Privacy Policy
What this policy covers
This policy explains what Hatch stores, where it stores it, and what it never does with it. It is written to be read, not filed.
It describes the app as it actually behaves. Most of Hatch never touches a network, and where this policy says something does not leave your device, that is a statement about how the app is built, not a promise about how it is used. One feature, cloud backup, is optional, needs an account and is paid for; everything it involves is set out in its own sections below, and none of it applies to you unless you turn it on.
It applies to the Hatch app on iOS and Android, and to the copies of these pages published on the web. "We" means Ahmad Mansour, the developer of Hatch, reachable at lowkey9.ai@gmail.com; "you" means the person using the app. The web copies are served by Google's Firebase Hosting, which receives your IP address in order to deliver them; they set no cookies and contain no scripts or analytics.
The short version
Hatch needs no account and contains no analytics. Everything you put into it is encrypted on your phone and, unless you choose otherwise, stays on your phone. Without an account we receive nothing, so there is nothing we can look at, sell, lose in a breach, or hand to anyone else.
If you choose the optional, paid cloud backup, you create an account, and we then hold your email address, your subscription status and an encrypted copy of your vault that we cannot read. The rest of this policy is the same statement, said precisely enough to be checked.
What we collect
Without an account, nothing. An account is optional and is only offered for cloud backup; nothing else in the app needs or asks for one. There is no analytics, crash reporting or advertising code in the app, with or without an account.
Everything you put into the vault — photos, videos, files, notes and passwords — is encrypted on the device before it is written to storage, and the key that opens it is itself stored only in encrypted form. We never receive any of it in a form we can read: unless you turn on cloud backup it is never sent anywhere, and if you do, what is sent is that same ciphertext, which we cannot decrypt.
Your preferences (theme, language, reminders) are stored locally and are deleted when the app is deleted.
What stays on your device
The vault itself: your files, encrypted one record at a time, with names that say nothing about what they hold, and an index of them that is decrypted into memory only while the vault is open.
The things that make it work: the wrapped key material, a count of failed unlock attempts and which entrance they came through, and the settings you have chosen. The attempt count sits outside the encrypted index on purpose — a lockout that could only be read after a successful unlock would not be a lockout.
Nothing on this list is readable by another app on a device that has not been tampered with, and none of it is registered with the system photo library or media index, so vault contents do not appear in the phone's own gallery, in search, or in a file picker.
Permissions, and what each one is for
The app asks for a permission at the moment a feature needs it, never on first launch as a bundle, and every one of them is optional: the app keeps working without it, minus that feature.
Photos: to read the items you pick when importing from your camera roll. Only the ones you choose are read, and location data is stripped before they are encrypted.
Camera and microphone: only if you take a photo, shoot a video or record a voice note into the vault from inside the app. The microphone is used only while you are recording, and if you refuse it, videos are recorded without sound. Nothing is captured in the background.
Notifications: only if you turn on reminders. Notification text never names an item or shows its contents.
Local network: used only by shared albums, and only while an album's sharing screen is open. The app finds the one phone you paired with on the same Wi-Fi and connects to it directly. It refuses any address outside your local network, everything it sends is encrypted end to end, and we are not involved at any point. Nothing is sent to the internet. On Android the release build declares the internet permission, because a connection to another phone on your Wi-Fi needs it; on iOS you are asked for local network access the first time.
Internet: used only if you open cloud backup — to sign in, to buy or check a plan, and to upload or download your encrypted backup. Nothing else in the app connects to the internet, and every other feature works with the phone in aeroplane mode.
You can withdraw any of these in the system settings afterwards. The app will tell you what stopped working rather than failing quietly.
Other companies
There are no analytics, advertising or crash-reporting SDKs in the app, and no attribution or "growth" tooling of any kind. The only outside service the app can talk to is Google's Firebase, and only for cloud backup, as described below.
The store you installed from, and the company that runs it (Apple or Google), still know what they know — that you downloaded an app, and, if you buy something, that a purchase happened. That is between you and them under their privacy policy. If you buy a cloud backup plan, the store tells us the plan, its renewal and expiry dates and an identifier for the purchase; we never receive your name, your payment details or your store account.
If you use the system share sheet to send something out of the vault, it leaves under the rules of whichever app you send it to. The app warns you at that point, because that is the one moment where its guarantees end.
What we do not do
We do not sell data. We do not show third-party advertising. We do not track you across other apps or websites. We cannot read the contents of your vault, including the encrypted copy that cloud backup keeps. The app works with the network switched off; the only things that need it are cloud backup, if you use it, and sharing an album directly with a phone you paired with, over your own Wi-Fi.
We do not profile you and we do not make automated decisions about you. What an account holds is used to run cloud backup and for nothing else.
How it is protected
Your secret is stretched with Argon2id and never stored. On devices that support it, unlocking also requires a device key that cannot be exported from the Secure Enclave on iOS or the Android Keystore, so the vault key is unwrapped only when both your secret and this phone are present: a copy of the app's data, a backup file or a cloud backup cannot be attacked offline by guessing your secret, and restoring a backup on a different phone needs your 24-word recovery phrase. On a device without such a key, your secret is protected by the cost of Argon2id alone, so choose a long one. File contents are encrypted with XChaCha20-Poly1305, which also detects any change made to a stored file behind the app's back.
That is strong, and it is not magic. It protects the data at rest on a device you still control. It does not protect you from someone who knows your secret, from malware on a rooted or jailbroken phone, or from a person standing next to you while the vault is open. Nothing installed as an ordinary app can, and any app that claims otherwise is selling you something.
Cloud backup: what it is
Cloud backup is an optional, paid subscription that keeps an encrypted copy of your vault on servers we rent from Google, so that a lost or broken phone does not have to mean a lost vault. None of it happens unless you open cloud backup in the app, create or sign in to an account, and choose to back up. The rest of the app does not need it and works the same without it.
What is uploaded is exactly what the app's own export bundle contains: every encrypted record in the vault, and the vault's key file, in which every key is itself encrypted under your secret or your recovery phrase. Never your secret, your recovery phrase, an unencrypted key, a file name, or anything else in readable form. We cannot decrypt it, and neither can Google.
Restoring on a new phone needs your recovery phrase. On phones with a hardware key, your PIN, password or pattern is tied to the phone that made the backup, so the cloud copy on its own cannot be used to test guesses at it.
Cloud backup: what we hold
For cloud backup, Ahmad Mansour, the developer of Hatch, is the data controller, reachable at lowkey9.ai@gmail.com. If you create an account, and only then, we hold the following.
Your email address, and the sign-in method you used: email and password, Sign in with Apple (on iOS), or Google (on Android). With Sign in with Apple you can share a private relay address instead of your own. A password you choose for the account is stored only as a salted hash by our sign-in provider, and it is separate from your vault secret: it cannot open your vault. An email address is required to create an account: without one there is no cloud backup, and nothing else in the app is affected.
An account identifier, and when the account was created and last signed in to.
Your subscription: the plan, whether it renews, when it expires, which store it was bought from, and the store's identifier for the purchase. The store tells us this when you buy, renew, cancel or are refunded.
The encrypted backup, and what anyone storing it can see without decrypting it: how many records it holds, the size of each, the total storage used, and when each backup was made.
Like any server, Google's infrastructure records the IP address and device details of each request in its logs. They are used only to run and secure the service, never to locate or profile you.
We use all of this for one purpose: to provide cloud backup — signing you in, sending the emails an account needs (confirming your address and resetting a password), checking your subscription, enforcing your storage limit, and restoring your vault. The legal basis is the contract between us (your subscription), and, for security logs, our legitimate interest in keeping the service safe. We do not use it for advertising or analytics, and we do not sell it or share it with anyone beyond the processors below.
Cloud backup: who processes it
Google (Firebase and Google Cloud) stores the account and the encrypted backup on our behalf, in the United States (the us-central1 region), under Google's data processing terms. For users in the EEA, the UK and Switzerland, that transfer relies on the safeguards in those terms, such as the European Commission's standard contractual clauses.
The store you buy from (the App Store or Google Play, run by Apple or Google) takes your payment as an independent controller, under its own privacy policy. It tells us the subscription details listed above. Each purchase carries an identifier derived from your account, so that a subscription cannot be attached to someone else's account; it reveals nothing else about you. If you sign in with a third-party account rather than a password, its provider confirms your identity to us under its own privacy policy and passes us only the email address you chose to share; we never receive that account's password.
Cloud backup: how long it is kept
While your subscription is active, your backup is kept and updated each time you back up; records that are no longer in your vault are removed from it.
When a subscription ends — cancelled, expired or refunded — you can still restore for 30 days, but no longer back up. After those 30 days the backup is deleted automatically. The account itself, holding only your email address and sign-in details, remains until you delete it.
Deleting your account from the account screen in the app deletes the backup, the subscription record and the account immediately. It does not cancel the subscription: cancel that in your store account's subscription settings, or the store will keep charging you. If you no longer have the app, email lowkey9.ai@gmail.com from the account's address and we will delete it within 30 days. Entries in Google's request logs expire on Google's schedule, normally within 30 days, and the store keeps its own purchase records.
How long anything is kept
On your phone, for as long as you keep it, and no longer. Without an account there is no retention schedule to publish, because nothing is held anywhere but on your phone. If you have an account, the rules for what we hold are in "Cloud backup: how long it is kept".
Deleting an item removes it from the vault. Deleting the app removes everything the app kept on the phone, including the keys. If your phone backs itself up to iCloud or Google, the vault is excluded from that backup, so restoring a new phone does not bring it back — that is deliberate, and it is why the export bundle, the optional cloud backup and the recovery phrase exist.
Your choices
You can delete the vault and everything in it from Settings at any time. That deletion is real: the keys are destroyed and the encrypted data becomes unreadable, including by us. If you use cloud backup, deleting the vault on the phone does not delete the cloud copy; deleting your account does.
There is a consequence to this design that you should understand before relying on it. Because we hold no keys and no readable copy of your data, we cannot recover anything for you. If you lose your PIN, password or pattern and also lose the recovery phrase shown when you set the vault up, what is in the vault is gone permanently — and so is any cloud backup of it, which cannot be opened without them.
Children
Hatch is not directed at children. It contains nothing made for children, and a parent setting up a child's phone should treat it as they would any other app that keeps things private. Cloud backup accounts are not meant for children under 13, or under the age of digital consent where they live; we do not knowingly keep one, and if you tell us about one we will delete it.
Your rights over your data
Under the GDPR, the UK GDPR, the CCPA and similar laws, you have rights to access, correct, export and delete the personal data a company holds about you, and to object to or restrict how it is used. Without an account we hold none. With one, we hold what is listed in "Cloud backup: what we hold", and these rights apply to all of it.
Most of them you can exercise directly in the app, without asking us: the vault's contents are in front of you and the export bundle gives you a portable copy; the account screen shows your email address and plan; and Delete account erases the account and its backup straight away.
For anything else — a copy of the account data we hold, a correction, or deletion when you no longer have the app — write to lowkey9.ai@gmail.com from the email address on the account, so we know the request is yours. We answer within one month. You also have the right to complain to the data protection authority where you live.
Requests from courts and the police
We can only produce what we have. Without an account that is nothing: no records, no backups, no keys, and no way to identify a user. With an account it is the data listed in "Cloud backup: what we hold" and the encrypted backup, which we cannot decrypt, because we never have your secret, your recovery phrase or any key. We have no ability to reach into an installed copy of the app.
This is a property of the design rather than a promise about our conduct, and it is the reason the design is what it is. We disclose account data only when the law requires it and, where we are allowed to, we tell you first. Note that none of this says anything about the phone itself, which its owner or holder may be legally obliged to unlock.
Where this applies
Everywhere the app runs. Without cloud backup there is no transfer of any kind: your data never leaves your device unless you deliberately export or share it. With cloud backup, your account data and encrypted backup are stored by Google in the United States, as described in "Cloud backup: who processes it".
You are responsible for the laws that apply to you where you are, including any that govern the material you keep encrypted.
Changes to this policy
We may update this policy as the app changes. The effective date at the top tells you when it last changed, and a change that materially affects what is stored or asked for will be pointed out in the app rather than published quietly.
Continuing to use the app after a change means you accept the updated policy.
Contact
Questions about this policy, about what the app does, or about anything in it that reads as evasive: write to lowkey9.ai@gmail.com, the same address as Settings → Help & support. A question that shows this policy is unclear is worth more to us than one that shows it is thorough.