HiSign Privacy Policy

1. The short version

• HiSign does not collect any personal data. The app has no backend, no account system, no analytics, no tracking, no advertising, and no third-party SDKs that collect data.
• Everything you put into HiSign — your profile, your contacts, the cryptographic keys you exchange — stays on your device, encrypted with industry‑standard authenticated encryption, and is unlocked only by your device biometrics or device passcode.
• Contact exchange happens peer‑to‑peer between two phones (NFC tap or QR code). Nothing about that exchange goes through Insight Velocity or any third‑party server.
• Any in‑app purchase is processed entirely by the Apple App Store or Google Play Store. HiSign never sees your payment information.

The rest of this document spells out exactly what that means.

2. Information HiSign does not collect

HiSign does not collect, transmit, or have access to any of the following:

• Your name, email address, phone number, postal address, or any other contact information you enter for yourself or your contacts.
• Your contact list from the operating system. HiSign keeps its own separate, encrypted contact store and never reads the OS address book.
• Your location (precise or approximate). The app does not request the location permission on either platform.
• Photos, videos, microphone audio, calendar entries, files, SMS messages, call logs, or browsing history.
• Advertising or tracking identifiers, the device serial number, or any other persistent device fingerprint.
• Crash reports, performance metrics, usage analytics, telemetry, or any other diagnostic data sent to us automatically.
• Payment information. All in‑app purchases are completed inside the Apple App Store or Google Play sheet; HiSign never sees your card, bank account, or billing address.

There are no analytics SDKs, no ad SDKs, no attribution SDKs, and no third‑party tracking libraries embedded in HiSign.

3. Information that stays on your device

The following data is created or entered by you and is stored only on your device, in an encrypted local database:

• Your profile: the optional name, alias, phone numbers, email addresses, and notes you choose to add to your HiSign identity card.
• Your contacts: the HiSign cards you receive from other people, along with any nickname or notes you add about each one.
• Cryptographic key material: your personal identity key pair created on first launch, the per‑contact verification secrets exchanged with each peer, and a short fingerprint of each peer's public key (used to detect impersonation if a peer's key ever changes).
• App preferences: screen‑lock timeout, theme, widget pin choices, and similar local settings.
• Optional in‑app purchase record: if you choose to make an in‑app purchase, a small local record indicating the purchase has been made, kept only so the app can re-verify the purchase locally on launch. This record is never transmitted off the device and never sent to Insight Velocity.

How that data is protected

• All on‑device records are encrypted with industry‑standard authenticated encryption, using a per‑install random key.
• On iOS, that key — together with your private identity key — is stored in the iOS Keychain with an access policy that requires the device to have a passcode set, restricts the key to this device only, and requires the current Face ID / Touch ID enrollment for retrieval.
• On Android, the same per‑install key is wrapped by a hardware‑backed key (where the device supports it) in the Android Keystore, configured so that the wrapping key is destroyed if the user's biometric enrollment changes.
• The app requires biometric authentication (Face ID, Touch ID, or fingerprint) — or, as a fallback, the device passcode — to unlock the encrypted store on every cold launch, and again after the background grace period elapses.
• Backups, when you choose to export one, are encrypted with a password you choose, using a slow password‑based key derivation function and authenticated encryption tuned to make brute‑force attacks computationally expensive on modern hardware.

4. Biometrics

HiSign uses biometric authentication (Face ID, Touch ID on iOS; fingerprint or face unlock on Android) solely to unlock the encryption key that protects your local data.

• Biometric matching is performed entirely by the operating system.
• HiSign never sees, stores, or transmits your biometric templates, fingerprint images, or face data. Apple's and Google's platform documentation describes how these systems work.
• If biometrics are unavailable or have been removed, the app falls back to your device passcode; if neither is enrolled, HiSign cannot unlock the encrypted store and will prompt you to enable a screen lock.

5. Peer‑to‑peer contact exchange

Adding a contact in HiSign happens directly between two phones:

• NFC tap — two phones held back‑to‑back exchange a short signed payload over the operating system's NFC stack.
• QR code — one phone displays a signed QR code on screen, the other scans it with the camera.
• Manual exchange — for unusual cases, both sides type a short PIN‑encrypted code that may be delivered through any channel of your choosing.

In every case, the payload travels only between the two devices involved. Insight Velocity does not operate, route, or relay any contact‑exchange traffic, and does not receive a copy of the exchange. Live‑exchange payloads are short‑lived, and every payload is signed with the sender's identity key so the receiver can verify it has not been tampered with.

6. Network activity

HiSign is built to function fully offline. The only network request the app may make is a periodic clock‑integrity check against an authoritative public time service, used to detect a tampered or badly skewed device clock that could otherwise weaken the rotating verification phrase. This check uses the standard Network Time Protocol; only the timestamp fields the protocol defines are sent and received, and no account is involved.

That request:

• Is a standard NTP query and reads only standard NTP timestamp fields from the response.
• Sends no user data, no identifiers, no contact data, and no device fingerprint beyond what any standard internet request would reveal to any public server (your IP address and the timestamps the protocol requires).
• Is processed by the third party operating that service; Insight Velocity does not see or receive its results.

There is no other network traffic. There is no HiSign‑operated server to talk to.

7. In‑app purchases

HiSign may offer an optional one‑time purchase. Whether you make this purchase has no effect on what data HiSign collects, how it is processed, or where it is stored — there is no extra data collection associated with making, restoring, or declining the purchase. The purchase is:

• Sold and processed entirely by the Apple App Store or the Google Play Store.
• Subject to the privacy policies of Apple and Google for the transaction itself.
• Verified locally on your device using the platform's standard purchase‑receipt APIs. HiSign does not run a server‑side receipt validator because no HiSign server exists.

HiSign never receives, stores, or transmits your card number, bank information, billing address, Apple ID, or Google account email.

8. Home‑screen widgets

HiSign offers optional home‑screen widgets that surface a small subset of your local contact data (such as the names you have chosen to pin) for quick access. Widget content is rendered by the operating system from data already stored on your device and is visible according to your device's lock‑screen and home‑screen privacy settings. No widget data is transmitted off the device.

9. Optional diagnostic log sharing

If you choose to use the in‑app Report an issue option, HiSign will offer to attach a diagnostic log file. That file contains only event timestamps and high‑level event names (for example, "app launched", "biometric prompt shown", "NFC exchange started") and is composed entirely on your device at the moment you request it. It does not contain your contacts, your phone numbers or email addresses, your verification phrases, your cryptographic keys, or the contents of any exchange. You choose where the file is sent — HiSign does not transmit it.

10. Permissions used by the app

The app only requests the permissions it needs to function. The exact wording of each request is shown by the operating system when the permission is first needed. At a high level:

• Biometrics (Face ID, Touch ID, fingerprint) — to unlock the encryption key that protects your local data.
• NFC — to exchange contact cards by tapping two phones together.
• Camera — to scan another HiSign user's QR code when adding a contact.
• Internet (Android only as an explicit permission; iOS does not require an equivalent declaration) — for the optional clock‑integrity check described in §6.
• Vibration (Android) — for haptic feedback on a successful exchange.
• Billing (Android) — to process the optional in‑app purchase via Google Play. iOS purchases use the App Store's built‑in StoreKit and require no additional permission.

HiSign does not request location, your operating‑system contact list, microphone, photos, calendar, SMS, phone state, "query all packages", or any other sensitive permission.

11. Children

HiSign is a general‑purpose utility and is not directed at children under 13 (or the equivalent age in your jurisdiction). Because HiSign collects no data on a server, we cannot determine the age of any user. A parent or guardian who believes a child has been using HiSign on a device they manage can clear all of the app's data using the in‑app Delete all data option, which immediately and irreversibly wipes the local encrypted database and key material.

12. Your rights and choices

Because all data is on your device:

• Access / portability. You can view all of your data in the app at any time and export an encrypted backup file from Settings.
• Correction. You can edit your profile and contacts at any time.
• Deletion. Use the in‑app Delete all data option to wipe everything (encrypted database, keys, cached entitlement, and preferences). Uninstalling the app on iOS also removes its data; on Android, app data is removed when you uninstall or use Settings → Apps → HiSign → Storage → "Clear data".

HiSign has no servers, so there is nothing for us to delete or hand back on your behalf — your control over the data is your control over your device.

European users (GDPR), UK users (UK GDPR), California users (CCPA/CPRA), and users in other jurisdictions with similar laws have the rights granted by those laws. For the categories above, the practical answer is the same in every jurisdiction: HiSign does not collect personal data on a server, does not "sell" or "share" personal data, and does not engage in cross‑context behavioural advertising. The lawful basis under GDPR Art. 6(1)(b) is "performance of a contract with the user" — i.e. running the app you installed.

13. Data breach

There is no central HiSign database to breach. If your device itself is lost, stolen, or compromised, your HiSign data remains protected by the on‑device encryption and the biometric/passcode gate described in §3. If we ever discover and confirm a vulnerability that could materially weaken that protection, we will publish details and mitigation guidance through an in‑app notice and through the support contact below.

14. Changes to this policy

If we change this policy:

• The Last updated date and Version at the top of the document are bumped.
• A summary of the change is added to the Change log below.
• Material changes are surfaced to users on next app launch with an in‑app notice.
• The previous version remains available on request from privacy@insightvelocity.io.

We will not retroactively reduce the privacy protections described here without notifying you in‑app first.

15. Change log

• 2026‑05‑08 — v1.0.1. Editorial: clarified §3 to describe the iOS Keychain and Android Keystore storage models separately, and removed an ambiguous phrase that could be read as implying a Secure Enclave–wrapped iOS identity key. The underlying behaviour is unchanged from v1.0 — iOS identity keys have always been stored in the iOS Keychain (gated by Face ID / Touch ID), not the Secure Enclave. No change to data collection, processing, or sharing.
• 2026‑04‑23 — v1.0. Initial public release of HiSign for iOS and Android. Policy rewritten from the previous PWA‑era draft to reflect the native‑app behaviour shipped in v1.0.

16. Contact

Insight Velocity LLC
Privacy contact: privacy@insightvelocity.io
General support: support@insightvelocity.io

We aim to respond to privacy inquiries within 30 days.