Privacy Policy

Last updated: August 19, 2026

This policy is divided into two parts: Part A describes what happens when you visit this website (hiy.ch). Part B describes how the future HIY app handles data — HIY has not yet been released; this part describes the architecture as it has been built and tested.

Part A — This Website (hiy.ch)

No Active Data Collection via Forms

The download button on this website links directly to HIY's official app page on Google Play — an external link governed by Google's own privacy policy. This website itself does not collect any email addresses or other contact data through that click. The earlier internal Android tester list is no longer maintained now that the app is publicly available on the Play Store.

Language Setting (localStorage)

Your selected language (DE/EN/FR/IT/ES) is stored in your browser's localStorage — purely locally on your device, not as a cookie, and never transmitted to a server. It serves solely to show you the last selected language on a repeat visit. You can delete this setting at any time via your browser settings.

Fonts

The fonts used on this page (Plus Jakarta Sans, Space Grotesk, JetBrains Mono) are served from our own server, not loaded from Google or any other third party. No data is transmitted to third parties in the process.

Help Chat

The help chat in the bottom right runs entirely locally in your browser (simple text matching against a fixed list of questions and answers). Your input is not transmitted to any server.

Server Logs

As with practically every web server, accessing this page causes technically standard access data (IP address, timestamp, page accessed, browser type) to be briefly processed in the server logs of our hosting infrastructure (Switzerland). This is technically necessary for the secure operation of the website and is not combined with any other data. An automated, purely rule-based security system (CrowdSec) additionally evaluates these access logs to recognize known attack patterns and automatically block the corresponding IP address if necessary — without AI-based profiling, solely to protect against abuse.

No Cookies, No Tracking

This website does not use analytics or tracking cookies, advertising cookies, or services such as Google Analytics or the Meta Pixel.

Part B — The HIY App (Once Available)

The following points describe how the app is currently technically built. Where a feature is not yet complete, this is expressly noted — this policy is intended to reflect the actual state at any given time, not the planned one.

Sign-In

Sign-in takes place via ortino.AUTH (OAuth2 with PKCE). Name, profile picture, and email verification status originate from there; HIY does not maintain its own password. The privacy policy of ortino.AUTH additionally applies.

Hardware Signature and Keys

When you create your identity, your device generates a cryptographic key pair in the Android Keystore (where available: in the StrongBox hardware chip). The private key never leaves your device. Every post, comment, and report is signed with it (ECDSA).

Single-Device Mode (optional)

If you enable single-device mode in settings, signing in on a new device automatically ends the session on the previously used device. No additional data about you is stored for this — the check uses the device identifier already tied to your active ortino.AUTH session.

Friends Backup (Backup PIN)

Optionally, you can back up your friends list, encrypted, at the relay, to restore it after losing a device. The key for this is derived exclusively from a PIN you choose (PBKDF2-HMAC-SHA256, 600,000 rounds) — the PIN itself never leaves your device and is not known to us. Without the PIN, the backed-up list is unreadable, to us included.

Local Storage

Your data (posts, contacts, settings) is stored locally on your device in a database encrypted with SQLCipher (AES-256). The key for this is itself additionally encrypted, hardware-bound, in the Android Keystore.

Transmission to Other Devices

Depending on the audience selected for a post:

• "Local" — the post leaves your device only via a direct connection within the same local network (Wi-Fi) and never reaches the internet or a server.
• "Friends" and "Everyone" — the post is additionally forwarded via relay servers (operated on Infomaniak infrastructure, Switzerland) so that it also reaches recipients who are not reachable online at the same time. Relay servers only temporarily cache posts until delivery, or until the chosen reach budget is exhausted.
• "Only me" — the post never leaves your device.

Content with "Friends only" visibility receives its own device-bound encryption key, separate from the signature key, so that no one other than the recipients can read it — not even a relay operator. This end-to-end encryption is implemented and active (X25519 key exchange + AES-256-GCM, implemented identically on Android and iOS).

Relay Access Data

When receiving posts and requests, the relay servers also briefly process the requesting device's IP address — solely to prevent abuse (e.g. overload attacks). This data is held only in memory, automatically deleted every hour, and is never linked to post content or stored permanently.

Direct Messages

Private 1:1 messages are end-to-end encrypted (X25519 + AES-256-GCM) just like "Friends only" posts — the relay operator only sees ciphertext, never the content. Whether a message was delivered and read is stored only locally on the devices involved.

For instant delivery we use push notifications via Firebase Cloud Messaging (Google, Android) or Apple's own push service (iOS). The push notification itself only contains the sender's display name and a generic prompt ("Tap to view") — the actual message content is never transmitted via the push service. The privacy policies of Google or Apple additionally apply to their respective push service.

Photos

Images are automatically recompressed before sharing. In this process, EXIF metadata such as GPS location and camera model is completely removed — a deliberately verified process, not a coincidence.

Local Content Check (Nudity/Violence)

Before an image is shared, a purely local model checks it for nudity and graphic violence — using Apple's own SensitiveContentAnalysis on iOS, and a bundled on-device model on Android. No image ever leaves your device for this, not even to us.

On-Device AI Shield

Detection of AI-generated content and suspicious bot behavior runs exclusively locally on the recipient's device. No content is transmitted to a server for this purpose.

Reports and Moderation

If you report a post, this report is signed like a post and — weighted by trust according to the rules described on hiy.ch — distributed via the mesh or the relay servers so that other devices can calculate the visibility threshold. No central database of all reports is created on our end.

HIY+ and Payment Data

Purchases of HIY+ are processed entirely through Apple or Google. We do not receive any payment or credit card data in this process — only a technical confirmation that a valid subscription exists. The privacy policies of Apple or Google additionally apply.

Your Rights

Regardless of whether you are resident in Switzerland or the EU, you have, in particular, the following rights: access to data concerning you, correction of inaccurate data, deletion, restriction of processing, objection, and — to the extent technically applicable — data portability. Since app data resides primarily locally on your device, you can exercise most of these rights directly within the app (e.g., deleting your account and local data).

For inquiries, please contact info@hiy.ch. You also have the right to lodge a complaint with the competent supervisory authority — in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the data protection authority of your country of residence.

Changes to This Policy

We will update this policy as soon as actual data processing changes — for example, when the sign-up function on the website is activated or the app launches. The date above shows the last update.

The German version of this policy is the authoritative, legally binding version. Translations into other languages are provided for convenience; in the event of any discrepancy, the German text shall prevail.