Privacy policy

Your tokens and recovery material

Token setup secrets, account labels, edit history, and unfinished drafts are stored locally using protected app storage and Keychain. Codes are generated on your device. HitoKey does not send your token secrets or recovery phrase to Hito. No Hito account is required.

Deleting a token can leave a recoverable entry in History. Use Clear History to remove those entries. Previously exported files and cloud backups are separate copies. Removing the app is not a reliable way to delete Keychain records or copies held elsewhere.

Optional backups

If you enable iCloud backup, HitoKey encrypts the token snapshot before uploading it to your private CloudKit storage. Its recovery key is stored in iCloud Keychain. Apple operates these services under its own terms and privacy policy. Recovery needs both the cloud copy and the key; Apple Account sign-in alone does not guarantee access.

Turning iCloud backup off stops future uploads but keeps the last cloud copy and recovery key. To remove cloud storage, use the storage controls Apple provides in iCloud settings; contact support if you need help locating them. Do not remove a backup until you have another recovery method.

Encrypted file exports go to the destination you choose. Recovery requires that file and the matching recovery phrase. You control retention and deletion of exported copies, including copies held by your selected storage provider.

Camera, photos, and Google Authenticator import

Camera permission is used to scan setup codes. Photos you select for import are processed on the device. Google Authenticator import uses an explicit, temporary iOS screen broadcast to recognize export QR codes on your device. HitoKey does not upload the broadcast or record audio. Temporary token data stays in device-only Keychain storage shared by HitoKey and its import extension. Their shared app folder holds import-session status, not token secrets.

Import sessions expire after five minutes; capture is time-limited. Temporary access is revoked and pending data is cleaned up on completion, cancellation, or when expiry is detected. Accounts are saved only after you review and confirm them.

Website icons and external links

HitoKey may request an icon directly from the website associated with a token. That website can receive your IP address and normal request information. Setup secrets, account names, and one-time codes are not included in icon requests. Icons are cached locally. Opening a website, privacy link, or support link uses your browser and the destination’s policies.

Optional usage counts

After setup, HitoKey asks once whether you want to share Detailed usage, Basic usage, or Don’t share. Sharing stays off until you choose; dismissing the prompt means Don’t share. You can change this under Usage sharing in Settings. Basic usage sends foreground and background events with the app version and build to stat.hito.ai. Detailed usage also sends events for copying and showing or hiding codes, search use, filter and sort choices, token changes, History, screen navigation, import choices, backup, and recovery. Extra event properties are predefined choices, such as Title/Recent, All/one service, and file/iCloud; they never identify the selected service. Collection begins on the next app visit. It does not include tokens, account names, service names, recovery information, advertising identifiers, search text, query lengths, result counts, clipboard contents, or error text. Event delivery is best effort. Collection also requires an enabled build.

Usage events go directly to our self-hosted Umami service at stat.hito.ai. The service receives your connection’s IP address and a fixed compatibility header, not your phone’s actual model or OS version. Umami may use network information to derive session identifiers and approximate location. This is not fully anonymous collection. We use these events to understand app activity and improve HitoKey, not for advertising or cross-company tracking. The app does not send an advertising ID or a persistent installation ID, and does not store Umami’s returned session identifiers.

There is currently no verified automatic retention limit for this self-hosted service. Records may remain until deleted; we do not promise automatic deletion after 90 days.

You can withdraw consent in Settings. This stops new collection and cancels pending requests; it cannot retract events already received. Consent stays on this device and is not restored from token backups. Previous Detailed users are asked again before the expanded feature events are collected; existing Basic and Don’t share choices remain unchanged. Collection remains inactive in builds that say so in Settings.

Authentication and analytics

iOS verifies device authentication for sensitive recovery and export actions. HitoKey does not receive Face ID or Touch ID biometric data. This app release has no advertising or third-party analytics SDK and does not access your contacts, call history, or location. Trusted Circle and account sign-in are unavailable in this release.

These privacy and support pages contain no analytics script. Hosting providers may process ordinary web request information to serve and secure the pages. Other Hito websites may have separate functionality.

Support and your choices

If you email support, we receive your email address and whatever you choose to include. The app’s email link pre-fills only its version and build. We use correspondence to answer your request and keep records needed for support, security, and applicable obligations. You can request access, correction, or deletion of your correspondence by emailing support@hito.ai.

Never send recovery words, setup secrets, QR codes, backup files, or one-time codes to support. Hito cannot reconstruct your secrets or recover your tokens without your recovery material.

We will update this page when app behavior or these practices change.