Privacy Policy
- Your photos, videos, files, file names and WhatsApp chats are encrypted on your phone before they reach us. We cannot open them, and nobody we work with can.
- We keep the little we need to run your account: your email address, your devices, how much space you use, and security records.
- We do not sell your data, show ads, or put tracking or analytics code in the app.
- You can delete your account in the app at any time. Your stored files are deleted with it.
1. Who we are
HakoDrive is operated by [Company legal name], [registered address] ("HakoDrive", "we", "us"). For anything about your privacy, email [email protected].
2. The waitlist and this website
When you join the waitlist we collect:
- Your email address, to tell you when HakoDrive is ready and about your place on the list.
- Your country and phone type (iPhone or Android), if you choose them, to plan launches and prices.
- Which version of the page and which ad or link brought you (for example "utm_source=meta"), to learn which messages work.
- Your answers to the optional questions on the waiting page.
- A one way, salted fingerprint of your network address, used only to stop spam and to count referrals fairly. We do not store the address itself.
To check that a person, not a bot, is joining, the form uses Cloudflare Turnstile. Turnstile looks at signals from your browser and network address to make that check. Cloudflare's own privacy policy applies to that check.
This website does not use advertising trackers or analytics cookies. It remembers your light or dark choice and your waitlist code in your own browser only.
We keep waitlist details until 12 months after HakoDrive launches in your country, or until you ask us to delete them, whichever is first. Every email we send has a way to stop further emails.
3. The HakoDrive app
What we can never read
Your files, photos and videos, their names and thumbnails, folder names, your WhatsApp chats, your favourites and your search are encrypted on your device with keys only you hold. The encryption uses AES-256-GCM, and your password is turned into a key on your device with Argon2id. Your password is never sent to us: sign in uses a method (SRP) that proves you know it without sending it.
Because of this, we cannot see what you store, cannot hand it to anyone in readable form, and cannot recover it if you lose both your password and your recovery words.
What we do keep
| Data | Why | How long |
|---|---|---|
| Email address | Sign in codes, account and security messages | Until you delete your account |
| Encrypted files and their sizes, number of versions, upload times | To store your files and count your space | Until you delete them; Trash keeps deleted items 15 days |
| Device names and types, when each was approved and last used | To let you see and remove your devices | Until you remove the device or delete your account |
| Sign in sessions, including network address and app or browser details | To keep you signed in and spot misuse | Until the session ends or expires |
| Security records (for example "device approved"), with a salted fingerprint of the network address | To protect your account and investigate misuse | [12 months] |
| Who you share with, and link settings (expiry, password on or off, download count) | To make sharing work | Until you stop sharing |
| Reports about shared links or folders | To act on abuse. A report never gives us access to the content | [24 months] |
| Subscription status (when plans launch) | To give you your storage | While you have an account. Card details stay with Apple or Google |
On your phone only
Some things never leave your device: your Photos library list used for backup, the record of what was freed from your iPhone, your light or dark choice, and which sender is "you" in a saved chat. If you choose to save your recovery words in iCloud Keychain, they are stored by Apple in your iCloud account, not by us.
Photos access
With your permission, HakoDrive reads your Photos library to back it up and, when you ask, removes backed up items. Each item is encrypted before upload. iOS always asks you before anything is removed.
4. What we do not do
- We do not sell or rent personal data.
- We do not show ads in the app or use your data for advertising.
- We do not include analytics or tracking code in the app.
- We do not use your content to train AI. We cannot read it.
5. Companies that help us
- Cloudflare: website hosting, the waitlist database, Turnstile, and storage of your encrypted files.
- [Email provider]: sending sign in codes and waitlist emails.
- Apple: the App Store, payments for plans, and iCloud Keychain if you choose to use it.
They process data only to provide their service to us. Your encrypted files may be stored in data centres outside your country. Because they are encrypted on your device, the storage provider cannot read them either.
6. Your choices and rights
- See and download your files at any time in the app.
- Delete files (they go to Trash for 15 days) or your whole account in Settings › Delete account. Your stored files are deleted at once, and any copies in our backups within [30 days].
- Ask for a copy of the account data we hold, a correction, or deletion of waitlist details by emailing [email protected]. We reply within 30 days.
- You can complain to your local data protection authority, for example the Privacy Commissioner for Personal Data in Hong Kong or the National Privacy Commission in the Philippines.
7. Security
Encryption happens on your device, connections use HTTPS, and new devices must be approved by one you already use or opened with your password or recovery words. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.
8. Children
HakoDrive is not meant for children under 13, or under the minimum age for online services in your country. If you think a child has given us their details, email us and we will delete them.
9. Changes
If we change this policy in a way that matters, we will tell you in the app or by email before the change applies. The date at the top shows the latest version.
10. Contact
[email protected] · [Company legal name], [registered address]