Privacy Policy
This Privacy Policy explains how Halor collects, uses, and protects your personal data when you visit our website, subscribe to our newsletter, or interact with our content.
The Halor iOS app has its own privacy policy at halor.app/app-privacy — this page covers the website and newsletter only.
We've written this policy in plain English. It applies to subscribers and visitors in Singapore, Hong Kong, Australia, and New Zealand — Halor's MVP launch markets. Subscribers from other jurisdictions are welcome, but our data practices are designed for those four.
1. Who is responsible for your personal data
Halor is operated by Benjamin Sang-Hjon Cistecky, based in Singapore. We intend to incorporate a Singapore company to operate Halor; when that happens, this Policy will be updated to identify the new entity and you will be notified of the change.
Where this Policy refers to "Halor," "we," "us," or "our," it refers to that operator.
2. Privacy contact
For any privacy question, request, or complaint, contact us at privacy@halor.app. We aim to respond within 30 days.
The same address reaches the person responsible for data protection under the PDPA.
3. The personal data we collect
We collect the minimum data needed to deliver the newsletter, run the waitlist, and honour newsletter choices made in the Halor app:
- Email address — when you sign up via halor.app, choose the Healthspan Brief in the Halor app, or subscribe through Beehiiv or Substack directly.
- Free-text answer to one segmentation question — when you sign up, we ask "What's your single biggest health question right now?" Your answer is optional. If you answer, we store the text alongside your email.
- Server logs — IP address, browser / device data, and standard request metadata, captured automatically by our hosting provider for security and operational purposes.
- Newsletter engagement — subscription and delivery status, opens, clicks, signup source, timestamps, unsubscribe activity, and technical data generated when you interact with an email. Beehiiv associates this information with a subscriber profile. The website itself carries no analytics: we do not measure page views and set no cookies (see the Cookie Policy).
We do not collect health, biomarker, or lab data through this website. The Halor mobile app stores your health data on your device and, only if you enable backup, in your own iCloud. It is never transmitted to our servers. The app has its own privacy policy, available in the app and at halor.app/app-privacy.
4. Sources of data
All data we hold about you comes either directly from you (signup form, a Healthspan Brief choice in the app, email reply, free-text segmentation answer) or is generated automatically when you interact with our website or emails (server logs, delivery, open, and click events). We do not buy, rent, or scrape personal data from third parties.
5. Why we collect your data (purposes)
We use your data for the following purposes:
- Newsletter delivery — sending you our weekly newsletter and any related transactional emails (welcome, unsubscribe confirmation).
- Waitlist management — keeping a record of who has signed up and notifying you when the Halor app launches in your market.
- Future product launch communications — sending you early access details, founding-subscriber announcements, and related updates when the app launches.
- Newsletter engagement — understanding delivery and how subscribers engage with issues, so we can operate and improve the Brief.
- Compliance and security — detecting abuse, securing infrastructure, and meeting our legal obligations.
We do not use your data for behavioural advertising, do not sell or rent your data, and do not share it with third-party marketers.
6. Legal basis for processing
The legal basis depends on your jurisdiction:
- Singapore (PDPA): consent, given when you submit the signup form, plus reasonable purposes for processing necessary to deliver the service you requested.
- Hong Kong (PDPO): consent under the Personal Information Collection Statement embedded in our signup flow, aligned to the six Data Protection Principles.
- Australia (Privacy Act / APP): APP 3 (collection by lawful and fair means with consent), APP 5 (notification at point of collection), APP 6 (use limited to disclosed purposes).
- New Zealand (Privacy Act 2020): IPP 1 (lawful purpose), IPP 3 (notification of collection), IPP 10 (use limited to disclosed purposes).
If you withdraw consent, we will stop using your data for the affected purposes. Some processing (e.g., compliance recordkeeping) may continue where another legal basis applies.
In the Halor app, free membership and the Healthspan Brief are separate choices. Tapping “Join free + get the weekly Brief” is a single opt-in to immediate newsletter enrolment. “Join free without the Brief” provides the same app access without newsletter e-mail. Unsubscribing never affects membership.
7. Who we share your data with
We share your data only with service providers that help us run the newsletter and waitlist:
- Beehiiv (newsletter delivery and engagement measurement) — US-hosted. Addresses collected on halor.app or submitted through an explicit Healthspan Brief choice in the app are passed to Beehiiv. Beehiiv maintains subscriber profiles and processes delivery, open, click, and unsubscribe activity. The halor.app form itself is ours, not a Beehiiv embed. beehiiv.com/privacy; beehiiv.com/dpa.
- Substack (secondary newsletter platform, used as a content discovery surface) — US-hosted. substack.com/privacy.
- Cloudflare (website hosting and content delivery for halor.app) — global edge network. cloudflare.com/privacypolicy.
- Resend (transactional e-mail sent from @halor.app addresses) — US company, sending from its Tokyo region. resend.com/legal/privacy-policy.
We do not sell your data. We do not share it with advertisers or marketing networks.
The Halor mobile app uses additional providers described in the separate app privacy policy. No health data is sent to Beehiiv.
8. International transfers of data
Your data is processed and stored on systems located outside your country of residence. Specifically:
- Beehiiv and Substack are US-based and store data on US infrastructure.
- Cloudflare serves halor.app from a global edge network, so requests are processed at the location nearest you; transactional e-mail is sent from Resend’s Tokyo region.
This means your data leaves the APAC region. We rely on the following safeguards:
- Singapore (PDPA): transfers are made only to recipients that provide a comparable standard of protection or where consent has been obtained.
- Hong Kong (PDPO): Section 33 (cross-border transfer) is currently suspended, but we disclose transfers in this Policy to align with best practice.
- Australia (APP 8): we take reasonable steps to ensure overseas recipients comply with the APPs, and we remain accountable for those overseas recipients' handling of your data.
- New Zealand (IPP 12): we notify you of overseas storage in this Policy.
9. How long we keep your data
| Data category | Retention |
|---|---|
| Active subscriber email and segmentation answer | Until you unsubscribe |
| Unsubscribed email | Retained as needed to honour the unsubscribe and meet legal or operational requirements; you may request deletion |
| Server logs | 90 days |
| Newsletter engagement | While the subscriber profile is active and afterwards only as needed for legal, security, suppression, or aggregate reporting purposes |
| Free-text segmentation answers (if not deleted earlier on request) | 24 months from collection |
You may request earlier deletion at any time (see § 10).
10. Your rights
Depending on your jurisdiction, you have some or all of the following rights:
- Right to access — request a copy of the personal data we hold about you (all four jurisdictions).
- Right to correction — request that we correct inaccurate or incomplete data (all four).
- Right to deletion / erasure — request deletion of your data, subject to legal obligations to retain certain records (all four).
- Right to data portability — receive your data in a structured, machine-readable format (AU and NZ).
- Right to withdraw consent — for any processing based on consent, you may withdraw it at any time (all four).
- Right to object to direct marketing — you can opt out of marketing emails using the unsubscribe link in any email (all four).
- Right to lodge a complaint with the supervisory authority:
- Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
- Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD) — pcpd.org.hk
- Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
- New Zealand: Office of the Privacy Commissioner — privacy.org.nz
To exercise any right, email privacy@halor.app. We aim to respond within 30 days.
11. Cookies and tracking
halor.app sets no cookies at all — no analytics, no advertising or behavioural targeting, and no consent banner, because there is nothing to consent to. The signup form posts to our own server rather than an embedded third-party form, and the site makes no third-party requests. Full detail in the Cookie Policy.
If we ever add anything that stores data in your browser, we will update the Cookie Policy and ask for your consent before setting it.
12. Children and minors
Halor is intended for adults aged 18 and older. We do not knowingly collect personal data from anyone under 18.
If you believe a child under 18 has subscribed, contact privacy@halor.app and we will delete the data promptly.
13. Security
We protect your data using:
- TLS encryption for data in transit between you and our infrastructure
- Access controls limiting which team members can view subscriber data
- Periodic review of third-party providers' security posture
- Standard safeguards offered by Beehiiv and Substack (see their respective security pages)
No system is perfectly secure. If we detect a breach affecting your data, we will notify you and the relevant supervisory authorities within the time frames required by your jurisdiction (72 hours under SG PDPA; mandatory NDB scheme under AU; notifiable privacy breach scheme under NZ).
14. Changes to this Policy
We may update this Policy. When we do:
- The "Last updated" date at the top changes.
- For material changes (e.g., a new third-party recipient, a new data category), we will email subscribers and post a notice on halor.app.
- For minor changes (e.g., clarifying language), we update the date but do not separately notify.
Continued use of halor.app or continued subscription after a material change constitutes acceptance of the revised Policy.
15. Cross-references
This Policy works alongside:
If there is any conflict, the document specifically addressing the topic governs.
16. Contact
For privacy queries, requests, or complaints: privacy@halor.app.
For all other inquiries: ben@halor.app.