Privacy Policy
In short: the files you hide never leave your phone. They are encrypted on the device, and we (Frank Apps) have no servers that receive them, your PIN, your optional recovery code or your intruder photos. The free version shows ads from Google AdMob, which uses your device’s advertising ID. We use Firebase Remote Config to tell the app whether an update is required, and Firebase Crashlytics to receive crash reports (with file names and paths removed). Buying “Remove ads” is handled by Google Play.
1. Who we are
Hideaway (“the app”) is developed by Frank Apps (“we”, “us”). If you have a question about this policy or your data, contact us at duytranhoang88@gmail.com.
2. Data that stays on your device
The app’s core features work entirely on your phone. None of the following is sent to us or to any third party:
- Files you hide. They are moved into an encrypted vault folder in your phone’s shared storage
(
.Hideaway) and encrypted with keys kept on the device. File names, folders, sizes and dates are encrypted too. - App PIN and decoy PIN. Stored only as a salted verifier, encrypted with a key from your phone’s Android Keystore. So that you can reopen your vault with the same PIN after reinstalling the app, the vault folder also keeps a copy of the vault key encrypted with a key derived from your PIN (PBKDF2-HMAC-SHA256). The decoy PIN never opens the vault. We can’t see or recover your PIN.
- Recovery code (optional). You can create one in Settings to reset a forgotten PIN. It is shown to you once and never stored by the app in readable form or sent anywhere. Without a PIN or a recovery code, nobody, including us, can open the vault.
- Fingerprint or face unlock. Handled by Android. The app only receives a success or failure result and never gets your biometric data.
- Intruder log and intruder photos (optional, off by default). If you turn this on, the front camera may take a photo after repeated wrong PINs. Photos and the log are encrypted in the app’s private storage, never added to your gallery and never uploaded. The log keeps at most 50 entries.
- Backups you create. A backup file contains the encrypted list of hidden items (never file contents). It is saved only where you choose, using Android’s file picker.
- Settings such as theme, language and lock options.
3. Permissions
- All files access (
MANAGE_EXTERNAL_STORAGE, Android 11 and later) or storage access (READ/WRITE_EXTERNAL_STORAGE, Android 8–10): needed to move the files you choose into the vault and back to their original location, and to keep the vault safe if the app is uninstalled. The app only acts on files you select or have already hidden. - Camera (optional): only for intruder photos, and only if you turn that feature on.
- Internet: used only by the Google services described in section 4. Your files are never uploaded.
4. Third-party services
The app uses the following Google services. They collect some device data under their own privacy policies.
| Service | Purpose | Data involved |
|---|---|---|
| Google AdMob (Google Mobile Ads SDK) |
Shows ads in the free version | Advertising ID, IP address (which may indicate approximate location), device and app information, ad interactions, diagnostics |
| Google User Messaging Platform | Asks for and stores your ad consent where the law requires it (for example EEA, UK, Switzerland and some US states) | Your consent choices, device information |
| Firebase Remote Config | Tells the app whether an update is required or recommended | Firebase installation ID, app version, device and OS information |
| Firebase Crashlytics | Reports app crashes so we can fix them | Crash stack trace, Firebase installation ID, app version, device model, OS version, free memory and storage, crash time. File names and paths are removed from crash messages before they are sent. |
| Google Play Billing | Processes the optional one-time “Remove ads” purchase | Purchase details, processed by Google Play. We never receive your payment information. The app only stores whether ads are removed. |
| Google Play in-app updates | Downloads and installs app updates | Handled by the Google Play Store app |
Google AdMob may work with third-party ad partners (for example ad networks and bidders) that receive the ad data above to show and measure ads. Where consent is required, the full list of partners is shown in the consent message, and they only process your data as you choose there. Google’s list of commonly used ad partners is at support.google.com/admob/answer/9012903.
We do not use Firebase Analytics or any other analytics service. Crash reports never include your files, their names or their contents, and we send no information about your files to the ad network. You can read how Google uses data at policies.google.com/technologies/partner-sites and the Google Privacy Policy.
5. Your choices
- Ad consent: where it applies, you can change your choice anytime in the app under Settings › Privacy › Privacy choices.
- US state privacy rights: if you live in a US state with a consumer privacy law (such as California, Virginia or Colorado), sharing your data with ad partners for targeted ads may count as “selling” or “sharing” under that law. You can opt out at any time in Settings › Privacy › Privacy choices (“Do not sell or share my personal information”). You may also contact us to ask about your data; because we keep no copy of it, there is nothing for us to access or delete.
- Personalized ads: you can reset or delete your advertising ID, or opt out of ads personalization, in your phone’s settings (Settings › Google › Ads, or Settings › Privacy › Ads on some phones).
- No ads: buying “Remove ads” turns ads off on every device with the same Google account. After that, the ads SDK is not started.
- Delete your data: unhide your files, then uninstall the app. You can also delete the
.Hideawayfolder in your phone’s storage. Because we hold no copy of your data, there is nothing to delete on our side.
6. Data sharing and sale
We don’t sell your personal information, and we don’t share your files or vault data with anyone. The only data shared is what the Google services in section 4, and the ad partners Google AdMob works with, collect to provide ads, consent, configuration, purchases and updates.
7. Security
Hidden files are encrypted with authenticated encryption (AES-256-GCM via Google Tink), and device keys are protected by the Android Keystore. Because the vault can be reopened with your PIN after a reinstall, someone who copies the vault folder could try every possible PIN; a longer PIN (6 digits) makes this much slower. No method of storage is completely secure. Keep your PIN and recovery code private, and keep your phone’s software up to date.
8. Children
The app is not directed at children under 13 (or the minimum age in your country), and we do not knowingly collect personal information from children.
9. Changes to this policy
We may update this policy when the app changes. We will post the new version on this page and update the date at the top.
10. Contact
Frank Apps · duytranhoang88@gmail.com