Privacy Policy

Last updated: October 2026

1. Introduction

This Privacy Policy explains how HideFile ("we," "us," or "our") collects, uses, and protects information when you use our website and service at hidefile.app.

We take privacy seriously—it's literally what our product is about. This policy is written to be readable, not just legally compliant.

2. What we don't collect

Let's start with what we don't have access to:

2.1 Your files

HideFile processes files entirely in your browser using WebAssembly. Your files are never uploaded to our servers. We cannot see, access, or recover:

• Files you lock
• Files you place inside cover files
• The contents of your cover files
• Any file you process through HideFile

2.2 Your passwords

Password processing happens locally on your device. We never receive your passwords. This means:

• We cannot recover lost passwords
• We cannot unlock your files
• We cannot help you if you forget your password

2.3 Unlocked content

Since unlocking happens in your browser, we never see the unlocked contents of your files.

3. What we do collect

3.1 Website analytics (PostHog)

We use PostHog (us.i.posthog.com) to count usage. Autocapture is turned off, so clicks and page contents are not recorded. This is exactly what is sent:

• Page views — the page address (URL path) and referrer URL
• Device and browser type, and screen size
• Approximate country, derived by PostHog from your IP address when the request arrives
• An anonymous random identifier stored in your browser (cookie or local storage), so we can count repeat visits
• Three usage events: locked_file_created, locked_file_opened and locked_file_saved. Each carries only the cover file type (png, jpeg, mp4 or pdf) and the platform (web or native)

We do NOT send to analytics:

• File names, file sizes, file counts or paths
• Passwords or keys
• File contents or cover file contents
• Error messages that could contain your data

You can block analytics with a content blocker such as uBlock Origin. The app works the same without it.

Optional cloud storage

If you connect your own cloud storage (an S3 or R2 bucket), the app sends your encrypted data directly from your device to that bucket. It goes to the bucket you configured, not to us.

3.2 Payment information

When you purchase HideFile Pro, payment is processed by Paddle.com Market Limited (our Merchant of Record).

Paddle collects:

• Name
• Email address
• Payment method details
• Billing address
• Transaction records

We receive from Paddle:

• Email address (to associate your license)
• Transaction ID
• License status (active/cancelled/refunded)

We do NOT receive:

• Full credit card numbers
• Bank account details
• Billing address

For details on how Paddle handles your payment data, see Paddle's Privacy Policy.

3.3 License verification

If you purchase Pro, HideFile may periodically verify your license status:

• License key/token — to confirm Pro status (occasionally, e.g., monthly)
• App version — to ensure compatibility (at verification)

This verification:

• Does not transmit your files or passwords
• Can be done manually by going online briefly
• Is separate from the analytics described in section 3.1

3.4 Support communications

If you contact us for support:

• Email address — to respond to you (retained until resolved + 1 year)
• Message content — to understand your issue (retained until resolved + 1 year)
• Attachments you send — to help troubleshoot (deleted after resolution)

We will never ask you to send us your locked files or passwords.

4. How we use your data

• Email (from Paddle) — Send license key, important updates, respond to support
• Analytics — Improve the website and product
• Error logs — Fix bugs and improve stability
• License tokens — Verify Pro status

We do NOT:

• Sell your data
• Share your data with advertisers
• Use your data for profiling
• Send marketing emails without consent

5. Third-party services

5.1 Paddle (payment processor)

Paddle processes all payments and acts as Merchant of Record. They are responsible for:

• Payment processing
• Subscription management
• Refunds
• Tax compliance

Paddle's Privacy Policy

5.2 Analytics provider

We use PostHog (PostHog Inc., US cloud) for the analytics listed in section 3.1. We do not use it for advertising or cross-site tracking.

6. Cookies

What cookies we use

• Session (if any) — Remember Pro license status (Functional)
• Analytics — PostHog anonymous identifier (cookie or local storage)

What cookies we don't use

• Advertising cookies
• Third-party tracking cookies
• Cross-site tracking

You can disable cookies in your browser settings. HideFile's core functionality works without cookies.

7. Data retention

• Your files — Never stored by us
• Your passwords — Never stored by us
• Payment records — Kept by Paddle per their policy
• License records — Duration of license + 2 years
• Support emails — 1 year after resolution
• Analytics — Held by PostHog under its retention settings; contains an anonymous identifier, not your name or email

8. Data security

8.1 Your files

Your files never leave your device, so they're protected by your own device security.

8.2 Our systems

For data we do handle (license records, support emails):

• Encrypted in transit (HTTPS/TLS)
• Encrypted at rest where applicable
• Access limited to necessary personnel
• Regular security reviews

8.3 Password security

Your password is turned into an encryption key on your device, through a deliberately slow process that keeps guessing expensive even on hardware built for guessing. That key never reaches our servers. See How HideFile protects you for exactly how this works.

9. Your rights

Depending on your jurisdiction (particularly under GDPR, CCPA, and similar laws), you may have the right to:

• Access — Email us to request data we hold about you
• Correction — Email us to correct inaccurate data
• Deletion — Email us to delete your data
• Portability — Email us for a copy of your data
• Objection — Block analytics with a content blocker; unsubscribe from emails
• Withdraw consent — Unsubscribe links in emails; browser settings for cookies

Important: We cannot provide access to your locked files or passwords because we don't have them.

To exercise your rights, contact: privacy@hidefile.app

We will respond within 30 days (or sooner if required by law).

10. Children's privacy

HideFile is not intended for children under 18 (or the age of majority in your jurisdiction). We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do:

• We'll update the "Last updated" date
• For significant changes, we may notify you by email (if we have it)
• We'll post the new policy on our website

Continued use of HideFile after changes constitutes acceptance of the updated policy.

12. Contact us

For privacy-related questions or to exercise your rights:

Email: privacy@hidefile.app

For payment-related inquiries:

Paddle Support: paddle.net

This Privacy Policy was written to be readable and honest. If something is unclear, please ask: privacy@hidefile.app