Privacy Policy — Hisn
1) Who we are
Hisn (App Locker) is provided by Saifullah Ahad ("we", "us", "our"). Our website/portfolio is: https://saifullah.ai.
2) What this policy covers
This Privacy Policy explains what information Hisn handles, how it is stored, and the choices you have when you use Hisn (the "App"), an app locker application for Android.
3) Information we collect
Most of what Hisn handles stays on your device. The only exception is the optional recovery account.
Stored only on your device:
- PIN: Your lock PIN is hashed using SHA-256 and stored locally on your device using Android DataStore. The plain-text PIN is never stored.
- Protected app list: The list of apps you choose to protect is stored locally on your device.
- Settings: Your preferences (theme, biometric, delays, toggles) are stored locally on your device.
- Intruder photos: If you enable intruder detection, photos taken after failed PIN attempts are saved locally on your device only. They are never uploaded anywhere.
Sent to Google Firebase, only if you link a recovery account to reset a forgotten PIN:
- Email address: Identifies your recovery account and receives its verification email.
- Password: Lets you prove the account is yours. Firebase stores it in hashed form, and we cannot see it.
- Account ID: Hisn also saves this ID on your device so only the linked account can reset its PIN.
- IP address and user agent: Firebase uses these to protect sign-up and sign-in from abuse.
- App and device check data: Firebase App Check uses Google Play Integrity to confirm that requests come from the real app.
The recovery account is optional. If you do not link one, Hisn sends none of this data and the rest of the app works the same, but you cannot reset a forgotten PIN.
4) How we use information
Hisn uses this information only for these purposes:
- Verify your PIN when unlocking protected apps.
- Remember which apps you have chosen to protect.
- Apply your preferred settings (theme, lock delays, etc.).
- Capture intruder photos when someone enters the wrong PIN (if enabled by you).
- Let you reset a forgotten PIN through the recovery account linked on your phone (if you link one).
5) Third-party services
Hisn uses one third-party service: Google Firebase (Authentication and App Check), only for the optional recovery account. Google explains how it handles this data at firebase.google.com/support/privacy.
Hisn has no ads, no analytics, and no crash reporting.
6) Sharing and disclosure
We do not sell your data or share it with anyone. Google Firebase processes recovery account data for us as a service provider. Everything else stays on your device.
7) Data retention
Data on your device stays there until you delete it or uninstall the app. Uninstalling removes your PIN, protected app list, settings, and any intruder photos. You can also delete intruder photos from within the app at any time.
Recovery account data stays until you delete the account. Uninstalling Hisn does not delete it. Firebase keeps logged IP addresses for a few weeks. After an account is deleted, Firebase removes its data from live and backup systems within 180 days. How to delete your recovery account.
8) Permissions used
Hisn requests the following Android permissions, each used only for its stated purpose:
- Accessibility Service: Required for core functionality. Hisn uses the Accessibility Service to detect when a protected app is opened so it can show the lock screen. This is the only way Android allows an app locker to work. The service does not read, collect, or transmit any content from other apps.
- Camera: Used only for intruder detection (optional). If enabled, the front camera captures a photo after multiple failed PIN attempts. Photos are stored locally and never uploaded.
- Biometric (USE_BIOMETRIC): Used only for fingerprint or face unlock as an alternative to PIN entry (optional).
- Notification Listener Service: Used only to hide notifications from protected apps (optional). Hisn removes the notification and shows its own alert with only the app's name and a count. This service does not read, store, or transmit what a notification says.
- Notifications (POST_NOTIFICATIONS): Lets Hisn show that private alert (optional).
- Device administrator: Used only for uninstall protection (optional), so Hisn is not removed by accident. You can turn it off any time in Settings, then uninstall Hisn normally.
- Internet: Used only for the optional recovery account.
Camera, biometric, notification, and recovery account features are optional. You can use Hisn with just the Accessibility Service and a PIN.
9) Your choices and controls
- Permissions: You can revoke the Accessibility Service, Camera, Biometric, Notification, or Notification Listener permissions at any time in Android settings.
- Intruder photos: You can enable/disable intruder detection and delete all captured photos from within the app.
- PIN: You can change your PIN at any time within the app.
- Recovery account: You can log out or delete the account in Settings, or ask us to delete it.
- Uninstall: Uninstalling Hisn removes all data from your device. It does not delete a recovery account.
10) Security
Your PIN is stored as a SHA-256 hash, and the actual PIN is never saved in plain text. Data on your device is stored in Android's private app storage, which is sandboxed and inaccessible to other apps. Intruder photos are saved in the app's internal storage directory, not in shared or public storage. Recovery account data travels over encrypted connections.
11) Children's privacy
Hisn does not knowingly collect personal information from children. The app may be used by parents or guardians to protect apps on a child's device. A recovery account should use the parent's or guardian's email.
12) Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated policy at https://privacy.saifullah.ai/Hisn and update the effective date above.
13) Contact
If you have questions or requests, contact: Saifullah Ahad
Email: [email protected]
Phone: +8801711134346
Website: https://saifullah.ai