
• Email: support@tickkit.app
• Access requests: handled by the privacy officer

For reports or advice about privacy violations in Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Privacy Infringement Report Center: 118 / privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301 / www.spo.go.kr
• Korean National Police Agency: 182 / ecrm.police.go.kr

Article 13 (Changes to this policy)

We announce additions, deletions, or changes in the app or on the website at least 7 days before they take effect (30 days for material changes to your rights).