Hisar privacy policy
Effective 18 October 2026. Applies to the hosted Hisar service at api.tryhisar.com and to the Hisar apps for macOS, iPhone and Android, the hisar command-line tool and the Hisar browser extension.
Summary
- Hisar is an end-to-end encrypted password, SSH key and secrets manager for developers. Your passwords, notes, keys and other items are encrypted on your devices before they are sent to our server. We cannot read them.
- To run the service, the server does store some things it can read: your email address and name, your devices' names, who you share vaults with, the organizations and teams you are in, timestamps, sizes, and IP addresses in a security log kept for one year. This page lists all of it.
- There is no analytics, advertising, tracking or selling of data. Our pages and emails contain no trackers and the service sets no cookies.
Who runs Hisar
The hosted service is operated by Alper Berber ("we", "us"). We are the controller of the personal data described here. Questions and requests: support@tryhisar.com.
What we cannot see
Your apps encrypt everything below with keys that never leave your devices. The server stores only the encrypted result, so neither we nor anyone who obtains a copy of our database can read it:
- your master password and your Secret Key (signing in uses a protocol, OPAQUE, in which the server never receives the password);
- the contents of your items: titles, usernames, passwords, websites, notes, custom fields, one-time-password secrets, passkeys and SSH private keys;
- vault names, including those of organization vaults;
- what a share link contains, and the key or passphrase that opens it;
- what an approval request from your Mac to your smart device describes, and your answer.
Because we never have your master password or Secret Key, we cannot reset your password or recover your data. If you lose both your master password and every signed-in device and your Emergency Kit, your data is lost.
What the server stores
| Data | Why | How long |
|---|---|---|
| Your account: email address, name, role on the Hisar server (admin or member), the date you signed up, whether an admin suspended it and since when, and cryptographic material that does not reveal your password (password-check record, key-derivation salt and settings, your encrypted keyset, your public keys and their signatures) | To sign you in, to let people share with you, to show your name to the people you share with and the people in your organizations, and to let the admins of the Hisar server manage accounts | While your account exists |
| Your devices: the name you or your computer gave it (for example "Ada's MacBook Pro"), the platform (for example "macOS app"), when it signed in and when it was last seen; a hash of each session token | To list your devices so you can sign one out, and to keep you signed in (sessions expire after 30 days without use) | While your account exists; sessions until they expire or you sign out |
| Your vaults and items, encrypted: the ciphertext, its size, when it changed and which account changed it; how many items each vault has; who has access to each vault and with which role; which organization an organization vault belongs to | To sync your data between your devices and the people you share with | While the vault exists; earlier versions of an item for 90 days |
| Organizations: the name of each organization and of its teams; who is a member, with which role (admin or member), and who is in which team; which teams were given which vaults, with which role; and who created, added or gave each of these, and when. The vaults' names and items stay end-to-end encrypted, as above | To let admins manage an organization's members, teams and vaults, to show the members of an organization to each other, and to give a team's members its vaults | While the organization exists (admins can delete it once it has no vaults; it is deleted with the account of its last member); your membership until you leave, an admin removes you or you delete your account |
| Invitations: the email address you invite, who invited them, when, and whether it was used; for sharing a vault, also the vault, the role and whether they accepted; for an organization, also the organization and the role | To send the invitation and let the other person accept it | A vault invitation until the share is finished, declined or cancelled; an organization invitation until it is accepted, declined or cancelled; any invitation at most 30 days after it expires (invitations expire 7 days after they are sent) |
| Share links: which account created the link, the encrypted contents and an encrypted label only your devices can read, its size, expiry, view limit and number of views, and whether it needs a passphrase | To serve the link to the person you send it to | Deleted when the link expires, is revoked, or reaches its view limit |
| Security log: sign-ins and sign-ins refused because the account is suspended, sign-ups, devices signed out, master password and Secret Key changes, failed master password checks, account deletions, invitations, sharing changes, organization changes (organizations and teams created, renamed or deleted; members' roles changed; people added to or removed from a team; people removed from or leaving an organization; vaults given to or taken back from a team), changes the admins of the Hisar server make to accounts (suspended, reactivated, role changed, signed out, deleted), and share links created or revoked, each with the account, the device, the time and the IP address it came from; for sign-ins also the device's name and platform, and for invitations the invited email address | To detect and investigate abuse and attacks on accounts | 1 year, then deleted automatically |
Kept only in memory
- Rate limits. To slow down password guessing and spam, the server counts requests per IP address and per account in memory. These counters are never written to disk and are lost when the server restarts.
- Approvals from your smart device. When your Mac asks your smart device to approve an SSH or command-line request, the server relays an encrypted request and an encrypted answer. It sees your account, which device asked, an ID, the sizes and the times, for at most a few minutes, in memory only.
- Live updates. While your apps are open, the server keeps a connection to tell them that something changed, without content.
Logs and backups
- Like most web services, our web server records each request (IP address, time, address requested, response status and browser or app version) in access logs, kept for 14 days. Opening a share link is recorded there the same way; the part of the link that holds the key is never sent to the server.
- We back up the database every night. Backups are encrypted and kept for 30 days, so deleted data disappears from backups after that time.
The server sends a few plain-text emails, with no images or tracking: an invitation when someone invites you to Hisar or to an organization or shares a vault with you, and a note to you when someone accepted your invitation to a vault but your Hisar has not finished sharing it yet. Emails contain the names and email addresses of the people involved, the organization's name in an invitation to an organization, and, in an invitation to someone without an account, a sign-up link; they never contain vault names or items. Email is not end-to-end encrypted. We send these transactional emails through Google (Google Workspace SMTP), which processes the recipient's address and the message to deliver it. Google is a US company; transfers of this data to the US are covered by the EU–US Data Privacy Framework and Google's standard contractual clauses.
Who else receives data
- The people you share with see your name, your email address and your security code, and the vaults you share with them. Apart from the admins of the Hisar server (below), nobody can look up whether an email address has a Hisar account or list its users.
- The admins of the Hisar server, from its admin dashboard, see each account's email address, name, role, whether it is suspended, sign-up date, last activity, and how many devices and vaults it has, and each device's name, platform and when it signed in, was last seen and was signed out. They never see vault names, items or keys, which stay end-to-end encrypted. They can suspend an account, which keeps it and its devices from reaching the server and stops its share links from opening until they reactivate it, sign its devices out, change its role, and delete it, as described under "Your choices and rights", and you get an email when they delete it.
- The people in your organizations see your name, your email address, your role, your security code and the teams you are in. An organization's admins see the email addresses invited to it, and whoever you invite sees your name and email address with the invitation. Admins choose who is in each team, and so who gets its vaults. Being an admin gives no vault: an admin who joins a team gets its vaults like any member, and every member sees that. People outside an organization cannot see who is in it.
- Service providers that process data on our behalf: Hetzner Online GmbH runs the server and stores the database and backups, on servers in Helsinki, Finland (EU); Google delivers email (below).
- Authorities, only when the law requires it. What we could hand over is what this page lists; we cannot decrypt your vaults.
We do not sell or rent personal data, and we do not use it for advertising or profiling.
The apps
- The macOS, iPhone and Android apps keep an encrypted copy of your vaults on the device so they work offline. The Android app keeps that copy and your Secret Key out of Android's backups and out of transfers to a new device. Touch ID, Face ID and Android's fingerprint and face unlock are handled by the device's operating system; Hisar never receives your fingerprint or face data.
- For AutoFill on the iPhone, Hisar gives iOS the website and username of each login and passkey, so iOS can suggest them, and iOS keeps that list on the iPhone. Android's AutoFill gets nothing from Hisar ahead of time. When you fill a form, Android tells Hisar the page's address or the app you are in, and the form's fields; Hisar reads the app's signing certificate from the device. Hisar stores none of it, unless you choose to always use a login in that app, which saves the app's name and certificate in the login, encrypted like the rest of it. After you sign in somewhere, Android can offer to save what you typed to Hisar, and Hisar stores it only if you save it in its editor. On Android 14 and later, when a website in your browser or an app asks Android for a passkey or password, Android gives Hisar the website's address or the app's name and signing certificate, the site the request is for, the passkeys that site accepts and, when you save a passkey, your user name there; Hisar stores none of it unless you save a new passkey, and before it lets an app use a website's passkeys it reads that website's
/.well-known/assetlinks.jsonfrom your device. - A password or other secret you copy is cleared from the clipboard after 90 seconds on the iPhone, where it also stays off your other devices. On Android it is cleared about 2 minutes after the copy and marked sensitive, so the system and the keyboards that respect the mark hide it. On Android, screenshots, screen recordings and the app switcher show nothing of Hisar unless you turn on Allow screenshots in Settings → Security.
- The apps contact the Hisar server you sign in to, and ask the website of a login for its icon (Settings → Appearance → Show website icons turns this off on the Mac, the iPhone and Android). To fill a login into an Android app, Hisar may also ask a website in your vaults whose name is part of the app's name whether that app may use its logins, by reading the website's
/.well-known/assetlinks.json; the website sees that request come from your device's IP address. The macOS app checks the Hisar server for updates while you are signed in. - The Hisar browser extension talks only to the Hisar app on the same computer, through the browser's native messaging, and sends nothing to the internet. It reads the address of the page you are on and the login forms on it, to offer matching logins and to offer saving a login after you sign in. Page contents are not stored or sent anywhere except to the Hisar app on your computer. It stores a random installation ID, the pairing token for your Hisar app, its settings, and the sites you chose "Never for this site" for, in the browser's local extension storage. Logins are filled only on the site they were saved for.
Security, and its limits
Traffic is encrypted with TLS. Items are encrypted with keys derived from your master password and your 128-bit Secret Key, so a copy of our database is not enough to guess your password offline. We work to keep the service secure, but please know the limits of any server-based design:
- The server sees the metadata listed above: who you share with, which organizations and teams you are in, how many items you have, how big they are and when they change.
- A compromised server could try to hand you someone else's public key when you share a vault. Comparing security codes with the other person once (Settings → People) detects that.
- When you own a vault, your app gives its key to the people the server says accepted your invitation to it or are in a team that has it, so a compromised server could have your app give the key to an account the server controls.
- The Android app trusts every certificate authority installed on the device, including ones you install yourself, so a certificate authority you install can see Hisar's TLS traffic, while the contents of your vaults stay end-to-end encrypted.
- The web page that opens a share link is served by our server, so a compromised server could change it. People who use the
hisarcommand-line tool can open share links without the page.
If we learn of a breach that affects your personal data, we will tell you and the relevant authorities as the law requires.
Legal bases
Under the GDPR we rely on:
- Contract (Art. 6(1)(b)): account, device, vault, sharing, organization and share-link data, and the emails about your own account, to provide the service you signed up for.
- Legitimate interests (Art. 6(1)(f)): the security log, rate limits and web server logs, to keep the service secure and prevent abuse; and invitation emails to people who do not have an account yet, sent because a user asked us to.
Your choices and rights
- You can see and change your vaults, devices, sharing and organizations in the apps at any time, and sign out any device.
- You can delete your account yourself in the Hisar apps (Settings → Account → Delete account) or with
hisar account delete, after confirming your master password and your email address. You can also email support@tryhisar.com from the address on the account and we will delete it for you, and an admin of the Hisar server can delete it from the admin dashboard. Deleting the account deletes everything tied to it at once: devices, sessions, the vaults you own with no other owner and their items (the people you shared them with lose access), your access to vaults that have another owner (those vaults stay with them), your membership of organizations and their teams (if you were an organization's last admin, the remaining member who joined earliest becomes its admin, and an organization left with no members is deleted with its teams and invitations), your share links, and the invitations you sent or received. An organization's records of who created it or its teams, added someone to it or gave a team a vault keep only your account's ID. We email you a confirmation. Security log entries and backups are deleted on the schedules above. - Under the GDPR you have the right to access your personal data, to have it corrected (rectification) or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. Write to support@tryhisar.com and we will answer within one month.
- You may also lodge a complaint with a data protection supervisory authority. We are based in the Netherlands, so the lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you can also complain to the authority in the EU country where you live or work.
Children
Hisar is not meant for children under 16, and we do not knowingly hold their data.
Changes
When we change this policy we update the date at the top, and for significant changes we tell you in the apps or by email before they take effect.