Privacy Policy

1. Scope

This Privacy Notice describes how we collect, use, and safeguard personal data when you interact with our services. It applies when you:

• Create or use a HashThat account or access the App via web, desktop, mobile, or browser extension;
• Use features such as the Password Manager, password import tools, Shared Vaults and Password Sharing, File Sharing and Secure Links, the Link Shortener, link analytics, Notes, account recovery, device controls, two-factor authentication, or push notifications;
• Purchase, activate, renew, cancel, or restore a Free Trial, Pro Bundle, or Subscription through web checkout or in-app billing;
• Visit our websites or communicate with us, including contacting support.

Capitalised terms used in this Privacy Notice have the meanings given to them in the HashThat Terms and Conditions.

2. What is “Personal Data”?

“Personal data” means any information that identifies you, or can reasonably be used to identify you, directly or indirectly (e.g., name, email address, identifiers, IP addresses, or support messages).

We do not intentionally collect sensitive categories of data (e.g., health, biometric, or political opinions). If you upload or store such data, you must ensure you have a lawful basis. All customer content is treated as confidential.

3. How We Collect Personal Data

We collect personal data directly from you, automatically through your use of our services, and from certain third parties, depending on your interactions with the App and related services. Specifically, we collect data when you:

• Create or register a HashThat account, or update your Account Settings;
• Use the App and its features (e.g., Password Manager, Secure Sharing, Link Shortener, Link Analytics, Notes, imports, device controls, 2FA, and recovery tools), to the extent necessary to deliver core functionality (see Section 4);
• Purchase, activate, renew, cancel, or restore a subscription, Free Trial, or Pro Bundle;
• Contact us for support, submit feedback, or communicate via other channels;
• Register a device, enable push notifications, or interact with a notification;
• Trigger automatic diagnostic or security-related events (e.g., sign-in activity, token issuance, IP logs, device verification, 2FA events, abuse prevention systems);
• Visit our websites or interfaces, which may use cookies or software development kits (SDKs) for essential functions and optional analytics (see Section 7).

We do not monitor or access the content of your vault entries, shared passwords, encrypted Notes, or uploaded files. Where client-side encryption is used, we have no ability to decrypt your data. Encryption keys are generated on your device and encrypted using your Master Password and, if enabled, your Secret Key. These keys are never transmitted to our servers in a form that would allow us to access your encrypted content.

However, we may collect non-content metadata—such as the number of vault items, notes, links, storage usage, subscription entitlements, device status, or feature usage frequency—to manage account limits, ensure fair use, provide security features, and determine eligibility for subscription tiers. This metadata does not include or reveal the contents of your encrypted data.

4. Categories of Data & Purposes

We collect and process various categories of personal data depending on your interaction with our services and subscription level. The tables below describe the types of data we may collect, the purposes for processing, and the applicable legal bases under relevant data protection laws (such as the GDPR and UK GDPR).

Some data is only collected when using certain features, such as those available under a Pro subscription. Where applicable, this is noted in the relevant section. Optional features that rely on your consent (e.g., marketing, optional cookies, or push notification permission) are always clearly marked, and you may withdraw your consent at any time.

We do not use personal data for automated decision-making or profiling beyond what is necessary to provide the core service securely and efficiently.

4.1 Account & Subscription

4.2 Authentication & Security

4.3 Password Manager (Vault)

4.4 Shared Vaults & Password Sharing

4.5 File Sharing & Secure Links

4.6 Link Shortener & Analytics

4.7 Notes

4.8 Device & Push Notifications

4.9 Support & Communications

5. Legal Bases for Processing (Summary)

We process your personal data based on the following legal grounds, as permitted under the GDPR and UK GDPR:

• Contract Performance: To provide and manage access to the App and associated subscription services, including account features, encrypted storage, sharing, links, Notes, billing entitlement checks, and support.
• Legitimate Interests: For purposes such as ensuring the security and integrity of our services, preventing fraud, improving performance, maintaining logs and metrics, providing analytics requested by link owners, and defending legal claims. We ensure that our interests do not override your rights and freedoms.
• Legal Obligations: To comply with applicable laws and regulations, including tax and accounting obligations, responding to lawful requests, and breach notification requirements.
• Consent: For the use of non-essential cookies, direct marketing communications, and push notifications where required. You may withdraw consent at any time.

6. Storage, Service Providers & Transfers

We utilize a combination of in-house infrastructure and carefully selected third-party service providers, including AWS S3, Backblaze B2, and self-hosted MinIO. Web payment processing is handled by Stripe, Inc. In-app purchase entitlement management may be handled through RevenueCat, with payment and subscription processing performed by Apple App Store or Google Play where applicable. We may also use platform push notification services and other service providers needed to deliver, secure, monitor, and support the App.

• Data Residency: Personal data is primarily stored within the European Economic Area (EEA). Where data is transferred outside the EEA, such transfers are safeguarded by Standard Contractual Clauses (SCCs) and supplementary measures as required by applicable data protection laws.
• Transparency: We maintain an up-to-date list of our subprocessors and will notify you of any material changes in accordance with our obligations.
• Encryption: All personal data is encrypted both in transit and at rest. Vault data, encrypted Notes, and client-side files benefit from client-side encryption for enhanced security where supported by the relevant feature.

7. Cookies & Tracking

The app (available via browser on app.hashthat.app, mobile and desktop) relies on essential functional cookies, local storage, device storage, and similar technologies to ensure it operates securely and functions correctly.

On our marketing / secondary websites, we also use necessary functional cookies. We may also use marketing and analytics cookies to enhance your experience – your consent is required for these. See our Cookie Policy for complete information.

On mobile, the App may also use platform permissions and SDKs for purchases, push notifications, device information, and secure local preferences. You can manage operating-system permissions through your device settings.

8. Data Retention

We retain your personal data exclusively for the period which is lawfully permissible to retain your personal data. Thereafter, your personal data shall be immediately and irrevocably destroyed.

In view of Our contractual relationship with you, We typically retain your personal data for up to five (5) years from the end of Our contractual relationship on the basis of Our legitimate interests to protect ourselves in civil cases which you might institute against Us in relation to Our contractual relationship.

Payment information such as invoices, receipts, purchase records, entitlement records, and transactional documentation and information, may be kept by Us or the applicable Billing Provider for up to ten (10) years from the completion of the relevant transaction, on the basis of legal obligations imposed on Us or the Billing Provider to retain such information.

Encrypted customer content, including vault data, Notes, files, links, and related metadata, is generally retained while your Account is active and then deleted or anonymised in accordance with the Terms, technical backup cycles, and applicable legal obligations. Security, diagnostic, notification, and abuse-prevention logs are retained only for as long as needed for the purposes described in this Notice, unless a longer period is required for legal, tax, accounting, fraud-prevention, or dispute purposes.

We may also have a legitimate interest to retain your data for longer periods such as when your personal data is required for exercising or defending legal claims.

9. Your Rights

9.1 EEA/UK

You have several rights under applicable data protection laws, particularly the General Data Protection Regulation (GDPR), in relation to the personal data we process about you:

• Right of Access – You have the right to obtain confirmation as to whether or not we are processing personal data concerning you, and, if so, to request access to such data and receive a copy thereof.
• Right to Rectification – You have the right to request the rectification of inaccurate personal data concerning you and to have incomplete personal data completed.
• Right to Erasure ("Right to be Forgotten") – In certain circumstances, you have the right to request the erasure of your personal data, such as where the data are no longer necessary for the purposes for which they were collected or otherwise processed.
• Right to Data Portability – Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, and to request that we transmit those data directly to another controller, where technically feasible.
• Right to Object – You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data where such processing is based on our legitimate interests or those of a third party. In such cases, we shall cease processing your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.
• Right to Restriction of Processing – You have the right to request the restriction of processing in specific circumstances, such as when you contest the accuracy of the data or object to processing.
• Right to Withdraw Consent – Where we rely on your consent for processing, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint – If you have concerns about how your personal data are being processed, you have the right to lodge a complaint with us using the contact details provided below. You also have the right to file a complaint with the Information and Data Protection Commissioner in Malta, available at idpc.org.mt.

To exercise any of these rights, please contact us at: support@hashthat.app. Please note: We may require verification of your identity. Technical limitations may apply to encrypted content.

9.2 Your U.S. State Privacy Rights

If you are a resident of certain U.S. states (including, but not limited to, California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, and Tennessee), you may have the following rights under applicable state privacy laws:

• Right to Know/Access – You have the right to request access to the categories and specific pieces of personal information we have collected about you.
• Right to Correct – You may request the correction of inaccurate personal information.
• Right to Data Portability – You may request that we provide your personal data in a portable and readily usable format.
• Right to Opt-Out of Sale or Sharing – You may opt out of the sale or sharing of your personal information, where applicable.
• Right to Limit Use of Sensitive Personal Information (California residents only) – You may request that we limit the use or disclosure of your sensitive personal information.
• Right to Non-Discrimination – You will not be discriminated against for exercising your privacy rights.
• Right to Appeal – If we deny your request (where applicable), you have the right to appeal our decision. To do so, please respond to our decision email with “Privacy Appeal” in the subject line.

To exercise any of these rights, please contact us at: support@hashthat.app. Please note: We may require verification of your identity. Technical limitations may apply to encrypted content.

10. Children's Privacy

Our services are not directed to, and we do not knowingly collect personal data from, children under the age of 16. If you are under 16, please do not provide any personal data through our website or services.

If we become aware that we have inadvertently collected personal data from a child under the applicable age threshold without verifiable parental consent, we will take steps to delete such data as soon as possible.

If you believe that we may have collected personal data from a child, please contact us immediately at support@hashthat.app.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, misuse, loss, or destruction.

Our safeguards include encryption (in transit and at rest), access controls, authentication mechanisms, and ongoing monitoring. Where applicable, additional layers such as client-side encryption, device verification, secure local storage, recovery controls, push-notification security controls, and two-factor authentication are also used.

Although no system is entirely secure, we are committed to maintaining a high level of data security and will notify you of any data breaches in accordance with applicable laws.

12. Disclosures & Corporate Events

We do not sell your personal data.

We may share your data only in the following circumstances, and always subject to appropriate confidentiality and security safeguards:

• Personnel and Contractors – With employees and independent contractors who require access to perform their duties, subject to confidentiality obligations.
• Service Providers and Subprocessors – With trusted third parties who provide services on our behalf, such as hosting, storage, payment processing, in-app purchase entitlement management, app-store billing, push notification delivery, analytics, security monitoring, and infrastructure support.
• Legal and Regulatory Authorities – Where required to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
• Corporate Transactions – In connection with a merger, acquisition, financing, or sale of assets, where personal data may be transferred to a successor entity, provided appropriate protections are maintained.

We ensure that any third parties accessing your personal data do so in compliance with applicable data protection laws and only for specified, legitimate purposes.

13. Contact Details

If you have any questions, requests, or concerns regarding this Privacy Policy or the way we handle your personal data, you may contact us via email on: support@hashthat.app

14. Updates

We may update this Notice to reflect changes in processing or law. We will notify you before material changes and seek consent if required.