Privacy Policy

This policy covers the Hidlet iPhone app and the website hidlet.app. Both are run by Karawya LLC (“we”). The short version: we cannot see your photos or files, we do not ask who you are, and we do not sell or share data for advertising.

Your vault contents

Photos, videos, documents and their names and thumbnails are encrypted on your device before they are saved. The key comes from the pattern you draw and is never sent to us. We have no copy of your pattern, your recovery phrase or your files, so we cannot read them, recover them or hand them to anyone.

No accounts

Hidlet does not ask for your name, email address, phone number or any sign-up. There is no Hidlet account.

Encrypted backup and sync

If backup is on (it is by default), encrypted vault data is stored in your own private iCloud storage using Apple’s CloudKit. It is encrypted on your device first, so Apple stores only scrambled data and it never reaches our servers. Your use of iCloud is covered by Apple’s Privacy Policy.

Shared vaults

When you share a vault, its contents are encrypted on your device and stored through Apple’s CloudKit so the people you share it with can download them. Only someone with the share phrase can decrypt them. We cannot.

Purchases

Subscriptions and one-time purchases are processed by Apple. We do not receive your payment details. Apple gives us sales reports that do not identify you.

Diagnostics

The app has no analytics or advertising tools. If you have chosen in your iPhone settings to share analytics with app developers, Apple may send us crash reports and usage statistics. These do not include your files, patterns or recovery phrases. You can turn this off in Settings → Privacy & Security → Analytics & Improvements.

This website

This site uses no cookies or advertising. It is hosted by Cloudflare, which processes visitors’ IP addresses and browser information to deliver pages and protect the site from attacks. See Cloudflare’s Privacy Policy.

To count visits, we use PostHog, hosted in the European Union (Germany). For each page you open, it records the page address (including campaign tags in the link, such as utm_source), the site that sent you, your browser and device type, how long the page stayed open, and whether you tapped the App Store button. It stores nothing on your device, so we cannot recognise you from one visit to the next, and there is no session recording. Your IP address reaches PostHog when a visit is counted; we have set PostHog not to store it. If your browser sends “Do Not Track”, nothing is recorded. The data is not used for advertising or shared with advertisers.

Email

If you email us, we use your address and message only to reply, and we keep them only as long as needed to help you. Please never send us your pattern or recovery phrase.

Your email reaches us through Cloudflare’s email forwarding and is kept in our Google mailbox (Gmail). Our replies are sent through Resend, from servers in Ireland (EU).

Children

Hidlet is not directed at children under 13, and we do not knowingly collect information from them.

Your rights

Because we hold no personal data about you beyond any emails you send us, there is usually nothing for us to access, correct or delete. You can delete everything Hidlet stores by deleting your vaults in the app and its backup in iCloud settings. To ask about emails we hold, contact us.

Changes

If this policy changes, we will update it here and change the date at the top.

Contact

Karawya LLC: support@hidlet.app