Hash VaultPrivate. Always.

Version 2026-10-13

Privacy notice

Hash Vault is a private vault run by Hashkrio Tech LLP. This notice explains what we store, why, who else may see it, how long we keep it, and the rights you have. We wrote it to be read, not skimmed past.

What we store and why

  • Your account: name, email, password hash, time zone, currency and language. Needed to run your account (contract).
  • What you put in the vault: notes, credentials, contacts, income and expenses, calendar, files, family, health, finance and business records, custom menus. Stored only to give them back to you (contract). Health and children's records are sensitive: we never use them for anything else, and their sections stay locked until you confirm it's you.
  • Security information: sign-in history, devices, IP addresses and the activity log you see in Settings. Needed to protect your account (legitimate interest and legal obligation).
  • From your phone, in the Hash Vault app, only when you use the feature: your phone's contacts (names, phone numbers, email addresses and companies) when you choose “Import all phone contacts”; the microphone when you dictate or record a voice note; the camera or photo library when you add a photo, video or file; your location when you tap the location button in a diary entry. Each is asked for by your phone first, and what you add is stored in your vault like anything else (contract). Face ID or fingerprint unlock stays on your phone: we never receive your face or fingerprint.
  • Optional features: push notification subscriptions, passkeys, two-step verification and contact profile lookup are used only if you turn them on (consent), and you can turn them off at any time.

We do not sell personal data, show advertising, or use your vault to train AI models.

How it is protected

  • Each person's data is kept separate; no one else can see it unless you share a menu with them.
  • Passwords in Credentials, private journal entries, diagnoses, medicines and notes in Medical and Finance, policy and account numbers and every file in Private Drive are encrypted by the app (AES-256-GCM) on top of storage encryption.
  • Credentials, Medical, Finance and Daily Notes, and any diary entry you mark private, stay locked until you confirm it's you with your password, PIN or passkey.
  • Platform staff cannot open your vault. If support needs to look into a problem, they must ask you first, see only what you allow, for a limited time, and every view is shown in your activity log.

Who else may receive data

  • Hosting and database: Everything you store, encrypted at rest; sensitive fields are encrypted again by the app.
  • Email delivery (SMTP provider, when configured): Your email address and account emails (password reset, confirmation, security notices).
  • Web push services (Google, Apple, Mozilla): Short notification text, only if you turn on push for a device.
  • Gravatar, GitHub and the contact's company website: A contact's email address (Gravatar: hashed) or company name, only when profile lookup is on.
  • Web search provider (SearXNG, Serper or Brave, when configured): A contact's email, phone or name and company, only when profile lookup is on.
  • Currency rates (frankfurter.dev): No personal data: only the list of currencies.
  • AI provider shown in Settings → AI (when set up): Only after you turn on AI features: short extracts of the items a question matches, photos or scans you ask it to read, and voice clips for voice typing. Credentials, journal entries and protected sections are never sent.
  • WhatsApp Business by Meta (when set up): Your mobile number and a one-time code, only when you add a number to confirm.

When data is processed outside your country, we rely on the safeguards the law requires (for the EU/UK, standard contractual clauses).

How long we keep it

  • Your vault (notes, credentials, contacts, money, calendar, files, records): Until you delete it, or 30 days after you ask us to delete your account.
  • Items in Trash: Until you empty Trash or restore them.
  • Notifications: 180 days.
  • Sign-in tokens and email links: Up to 30 minutes (reset), 24 hours (confirmation); records removed a day after expiry.
  • Email delivery log (no email contents): 180 days.
  • Security activity (audit log): For the life of the account, so you can review sign-ins and changes.
  • Backups: 14 most recent daily backups, encrypted.

Your rights

  • See and take a copy: Settings → Your data → Export everything.
  • Correct: edit any item, or your profile in Settings.
  • Delete: delete items at any time, or your whole account from Settings → Your data. It is removed for good after 30 days.
  • Withdraw consent: turn off push, profile lookup, passkeys or two-step verification in Settings; this doesn't affect anything done before.
  • Nominate someone to act for you after your death (DPDP s. 14): Settings → Legacy. They get access only after the waiting time you choose, and you can decline their request in the meantime. To name someone for when you can't act, contact us below.
  • Object or restrict how your information is used: contact us below.
  • UK and California: the same rights apply under the UK GDPR and the CCPA/CPRA. We don't sell your personal information or share it for advertising.

Children

Accounts are for adults. Parents may store information about their own children for the family's use; that information is private to the parent's account and is never used to profile or target children.

Breaches

If a breach could affect you, we will tell you and the authorities without undue delay, as the law requires (GDPR: within 72 hours of becoming aware).

Contact and complaints

Use the contact details on hashkrio.com. We answer within 30 days. If you are not satisfied, you can complain to your data protection authority (in India, the Data Protection Board of India; in the EU/UK, your national supervisory authority).