HSX NanoKnot - Privacy Policy

1. Overview

Files, notes and your control input travel between your phone and your PC, encrypted. A watched PC screen is encrypted in the live video mode; on the same Wi-Fi, joining a screen and the still picture mode use your local network without encryption.
Send, and Watch on the same Wi-Fi, go directly between your phone and your PC. Control, on any network, and Watch from another network use a signaling service to introduce the two devices, and a relay may carry the encrypted stream when a network blocks a direct path. Neither keeps it.
There is no account, no advertising and no analytics or crash reporting service.
We have no servers that store your files, screen or input.
We do not sell, share or monetise user data.

2. Data We Do Not Collect

HSX NanoKnot does not collect, store on a server, or send us any of the following:

Personal Identity

No name, email, phone number, address or account.

Your Files and Screen

Files, notes, links, the PC's picture and sound, and what you type or tap never pass through our servers.

Advertising and Usage

No ads, no advertising ID, and no record of what you send, watch or control.

Location and Contacts

The app has no location or contacts permission. Finding PCs on your Wi-Fi is declared to Android as not used for location.

3. Data Stored on Your Device

Your PCs

The PCs you pair: the name you give each one, the link codes scanned from HSX NanoPilot and HSX NanoCastify, and the HSX NanoSend id that matches the PC on your network.

This Phone's Identity

A random id created on first launch and the phone's display name, kept in Android's encrypted storage. A PC shows the name, and HSX NanoPilot remembers the id once you allow the phone.

Received Files

Files a PC sends, after you accept them, are saved to Downloads where any file manager can open them. Notes and links stay in the app until it closes.

Wake and Shortcuts

A PC's network (MAC) address, saved so Wake on LAN can switch it on, and the launchers, key macros and text snippets you create for Control.

Settings and Pro State

Your appearance choices, and whether Pro was validated with its Google Play purchase token, kept on the phone so Pro works offline.

Uninstalling the app, or clearing its storage in Android settings, deletes everything in its private storage. Files saved to Downloads stay until you delete them.

4. Network Requests and Third Party Services

Your Wi-Fi Network

While the app is open it announces this phone's name and id on your local network so HSX NanoSend can list it, and asks the network for HSX NanoCastify. Transfers on the same Wi-Fi go straight to the PC, encrypted end to end. Watch on the same Wi-Fi connects straight to HSX NanoCastify: the live video mode is encrypted, while the join step (room code, PIN and this phone's name), the control socket and the still picture mode are not.

Signaling Service

To control a PC on any network, or watch one over the internet, the phone and the PC exchange connection details through a Supabase Realtime channel: a channel name derived from the link code (never the code itself), signed one time values, this phone's id and name, and network addresses. Messages are relayed, not stored; Supabase keeps short operational logs.

Connection Helpers

Google STUN servers tell the phone its public network address. When a network blocks a direct path, the free Open Relay service (Metered) may carry the encrypted stream; it cannot read it. Both see your IP address.

Speech for Dictation

If you use dictation in Control, Android's own speech service turns your voice into text, and only the text goes to your PC. Depending on your phone, that service may process the audio on Google's servers under Google's privacy policy.

Purchase Verification

When you buy or restore Pro, and about once a week while Pro is active, the app sends the Google Play purchase token, the product id and the app's package name to our verification service, which checks the purchase with Google Play. No personal data is included. The service stores nothing itself; its host, Supabase, keeps short operational request logs.

Links You Tap

Links to our website, email or Google Play open only when you tap them.

These are the only network requests the app makes. Signaling and purchase verification use encrypted HTTPS or secure WebSockets. Send, Control and live video Watch are encrypted end to end; same Wi-Fi Watch setup and still pictures are not.

5. Google Play Purchases

Pro is a one time purchase handled entirely by Google Play.

Card and payment details never reach the app or us.
We do not receive your Google account information.
On start the app asks Google Play which purchases this account owns, so a refunded purchase is removed. This check happens between your phone and Google Play.
Refunds are handled by Google Play under its refund policy.

6. App Permissions

Camera

Reads the QR code a PC shows, on the phone. Asked the first time you scan; no picture is saved or sent.

Microphone

Used only for dictation in Control, asked the first time you tap dictate. See Speech for Dictation in section 4.

Nearby Wi-Fi Devices and Multicast

Find HSX NanoSend and HSX NanoCastify on your Wi-Fi. Declared as not used to derive location.

Screen Kept On During Transfers

Transfers run while the app is open. The app keeps the screen on until they finish, then lets it sleep again. No background service or notification permission is used.

Internet and Network State

The connections in section 4.

Google Play Billing

The one time Pro purchase.

7. Children's Privacy

HSX NanoKnot is a general audience app. It is not directed to children under 13 and we collect no data from any user.

8. Policy Changes

This policy applies to HSX NanoKnot 1.0.0 and later, effective 8 Oct 2026. When the app's data behaviour changes, we update this page, its version and its effective date in the same release.

9. Copyright and Tamper Protection

HSX NanoKnot, its source code, design, brand identity, and all associated assets are protected by copyright. Reverse engineering, repackaging, decompiling, modifying signed builds, or redistributing the APK or AAB without written authorisation is strictly prohibited and may result in legal action under applicable copyright and computer misuse legislation.

Only builds published to Google Play under the publisher account "Hasnain Butt Akhtar / Hasnain Studio X" are genuine. Side loaded or third party builds are unauthorised and unsupported.

10. Contact

For privacy questions, contact:
Hasnain Butt Akhtar, Hasnain Studio X
[email protected]
https://hasnainstudiox.com