Privacy Policy

The short version

Hoidur has no server. GÜNES CONSULTING OÜ receives no data from the app — not your vault, not your email address, not analytics, not crash reports, not a count of how many times you opened it. There is no account to create and nothing to sign in to.

This is true of Hoidur on Mac, iPhone and iPad, and of Hoidur on Android. Where the two differ is only in whose storage your vault syncs through, and in both cases it is storage you already own.

What is encrypted, and when

Everything you type is encrypted on your device before it is stored anywhere — item names, usernames, passwords, one-time-code secrets, notes, group names, attachment filenames and attachment contents. The key comes from your master password, which never leaves your device and which we never receive.

What is not encrypted is what the app needs in order to put your items in order: an identifier, whether an item is a favourite, when it was created, changed or deleted, and which group it is in. None of that says anything about who you are or what the item is for.

Where your vault lives

On the device you are using, always. If you turn on sync, a copy also travels through storage belonging to you:

• Mac, iPhone and iPad — the private database of your own iCloud account, under your Apple Account. Already encrypted by Hoidur before it gets there, and encrypted again by Apple on top. We cannot read it, list it, or ask Apple for it.
• Android — a single file in your own Google Drive, in the private application folder Google keeps for each app. No other app can see it, and it does not appear among your own Drive files; you see only that Hoidur is using some space. Hoidur asks Google for one permission, drive.appdata, which is access to that folder and nothing else. It cannot read any of your files.

If you have not turned sync on, or you are not signed in, Hoidur keeps everything on that one device and says so at the bottom of its sidebar.

The recovery key

So that a forgotten master password is not the end of your vault, Hoidur stores one small recovery key with the platform you are already signed in to — your iCloud Keychain on Apple devices, or Google's Block Store on Android. Both are encrypted end to end, both are tied to your own account, and neither is readable by us or by anyone but your own devices.

The key unlocks your vault. It is not your vault, and it is not your master password.

What the app sends over the network

Two things, neither of them to us.

Sync, if you turn it on, which goes to Apple or to Google under your own account, as described above.

The purchase, if you buy sync, which is handled entirely by the App Store or Google Play. They tell the app whether the purchase is active. They do not tell us who you are, and we never see your payment details.

There is nothing else. Hoidur contacts no server of ours, fetches no icons or images from the internet, and contains no analytics, advertising or crash-reporting code of any kind.

Permissions on Android

Hoidur asks for four, and no others. Internet and network state, for sync to your own Drive. Biometrics, to unlock with your fingerprint or face. Billing, for the one purchase. It asks for no access to your files, contacts, location, camera, microphone or messages.

Your data rights

Because we hold no data about you, there is nothing for us to export, correct or delete. Your vault is yours: Hoidur can export the whole of it to a file at any time.

To remove it, delete the app. On Apple devices, also delete Hoidur's data from iCloud in your system settings. On Android, remove Hoidur's app data in your Google Drive settings, under the list of apps that store data there.

This website

hoidur.eu uses Vercel Analytics to count page views. It records aggregate visit data — page, referrer, country, device type — without cookies and without building a profile of you. This is the one place any measurement happens, and it is separate from the app in every sense. The app itself contains no analytics of any kind.

Children

Hoidur is not directed at children and collects no personal information from anyone, including children.

Changes

If this policy ever changes, the updated date above changes with it. A change that would involve collecting anything at all would be announced in the app before it took effect.

Contact

GÜNES CONSULTING OÜ, Tallinn, Estonia — support@hoidur.eu