HIDDEN — PRIVACY POLICY

1. WHO WE ARE

Hidden ("the App") is an encrypted vault for photos, videos and notes, made by Dimitrios Daskaleas, trading as fineapps ("we", "us").

Data Controller: Dimitrios Daskaleas, trading as fineapps
Address: Kallikratida 53, Piraeus 18544, Greece
Contact: hidden@fineapps.gr

2. THE SHORT VERSION

• Hidden has no account with us, and we run no server that receives your content.
• Everything you put in Hidden is encrypted on your device before it is stored anywhere.
• Your encrypted vault is stored where you choose: your own iCloud, your own Google Drive, or only on your phone.
• Hidden contains no analytics, no advertising, no tracking and no crash reporter.
• We cannot read, recover, hand over or delete your vault, because we never have it or its keys.

3. WHAT HIDDEN PROCESSES, AND WHERE

3.1 Your content (photos, videos, notes, tags and tables)

Your content is encrypted on your device with a key derived from your passphrase (Argon2id and XChaCha20-Poly1305). Only the encrypted form leaves the App. We never receive your content, your passphrase, your recovery phrase or your keys.

3.2 Where the encrypted vault is stored

• iCloud (iPhone): in a private folder of your own iCloud account, under Apple's terms and privacy policy. Apple stores the encrypted files but cannot read them.
• Google Drive: in Drive's hidden app-data folder of your own Google account, under Google's terms and privacy policy. Google stores the encrypted files but cannot read them.
• This phone only: in the App's storage on your device. If you lose the phone without an encrypted backup file, the vault is lost.

We are not a party to your storage with Apple or Google, and nothing is stored on any server of ours.

3.3 Google sign-in and Google Drive

If you choose Google Drive, the App asks Google for one permission only: drive.appdata, a private folder that only Hidden can use. Hidden cannot see any other file in your Drive. The sign-in token stays on your device and is never sent to us.

Hidden's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That information is used only to store and read your own encrypted vault, never for advertising, never sold, and never read by people.

3.4 Your photo library

With your permission, the App reads the photos and videos you choose to move (on iPhone, the Photos "Hidden" album; on Android, the albums you pick), encrypts them and stores them in your vault. It asks your phone to remove the originals only after the encrypted copy has been read back and checked, and your phone asks you to confirm. If you use the calculator disguise on iPhone, the App can also save the calculator picture you chose to Photos, with add-only access.

3.5 Face ID, Touch ID and fingerprint unlock

Biometric unlock is handled entirely by your phone's operating system. The App only learns whether the check succeeded; no biometric data ever reaches the App or us.

3.6 Purchases

The one-time unlock is sold by Apple (App Store) or Google (Google Play). They process the payment; we receive no card or payment details, and the App checks your purchase with the store on your device.

3.7 Settings on your device

The App keeps its settings (for example your storage choice, auto-lock time and disguise choice) on your device. A copy of your vault key may be kept in your phone's secure Keychain/Keystore for biometric unlock. None of this is sent to us.

3.8 The web version (hidden.fineapps.gr)

The web version runs the same app in your browser and follows the same rules. Your encrypted vault is stored either in your Google Drive (as in 3.3) or in your browser's own storage on your device ("This browser only"). The browser also keeps the app's settings and which home-screen look you chose. We set no cookies and run no analytics.

The web version's files are delivered by Cloudflare, which processes your IP address to send them to you, as any website host does. We receive no logs or statistics from it. If you choose Google Drive, Google's sign-in script is loaded from Google.

3.9 Email

If you write to us, we receive your email address and what you write, and use them only to answer you. We keep that correspondence for as long as needed to handle your request, then delete it.

4. WHAT WE DO NOT DO

• No analytics, telemetry, advertising identifiers or tracking of any kind.
• No crash reports or logs leave your device.
• No selling, sharing or transferring of your data, because we hold none.

5. KEEPING AND DELETING YOUR VAULT

Your vault stays wherever you stored it until you delete it:

• iCloud: iPhone Settings → your name → iCloud → Manage Storage → Hidden → Delete Data.
• Google Drive: Google Drive → Settings → Manage apps → Hidden → Options → Delete hidden app data.
• This phone only: deleting the App deletes the vault. This browser only (web version): removing Hidden from the home screen or clearing the site's data deletes the vault.

Encrypted backup files you export are ordinary files that you keep and delete yourself. If you lose both your passphrase and your recovery phrase, nobody, including us, can open your vault.

6. SECURITY

The App uses modern, standard cryptography and verifies every stored item by reading it back and decrypting it. No system is perfectly secure: keep your passphrase and recovery phrase private, and your phone locked.

7. YOUR RIGHTS

Under the GDPR and similar laws you have the right to access, correct, delete, restrict or port your personal data, and to object to its processing. Because we hold no personal data from the App, most requests are fully answered by the controls in Section 5. For anything else, email hidden@fineapps.gr; we reply within 30 days. You may also complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority of your country.

8. CHILDREN

Hidden is not directed to children under 16, and we do not knowingly receive any data from children.

9. CHANGES TO THIS POLICY

If we change this policy, we will update this page and its date. If a change affects how your data is handled, the App will tell you before it applies.

10. CONTACT

Email: hidden@fineapps.gr
Website: fineapps.gr/hidden
Address: Kallikratida 53, Piraeus 18544, Greece