Isokratis

Privacy Policy

Last updated: 5 November 2026.

Isokratis is a drone (ison) app for Byzantine chant. This policy explains what personal data the app and its server handle, why, and what you can do about it. We wrote it to be read, not skimmed past: if something here is unclear, ask us.

Who is responsible for your data

Isokratis is made by Konstantinos Chafis, an individual developer based in Greece. In this policy "we" and "us" mean him. He is the "controller" of your personal data under the EU General Data Protection Regulation (GDPR).

The short version

Without an account

Your settings, presets, scales, key layouts, prepared services and templates, imported audio samples, reader library and reader backgrounds are stored only on your device. Nothing about you is sent to us, unless you send us feedback (see "Feedback").

The app does contact one server even without an account: when it starts, it asks Expo's update service (see "Who else handles your data") whether a newer version of the app is available. That request carries technical details such as your platform, the app version and your IP address, and nothing that identifies you personally.

With an account

When you create an account we store:

We use this to sign you in, keep you signed in, unlock Premium, and send you the emails described below.

Free trial records

Every new account gets 14 days of Premium free. To give one free trial per person, we keep trial records: keyed hashes (HMAC-SHA256, with a secret key that only we hold) of:

We never store the device identifier itself in readable form, and the hashes alone cannot be turned back into the identifier, the address or the account ID. When you create an account, we compare them with earlier records. If any of them already had a trial, the new account gets none.

Trial records are kept after you delete your account, so that a re-created account does not get a second trial. We delete them 2 years after the trial started.

Sign-up attempts and code requests are limited in number per IP address. We use your IP address only for that and do not store it; as with every request, Cloudflare processes it as our host (see "Who else handles your data").

We may ask you to confirm your email address with a one-time code before the trial starts. The code is sent by email through MailerSend (see "Emails"). We store only a hash of the code, and only for 15 minutes.

Sync across devices (Premium)

Nothing below is uploaded unless you turn on Sync across devices in Profile. The switch is off until you turn it on, and it is set separately on each device. When it is on, we store, so they are the same on every device you sign in on:

The PDF files themselves are never uploaded. Volume, keep-screen-awake and reader backgrounds always stay on the device.

If your trial or subscription ends, this data stays stored but stops syncing, and it is back if you subscribe again. Turning sync off stops syncing from that device. Data already stored stays until you delete your account or ask us to delete it.

Data related to religious music

Isokratis is made for Byzantine chant, which is religious music, so your account and the titles of the books you sync are connected with a religious tradition. Data protection law, including the GDPR, gives extra protection to information that could indicate a person's religion. We don't ask what you believe and never try to work it out, but to be safe we give this data that extra protection anyway: we use it only to provide the app to you, never to profile you, and only with your explicit consent. You give that consent when you create your account and, for book titles, when you turn on Sync across devices. You can withdraw it at any time by deleting your account, or by turning off sync and asking us to delete your synced library.

Subscriptions and payments

Premium is sold through the Apple App Store and Google Play. Apple or Google handles the payment: we never see your card or bank details. To know whether your subscription is active, the app uses RevenueCat (see below), which receives from the store the details of your purchase: the product, the purchase, renewal and expiry dates, the price and currency, and the country of the store. RevenueCat receives only your internal account number, not your name or email, together with the store's purchase records. When you delete your account, your subscriber record at RevenueCat is deleted too.

Emails

We send you:

Our mailing list lives in our own database. We send emails through MailerSend, which receives your address and the email's content only to deliver it and keeps a delivery log for a limited time.

Feedback

You can send us feedback from General → Send feedback. With it we store:

Feedback is not linked to your account, whether you have one or not: unless you give us an email address, we can't tell who sent it. We use it only to fix problems, improve the app and, if you asked, reply to you. Please leave out personal details you don't want us to have. We keep feedback for 2 years and then delete it. To have something you sent deleted sooner, email us; if you gave no email address, tell us roughly when you sent it and what it said.

Why we may use your data (legal bases)

We make no decisions about you by automated means alone, and we do not profile you.

Who else handles your data

We use a small number of service providers, who process your data only on our instructions and under data processing agreements:

Some services act on their own account, under their own privacy policies:

We share your data with no one else, unless the law requires us to.

Data stored outside the EU

Some of these providers are based in, or use servers in, the United States and other countries outside the European Economic Area. When your data leaves the EEA, it is protected by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

How long we keep it

Data on your device stays there until you delete it or uninstall the app.

Your rights

You have the right to:

You can delete your account yourself in Profile → Delete account, or by following Delete your account. For anything else, email koxafis@gmail.com. We will answer within one month. We may ask you to confirm that the account is yours before acting.

If you believe we handle your data unlawfully, you can complain to a data protection authority. In Greece that is the Hellenic Data Protection Authority (www.dpa.gr). You can also complain in the EU country where you live or work.

Children

You must be at least 13 years old to create an account. If you are under 18, you need the permission of a parent or guardian, and they should read this policy with you. Children under 13 can use the free features without an account; then no personal data is collected. If we learn that someone under 13 has created an account, we will delete it.

Security

Connections to our server are encrypted (HTTPS). Passwords are stored only as salted hashes. Your sign-in token is kept in your device's secure storage. Each account can reach only its own data. No system is perfectly secure, but if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters to how your data is used, we will tell you in the app or by email before it takes effect.

Contact

Questions about this policy or your data: koxafis@gmail.com, or write to Konstantinos Chafis, Platonos 14, 145 63 Kifisia, Greece.