Privacy Policy for Khazna

Khazna (خزنة) is a personal vault: links you want to come back to, notes you jot down, and checklists you tick off. It has no accounts and no backend of ours. This page explains what it keeps on your device, the two requests that leave it, and how to switch both of them off.

Last updated 24 August 2026 · Covers Khazna 0.1.0 and later · com.khazna.vault

1. Who we are and what this covers

Khazna is built and published by Mohamed Gado, an individual developer, reachable at boogado@yahoo.com. In the language of data protection law, that person is the data controller for the small amount of information described in section 5. There is no company, no team and no third party with access.

This policy covers the Khazna mobile application, identified as com.khazna.vault, on Android and iOS. It does not cover the websites you open from inside it — once you tap a saved link you are on someone else's page, under their policy, and section 7 explains exactly what the app does and does not do at that moment.

2. No accounts, no server of ours

There is nothing to sign up for. Khazna has no login, no profile, no cloud, no sync and no API of ours anywhere in the picture. We do not operate a server that your vault touches, which means there is no database of items, no backup of your notes, and nothing for us to hand over, lose, or be compelled to produce.

This is a design decision with a cost, and it is worth stating plainly: because there is no server, there is no automatic recovery. If you lose the phone without having exported a backup (section 10), the vault is gone. We consider that the correct trade for a private notebook.

3. What stays on your device

All of it. Khazna stores its data in the app's private storage, which the operating system isolates from other apps. Nothing in this list is uploaded anywhere.

There is no analytics copy of any of this, no crash report that captures screen contents, and no diagnostic log that includes what you wrote.

4. The two requests the app makes

Khazna's own code opens exactly two kinds of network connection. Adding a third would require changing this page first, which is a rule the project holds itself to.

Request 1 — the title of a link you saved

When you save a link without typing a title, the app can fetch the page's own title so the item is readable later instead of being a bare URL. What that involves, precisely:

• It happens only for a link already saved, and only while that item is on screen or when you ask for it. Nothing is fetched while you type, and nothing is fetched from your clipboard.
• The request goes straight to the site. It does not pass through any service of ours or anyone else's, and there is no key or account involved. To that website, it looks like a visit — because it is one.
• It reads the markup only: the first 64 KB of the page, from which the title is taken. No images, scripts or stylesheets are downloaded, and no cookies are stored.
• It is attempted once per link. A page with no title is not asked again, and failure is silent — the link simply keeps whatever you typed.
• Switch: Settings → Links → Fetch page titles. Off means no request is ever made.

One honest consequence: the site you saved sees a request from your IP address at the moment you save or view the item, the same as if you had opened it in a browser. If that matters for a particular link, turn the setting off before saving it.

Request 2 — usage measurement

The app sends anonymous product measurements to PostHog, hosted in the European Union, so that decisions about what to build are based on how the app is actually used. Section 5 describes exactly what an event may contain — the short version is counts, durations, screen names and yes/no flags, and never a single character of what you wrote.

Switch: Settings → Privacy → Usage measurement. Off means nothing is sent.

5. Usage measurement, in detail

Most apps promise that analytics are "anonymous" and leave you to take it on faith. Here is the actual mechanism, because it is checkable rather than a promise.

Every event the app is allowed to send is declared in one file in the source, together with the exact shape of what it carries. A value in that file may be a number, a true/false flag, or one of a fixed list of words that we chose (a screen name such as feed, an item kind such as link). It may not be free text. A title, a URL, a note, a checklist label and a search query are all free text, so none of them can be placed in an event without changing that rule — and an automated test refuses to build the app if the rule is changed.

Counts that could grow without limit are rounded into bands before sending, because "this vault holds 1,247 items" is close to a fingerprint while "1000+" answers the same product question and is not.

PostHog assigns a random identifier to the installation so that a sequence of events can be recognised as one session. It is not derived from your device id, your phone number or any account, it is not shared with anyone, and reinstalling the app produces a new one. Session replay and autocapture — the PostHog features that record the screen and the text of whatever is tapped — are permanently disabled in the code and are not offered as a setting.

The legal basis, where the GDPR applies, is legitimate interest in understanding how the app is used, and the measurement is on by default. If you would rather not take part, one switch in Settings ends it.

6. Saving things into Khazna

There are four ways in, and none of them watches you.

• The share sheet. Khazna accepts shared text and web links from other apps. It deliberately does not accept images or files, so nothing from your photo library or storage can arrive. The app receives what you shared, at the moment you shared it, and nothing else.
• Pasting. When you open the capture sheet, the app may offer what is on your clipboard so you can save it in one tap. The clipboard is read at that moment to show you the offer; it is not monitored in the background and its contents are not stored or sent anywhere unless you choose to save them.
• Quick actions. Long-pressing the app icon offers shortcuts to start a new item. These are handled entirely by the operating system's launcher.
• Typing. Directly, in the app.

The app has no access to your browsing history, your other apps' data, your contacts, your photos, your location, your microphone or your camera — several of those are explicitly blocked in the app's manifest (section 12).

7. Opening a saved link

Tapping a link opens it in an in-app browser tab, or in your default browser when that is not available. From that point you are visiting the site normally: it sees your IP address and whatever your browser sends it, exactly as it would if you had typed the address. Khazna does not inject anything into the page, does not read its contents, and does not track where you go next. It records one thing locally, on your device: that the link has been opened, so it can stop showing as unread.

8. Reminders

You can ask an item to resurface at a chosen time. The reminder is scheduled with the operating system's own alarm scheduler and fires on the device. No push service is involved, no push token is requested, and the reminder's text — which may include your item's title — never leaves the phone. Denying notification permission simply means reminders are unavailable; nothing else in the app changes.

9. App lock and screen privacy

Two optional protections, both off by default and both entirely local.

App lock puts your device's own authentication — fingerprint, face, or PIN and pattern — in front of the vault. The check is performed by the operating system; the app is told only whether it passed. No biometric data is ever available to the app, and no PIN or password of ours exists to be stored, guessed or reset. The app remembers a single timestamp of when it was last backgrounded, so it can re-lock after the delay you chose. A cold start always locks.

If the lock becomes impossible to satisfy — you removed your device screen lock after enabling it, for instance — the app turns the setting off and lets you in rather than leaving you shut out of your own notes. A vault its owner cannot open is a loss, not security.

Screen privacy asks the operating system to block screenshots and screen recording, and to hide the app's preview in the task switcher. On Android this is the standard secure-window flag. The settings screen reports whether the block is actually in force rather than merely what you asked for, because a privacy control that claims to be on while it is not is worse than not having one.

10. Backup and restore

A backup is a plain JSON file containing your items, produced on demand and handed to your device's share sheet. Where it goes is entirely your choice — a cloud drive, a chat with yourself, a cable. It is not uploaded anywhere by the app, and no copy is kept by us. The file is not encrypted, because it is yours to place somewhere you trust; treat it as you would a document containing the same notes.

Restoring reads a file you pick and merges it into the vault. It never wipes what is already there, and restoring the same file twice changes nothing. You can also copy a backup to the clipboard and paste it back, which is useful for moving between two devices with nothing in between.

11. App updates

Two update mechanisms exist, and neither is a request the app's own features make.

• The app store. Google Play or the App Store handles installation and updates under its own privacy policy, as it does for every app on the device.
• Over-the-air updates. The app can fetch a corrected JavaScript bundle from Expo's update service (u.expo.dev) so a fix can ship without a store release. That request carries the app's version and platform in order to receive the right bundle. It carries nothing from your vault, and it is a platform mechanism rather than a feature — it is listed here for completeness, not hidden behind the count of two in section 4.

12. Permissions

Khazna asks for very little, and explicitly blocks several permissions that its libraries would otherwise be free to declare.

Explicitly blocked in the app's own configuration, so they cannot be present in a released build: microphone, camera, precise location, approximate location, physical activity recognition, reading images and reading video from your library.

Also absent, because nothing in the app has any use for them: contacts, SMS, call logs, the list of installed apps, and background location.

13. How your data is secured

Your vault sits in the app's private storage area, which Android and iOS keep isolated from other applications. On a device with a screen lock, that storage is covered by the operating system's own encryption at rest. App lock and screen privacy (section 9) add a second layer if you want one.

The two outbound requests use HTTPS. Beyond that, the strongest security property here is structural rather than technical: there is no server holding your items, so there is no breach of ours that could expose them.

A caveat worth stating: a device with no screen lock, or one that has been rooted or jailbroken, does not provide the isolation described above, and no app can restore it.

14. Retention and deletion

Your items are kept until you delete them. Deleting an item removes it; there is no hidden trash, and no copy is retained anywhere else. Archiving keeps an item out of the feed while leaving it searchable, and is not deletion.

To erase everything: uninstall the app, or clear its storage from your device settings. Both remove the vault and every setting with it, immediately and permanently. Export a backup first if you want to keep anything.

Usage measurements are held by PostHog for up to twelve months and then expire. They are not tied to your identity, so there is nothing personal to delete — but if you want the installation's measurement history removed anyway, email us from the address in section 19 and it will be deleted. Turning the switch off stops any further measurement immediately.

15. Your rights

Where the GDPR, the UK GDPR or a similar law applies, you have rights of access, rectification, erasure, restriction, portability and objection. Their shape here is unusual, because of how little exists:

• Access and portability are immediate and need no request: everything we could possibly hold about your content is on your device, and the backup export (section 10) is a machine-readable copy of all of it.
• Erasure is uninstalling, plus an email if you also want the anonymous measurements dropped.
• Objection to the measurement is a switch in Settings, effective at once, with no loss of any feature.

We cannot identify you from anything we receive, so we cannot search for "your" data on request — that is a consequence of collecting so little, not an evasion. You also have the right to complain to your local data protection authority.

16. Children's privacy

Khazna is a general-purpose notebook and is not directed at children. It contains no ads, no advertising identifiers, no in-app purchases and no social features, and it does not knowingly collect information from anyone. If you believe a child's information has somehow reached us, write to the address in section 19 and it will be removed.

17. Third-party services

There are no advertising networks, no attribution or install-tracking SDKs, no social logins, no crash reporter that captures screen contents, and no data broker relationship of any kind. Nothing is sold or shared for advertising, and nothing about you is used to train a model.

18. Changes to this policy

If the app starts doing something this page does not describe, this page is updated first, in the same working session as the change — not afterwards. The date at the top changes with it, and the full history of every edit is public in this repository's git log. Material changes will also be noted in the app's release notes.

19. Contact