hexis — habit journal · earlier-build policy, revised 12 september 2026
hexis is built to be private. the short version: your journal stays with you, and we never see it. there is no hexis server and no hexis account, so there is nowhere for your habits to go and no one here to read them. the only times anything leaves your device are ones you choose — iCloud sync, a group you start or join, a backup you export, a card you share, or an email you send us — and even then it goes to Apple or to whoever you sent it, never to a hexis system.
hexis was called tally until august 2026. same app, same developer, same policy — this page moved with it, which is why its address still says tally.
nothing about you, and nothing out of your journal. hexis has no analytics SDK, no tracking, no advertising, no attribution, no crash reporting, and no hexis account.
hexis carries no third-party code that reports anywhere. the app talks to Apple and to nobody else: the App Store for purchases, and iCloud for sync and groups.
the one way you can send us something is by writing to us — a support email or a report from a group. that is set out below, because it is the one path where personal information can reach us, and only because you chose to send it.
your habits, their marks, streaks, amounts and settings are stored in files on your device, inside the app's own storage. what they hold is the list of habits you made — each one's name, icon, target and amount, cadence, reminder time, and which days you marked kept, rested, or mended — your routines, and your signatures and the commitments you signed. nothing else about you is in them.
hexis also offers optional iCloud sync, off by default. when you turn it on in settings, your habits, their marks and signatures, the earned-mend balance, and records needed to merge changes and deletions are mirrored to your private iCloud. routines are not included in this sync. Apple protects the data in transit and at rest; we have no access to your private iCloud. turning sync off stops further mirroring.
deleting the app removes the copy on your device. if iCloud sync was ever on, the mirrored copy stays in your own iCloud until you remove it there — iOS Settings › your name › iCloud › Manage Account Storage. we cannot remove it for you, and we cannot see it either. if you host a group, deleting the app does not end that group — see leaving and ending a group.
a routine is a named block of your day, with an optional start time, a reminder, a repeat, and a timer. routines are stored on your device and included in backups you export, but are not mirrored by the app's iCloud sync. routines are not sent to groups or to the watch app. when a routine's timer is running it can show a Live Activity on your lock screen and Dynamic Island; that is drawn on your device from local state, with no push token and no server behind it.
if you install the watch app, hexis keeps a copy of your journal on the watch so you can mark a day without your phone. it carries your habit names, icons, cadences, targets and which days are marked — enough to draw the same journal — and it travels straight between your two devices over Apple's device-to-device link. it does not pass through a server, and it does not pass through us.
the phone currently transfers the full habit snapshot to your paired watch. that transfer can include a habit's signature and other fields that the watch does not display. the watch decodes the fields it uses for its journal and ignores the others; its displayed journal does not show signatures. routines are not in this snapshot. deleting the watch app removes its local journal.
the home screen widgets and the watch face complication read the same on-device journal and draw from it. they send nothing anywhere.
when you sign a commitment, hexis keeps what you drew as a set of points, on your device, alongside the habit you signed for. it is mirrored to your private iCloud if you have sync on.
signatures are not shared with group members or sent to the developer automatically. they can be included in your private iCloud sync and in the full habit snapshot transferred to your paired watch, although the watch does not display them. a backup you export also contains signatures; if you send that file to another person or to support, that recipient receives them. see backups you export.
a group lets a few people keep one habit side by side. it is entirely optional — nothing is shared until you start a group or accept an invite, and the rest of the app works the same either way.
a group lives in a shared iCloud area hosted by the person who created it. Apple carries it; there is no hexis server, and we cannot read a group's contents or reach into it.
what the other members of a group can see:
what is not shared with the group: every other habit in your journal, your routines, and the selected habit's amounts, reminders, commitments and signature. those items may still be part of your own device storage, private sync or deliberate exports as described elsewhere in this policy. group sharing includes the fields listed above and the app-scoped identifiers needed to identify membership.
how you are identified in a group. Apple issues hexis an identifier for your iCloud account, scoped to this app. that is what marks your row as yours. it is not your Apple ID, your email, or your real name, and we never see it — but it is the same identifier in every group you share with someone, which is what lets blocking follow a person from one group to another.
the invite is a link, and anyone who has it can join and see the group. it is not restricted to a person you named, and a link passed on works for whoever receives it. share it only with people you mean to let in. the app says this where the invite is created.
you can leave a group at any time from the group's screen. your member record — your name, colour and shared dates — is deleted out of the group, and your own marks stay in your journal, untouched.
if you created a group, the same screen offers end group. that is the action that deletes the shared iCloud area and everything in it, for everyone. deleting the app does not do this. an uninstall removes your device's copy, but the shared area stays in your iCloud and the group stays alive for the members you invited. to remove it, end the group from inside the app before you delete it — or, if the app is already gone, reinstall it, open the group, and end it there.
hexis uses two different things that both arrive as notifications, and they are worth telling apart.
reminders you set are local notifications — for habits and for routines — scheduled and delivered by your own device. they name the habit or routine they are for, so they are as private as your lock screen is. they never touch a server.
groups use silent background notifications. hexis registers with Apple's push service when the app launches so CloudKit can deliver database-change notifications used by group syncing. these contain background change information, not a visible reminder: they make no sound and show no alert. delivery is controlled by Apple and may be delayed. the developer does not operate a push server or receive your push token.
the money is Apple's business, not ours. subscriptions, any free trial, and the older one-time unlock are all handled through the App Store, on your App Store account. we never see your payment details — no card, no billing address, nothing of the sort ever reaches us or anyone acting for us.
to work out what to unlock, hexis checks Apple's verified transaction and subscription information through StoreKit. product loading, purchasing and restoring communicate with Apple; entitlement information can also be read from StoreKit's local records. the app does not send journal contents with these checks. offline access depends on the valid entitlement information available on the device; a restore or purchase may require an internet connection.
you can manage or cancel a subscription in your App Store account settings.
hexis writes a small log of its own first-run steps — that onboarding began, that a habit was made, that a day was first marked, that the hexis+ page was shown — with a timestamp on each. this is stored on your device and is not sent anywhere. there is no analytics service behind it and no code in the app that transmits it; it exists so the app's own screens can be reasoned about, and it goes when you delete the app. it holds no habit names, no marks, and nothing that identifies you.
exporting a backup writes your whole journal into a single file that you then save or send wherever you choose. that file contains everything — every habit and its amounts, every mark, your routines, your mend balance, and your signatures and the commitments you signed.
from the moment you export it, the file is yours to look after: it is no longer inside the app's protection, and we have no part in where it goes. if you send a backup to someone, you are sending them your signatures too. restoring a backup reads it straight back into the app on your device.
when you share your progress, the image is drawn on your device and handed to whatever you share it to. what happens next is that app's business, under its rules rather than ours. hexis copies to your clipboard and shares out; it never reads your clipboard.
two things in the app compose an email to us: support, and a report about someone in a group. both are written on your device and sent by you, from your own mail app — hexis does not send them for you, and nothing is transmitted if you close the draft.
what we receive. a support email brings whatever you write, your sending email address and displayed sender name, and — from the support link inside the app — your hexis version. a group report includes the group's name and identifier, the reported member's name and identifier, your app-scoped member identifier when available, the reason, your added note, the app version and the time the report was prepared. you can review the email before sending it. if you attach a backup or screenshot, we receive that too, so send only what you mean to.
what we do with it. we read it, answer it, and act on it. reports are used to deal with the behaviour reported and nothing else. we do not sell any of it, we do not use it for marketing, and we do not pass it on except where the law requires it.
how long we keep it. your message sits in the developer's mailbox, which is an ordinary email account, for as long as it is useful — to answer you, to fix the thing you found, and to keep a short record of reports so that a repeat offender is recognisable. we do not build a profile of you from it.
deletion. write to the address at the foot of this page and ask, and we will delete the correspondence we hold from you. a report may need to be kept in a minimal form — that a report was made, and about whom — where deleting it would undo a safety measure still in force.
hexis is not directed at children, and there is no hexis account to create. the app collects nothing about anyone into any system of ours — a child using hexis writes only to their own device and, if they turn it on, their own iCloud.
the one exception is the same one that applies to everybody: if a child writes to us, that email reaches us like any other. we do not knowingly solicit personal information from children, and if we learn that a child has sent us personal information we will delete it. a parent or guardian can ask us to do the same, at the address below.
if this policy ever changes, the new version will be posted here with a new effective date. this earlier-build policy, revised 12 september 2026, separates the silent background notifications groups use from the reminders you set; corrects what deleting the app does to a group you host; describes the edit receipts a group now carries; and says plainly what a support email or a report brings us. the previous version's account of those things is superseded.
questions, or a request about your data? write to martyelenjikkal@gmail.com and it reaches the developer directly.