Hyde Privacy Policy

Last updated: 20 October 2026. Applies to Hyde version 1.4 and later.

1. What Stays on Your Device

• Your vault. Photos, videos, documents and folder names are encrypted on your device with AES-GCM. Encryption keys and PINs are kept in your device's Keychain. We have no copy of your keys and cannot see, recover or restore your vault.
• Camera, microphone, photo library and Face ID. These are used on your device only to do what you ask, such as taking a photo or importing a video. Face ID is handled by Apple; we never receive biometric data.
• Device backups. Encrypted vault files can be included in your iCloud or computer backups. They stay encrypted in those backups.
• Vault backups you export. These are encrypted with a password you choose and saved wherever you choose. If you save one to a cloud service, that service's privacy policy applies to the file.

2. Information We Collect

Usage analytics

We use PostHog, an analytics service with servers in the United States, to understand how Hyde is used. The app sends only events we define ourselves, such as:

• The app being installed, updated, opened or closed
• Onboarding steps viewed and how long each took
• The subscription screen being viewed, and a subscription purchased (with the plan) or restored
• A vault being unlocked, or a folder being created
• Items imported or deleted (the media type and counts only)
• A vault backup being exported or restored

With these events, PostHog receives standard device and app information (device model, iOS version, app version, language and time zone) and your IP address, which it may use to estimate your approximate location (country or city).

Events are linked to a random identifier and to your anonymous subscription ID (see "Subscriptions" below). They never include your photos, videos, files, file or folder names, PINs, or anything else inside your vault. Hyde does not use session replay, screen recording or automatic tap capture.

Crash reports and diagnostics

If the app crashes or hits an error, PostHog collects a report with the error type, technical details of where it happened in the app's code, and device and app information. The app also sends a few technical log entries, for example that an unlock or a purchase completed. These never include your content.

Subscriptions

Payments are processed by Apple. We never see your card details or your Apple Account name or email.

We use RevenueCat to manage subscriptions. RevenueCat assigns you an anonymous ID and receives your App Store transaction information (products, purchase and renewal dates, trial status), along with device information such as your IP address, iOS version and region. See RevenueCat's privacy policy.

Shared collections (optional, Hyde Pro)

Nothing leaves your vault unless you choose to share a collection. When you do:

• What is uploaded: the photos you select, the folder names, and the collection title and description you enter. Photo file names are replaced with generic names such as "Photo 1.jpg". Original photos are shared as they are, including any information stored in the photo file, such as the date it was taken, camera details and location.
• Who can see it: anyone with the link can preview the folder names, file names, photo count and reduced thumbnails (thumbnails have their stored information removed). Importing the original photos requires Hyde Pro.
• Encryption: shared copies are encrypted in transit and while stored on our server, but they are not end-to-end encrypted, because automated safety checks need to read them.
• Safety checks: a collection becomes available only after its files pass automated checks by third-party services: Thorn Safer for known child sexual abuse material, Sightengine for explicit or violent content, and Cloudmersive for malware. We do not manually review your files. Collections that fail stay blocked, and we report apparent child sexual abuse material to the authorities where the law requires. Anyone with the link can report a collection, and reported collections can be blocked automatically.
• How long it is kept: a collection expires after 14 days, or sooner if you revoke the link in the app. Access stops immediately, and our cleanup process then deletes the stored files.
• Verifying your subscription: to confirm Hyde Pro and limit the number of active collections, the app sends your anonymous subscription ID, a signed App Store transaction, and a random credential created on your device. We store only a scrambled (hashed) version of that credential.
• Recipients: when someone opens or imports a collection, the app records anonymous events (for example "preview opened" or "import completed") with a random identifier and no file names. These events are deleted after 30 days. Reporting a collection uses a session cookie so the same person can't report it twice.
• Hosting: the collections service runs with a third-party hosting provider, which processes requests, including IP addresses, to deliver the service.

Camera information feed and private browser

• When the camera's information feed is shown, the app downloads public information: sports scores from ESPN, lottery results from Singapore Pools, news from Global Voices and fund holdings from iShares. These requests carry no cookies or personal information, but, as with any website, these providers can see your IP address.
• Websites you visit in Hyde's private browser, and Google as the default search engine, receive your requests and IP address as they would in any browser. Hyde doesn't keep cookies or website data after you close the browser, and we never see what you browse.

3. How We Use Information

• To understand which features are used and improve them
• To find and fix crashes and bugs
• To verify subscriptions and provide Hyde Pro features
• To run shared collections and keep them safe
• To meet legal obligations

Where data protection laws such as the GDPR apply, we rely on our legitimate interest in running and improving the app (for analytics and diagnostics), on providing the service you requested (for subscriptions and shared collections), and on legal obligations (for safety reports).

4. What We Don't Do

• We don't show ads or include advertising SDKs.
• We don't sell your personal information or share it with data brokers.
• We don't track you across other companies' apps or websites.
• We never access the contents of your vault.

5. Who We Share Information With

We share information only with service providers that help us run Hyde, as described above: Apple, RevenueCat, PostHog, our collections hosting provider, and the safety-check providers named above. We may also disclose information when the law requires it.

6. How Long We Keep Information

• Shared collections: up to 14 days, or until you revoke the link.
• Collection open and import events: 30 days.
• Analytics and diagnostics: only as long as they are useful for improving the app and fixing problems, after which they are deleted.
• Subscription records: kept by Apple and RevenueCat as long as needed to provide your subscription and meet accounting obligations.

7. Your Choices and Rights

• If you don't use shared collections, none of your photos are uploaded.
• You can revoke a shared link at any time in the app.
• Deleting the app deletes your vault from the device and stops the app from sending any data.
• Depending on where you live, you may have the right to access, correct or delete your information, to object to or limit how it is used, and to complain to your data protection authority. To make a request, email us. We don't collect your name or email in the app, so we may need details from you to find the data linked to your app.

8. Security

Your vault is encrypted on your device, and the app uses encrypted connections for everything it sends. No method of storage or transmission is completely secure, but we design Hyde so that your vault content is never available to us.

9. International Transfers

Our service providers, including PostHog and RevenueCat, process data in the United States and may process it in other countries. Where required, they use appropriate safeguards for these transfers.

10. Children's Privacy

Hyde is not directed to children under 13, or the minimum age required where they live. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

11. This Website

This website doesn't use cookies or analytics. Our web host may log standard request information, such as IP addresses, to deliver and protect the site.

12. Changes to This Policy

When we change this policy, we'll update this page and the date at the top. For significant changes, we'll also let you know inside the app.

13. Contact