Privacy Policy

1. Summary

HostSpica Identity is designed to collect nothing. It has no account system, no analytics, no advertising SDK, and no server of any kind. The app cannot make a network request even if it wanted to, because its Android manifest does not declare the INTERNET permission. This policy explains what that means for each part of the app: Authenticator, Passkey, AirAuth and Vault.

2. Data we collect

None. Specifically:

• • No account or sign-up, so no name, email or identity is ever collected.
• • No analytics, crash reporting or advertising SDKs are included in the app.
• • No usage data, device identifiers or diagnostics are sent anywhere.
• • No cookies (the app is not a website).

3. What's stored, and where

• • Authenticator: your 2FA account names and secrets are encrypted with an Android Keystore key and stored in a local database on your phone.
• • Passkey: passkey private keys are generated and held inside the Android Keystore (hardware-backed where the device supports it) and are non-exportable. Only metadata (which site a passkey is for, an account label, creation date) is stored in the local database.
• • AirAuth: a short local history of sign-in approvals you approved or denied (site name and time), kept on your phone only.
• • Vault: saved logins and secure notes are encrypted with a non-exportable Android Keystore key. Only the entry's title, username, site and favorite flag are kept as plain labels for search; passwords and notes stay encrypted.
• • Settings: theme, auto-lock and similar preferences, stored locally.
• • None of this is sent to HostSpica or anyone else. There is no HostSpica server for this app, so there is nothing to sync or back up remotely.

4. Autofill

If you turn on the HostSpica Vault Autofill service in Android Settings, the app reads the login form shown in another app or browser only to find the username and password fields and to match the app or site to a Vault entry. Each fill is protected by a fingerprint, face or screen-lock check. If you choose to save a new login, it is stored only in your on-device Vault. Form contents are not logged and are never transmitted.

5. Backups you create

You can export a password-protected backup file (Authenticator accounts and Vault). The file is encrypted on your phone with a key derived from the password you choose. You decide where it is saved and who gets it. We never receive it, and we cannot recover it or its password if you lose it.

6. Permissions the app requests, and why

• • Camera - only to scan QR codes on screen (adding a 2FA account, pairing a browser sign-in, approving a sign-in). The camera feed is processed on-device and is never recorded, stored or transmitted.
• • Bluetooth - only for the direct, single-use connection between this phone and a nearby browser to complete a passkey sign-in or sign-in approval. No relay server is involved.
• • Biometric / device credential - used to unlock the app and to approve sign-ins and passkey use. Biometric data is handled entirely by Android; the app never receives or stores it.
• • Autofill service and Credential Provider - optional system integrations you enable yourself in Android Settings.
• • Storage (Android 9 and below only) - to save an exported QR image.

The app does not request, and cannot be granted, network or internet access.

7. Screenshots and clipboard

The app blocks screenshots and screen recording of its own screens. Passwords copied from the Vault are marked as sensitive and cleared from the clipboard after 30 seconds.

8. Third-party sharing

There is nothing to share, because nothing is collected. HostSpica does not sell, rent or transmit any user data.

9. Children's privacy

This app does not knowingly collect information from anyone, including children, because it does not collect information from anyone.

10. Data deletion

Delete any entry inside the app, or uninstall the app to remove all of its data from your phone immediately. There is no server-side copy to delete.

11. Changes to this policy

If this app's data practices ever change, this page will be updated before that change ships.

12. Contact

Questions about this policy or the app: [email protected]