Privacy Policy
This privacy policy applies to the AhaFable app for mobile devices and the website (aha.javan.cc), together with related services (collectively, the "Service"). The Service is operated by Chi-Shun Chen, an individual developer in Taiwan (the "Service Provider"). We show no ads, do no cross-app tracking, do not sell your data, and do not access the advertising identifier (IDFA), so the app never shows an App Tracking Transparency (ATT) prompt.
1. Information collection and use
Account
- When you first open the app, an anonymous account (a random ID) is created automatically; no email or password. The sign-in session is stored in your device Keychain.
- You can choose to sign in with Apple or Google in Settings › Backup & Sync to back up your collection and restore it on a new phone. With Apple we only request your name, not your email; the name is stored with your account. With Google, the account record includes the basic profile Google provides (such as email and name).
Data stored on our servers
The following is stored in Supabase under your account ID; only your account can read or write its own data:
- Reading history and collection: which fables you drew, the page you reached, whether you reached the reveal, and your collection.
- Ratings and reading signals: your "aha" rating and reason, whether you finished, seconds spent on the reveal page, and content error reports. Used to improve and curate content.
- Interests and chosen fields: fields picked during onboarding, and fields a subscriber chooses to read.
- Background: the app asks once "What's your background?" (one of 8 broad categories; you can skip). As stated in the app: "It's only used for choosing content and overall stats, nothing else."
- Subscription status: plan, expiry and product ID, synced from RevenueCat.
- Share records: see Sharing below.
Some data (collection, reading progress, cached illustrations, app settings) is also stored on your device.
Product analytics (PostHog)
- We use PostHog to learn whether features are used. Only events we define are sent: onboarding steps, draws, finishing a fable, ratings, opening the collection, rereads, seeing the subscription screen, purchases, and creating or claiming a share. Events contain fable IDs, fields, ratings, plans and similar, never your name, email or text you type.
- These events are not aggregated or anonymized: they are tied to your account ID plus whether you are signed in (Apple / Google / not signed in). As part of its normal service PostHog receives technical info such as device and app version, and your IP address.
- Autocapture, session replay and surveys are off.
- Turn it off anytime in Settings › Help improve AhaFable; when off, nothing is sent.
Sharing
- When you share a fable we record the sharer, the fable and the time, and store a preview image (fable title, field and illustration, none of your data) in private storage to build the link preview.
- Anyone with the link can open the share page (aha.javan.cc/t/…). It shows the story (answer blurred) and never shows who shared it. Links can be claimed for 30 days.
- When a friend claims it we record the recipient account and time. In My Shares you see counts only, never who; your friend does not see who you are unless you tell them.
- The "Get the answer" button on the share page copies the link to the clipboard so the app can pick up the fable after install.
- Saving a share image to Photos only uses add-only Photos permission; the app does not read your library.
Purchases
Apple processes subscription payments; we never see your payment details. We use RevenueCat to check subscription status, identified by your account ID, with no name or email attached.
What we don't do
- We send no marketing email, or any email.
- The app sends no push notifications.
- Fables and illustrations are generated in advance by AI (Anthropic, Google Gemini) and reviewed by a person. No user data is used to generate content, and nothing you do in the app triggers AI generation.
2. Cookies and tracking technologies
This website uses no cookies or tracking pixels. The app uses only the PostHog analytics SDK described above (can be turned off) and the RevenueCat SDK (subscription status); it uses no advertising SDKs and does no cross-app or cross-site tracking.
3. Your rights
You may request access to, correction of, or deletion of your personal data held by the Service Provider, or withdraw consent you gave. Most of this can be done in the app (turn off analytics, delete your account; see section 10). For anything else, email imjavanchen@gmail.com.
4. Your California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information is collected, the right to delete it, the right to opt out of its sale or sharing, and the right to non-discrimination for exercising these rights. We do not sell your personal information or share it for cross-context behavioral advertising. To exercise these rights, email imjavanchen@gmail.com.
5. Third-party access
The Service Provider shares data only with the following services that process it on our behalf, for the purposes listed. Each has its own privacy policy:
| Service | Purpose |
|---|---|
| Supabase | Accounts, database, file storage, server functions |
| PostHog (US) | Product analytics (can be turned off) |
| RevenueCat | Subscription status |
| Apple | App Store payments, Sign in with Apple |
| Sign in with Google (only if you choose it) | |
| Cloudflare | Hosting this website and share pages |
6. International data transfers
The Service Provider and the services above may process your data in countries outside your country of residence, including outside the European Economic Area (for example, the United States). Where applicable law requires safeguards, we use appropriate mechanisms such as Standard Contractual Clauses approved by the European Commission, adequacy decisions or other legally recognized transfer mechanisms, or your consent where required. Data protection laws in other countries may differ from those in your jurisdiction.
7. Disclosure
The Service Provider may disclose your data:
- as required by law, such as to comply with a subpoena or similar legal process;
- when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
- to the services that process data on our behalf (section 5), which may not use it for any other purpose.
8. Opt-out rights
You can turn off product analytics in the app at any time. Uninstalling the app or ceasing to use the website stops collection from your device, but does not delete data already sent to our servers; to delete it, use Delete Account (section 10).
9. Data retention
We have no fixed retention schedule: your data is kept until you delete your account and is deleted from our servers immediately when you do; PostHog data is deleted by PostHog according to its own processing. Unless the law requires us to keep it, we keep none of your data after you delete your account.
10. Data deletion
- Signed in or not, tap Delete Account in Settings › Backup & Sync. We revoke the Sign in with Apple authorization (if any), delete your RevenueCat subscriber record, your share preview images and your PostHog analytics data (person and events), and delete your account and all of your server data (including share and claim records); data on the device is cleared too. When you delete, the app stops uploading analytics and discards events not yet sent from your device; if a rare event already in transit reaches PostHog after the deletion, email us and we will delete it.
- Deleting your account does not cancel an Apple subscription; cancel it in Apple settings.
- Alternatively, email imjavanchen@gmail.com describing your situation and we will help delete your data.
11. Children
The Service is not intended for children under 16, or such higher age as required by applicable law, and we do not knowingly collect data from or market to children. Where parental or guardian consent is required by applicable law, the Service is not intended for use without that consent. If we discover that a child has provided personal data, we will delete it from our servers immediately. If you are a parent or guardian and know your child has provided personal data, email imjavanchen@gmail.com so we can take action.
12. Security
The Service Provider cares about keeping your information confidential and uses physical, electronic and procedural safeguards. For example, server data is isolated per account so only your account can read or write its own data, and share preview images are kept in private storage.
13. Data breach notification
If a data breach affects your personal data, the Service Provider will notify you as required by applicable law, including, where required, the nature of the breach and the steps being taken.
14. Changes
This policy may be updated from time to time. We change the effective date on this page and announce material changes in the app or on this site; where required by law, we will seek your consent before material changes take effect. Previous versions are available on request at imjavanchen@gmail.com.
This privacy policy is effective as of 2026-10-19.
15. Your consent
Where processing is based on consent (for example signing in with Apple or Google), you give it by taking that action. Product analytics is on by default and can be turned off in Settings at any time. You may withdraw consent at any time without affecting processing carried out before withdrawal. Other processing is carried out on the lawful bases described above.
16. Contact us
Any privacy question or request: imjavanchen@gmail.com