SirdasApp — Privacy Policy
Developer: HD Innovation Labs (Harun Doğan) · Contact: hdinnovationlabs@gmail.com · WhatsApp @harundogan · Web: https://sirdasapp.com · Effective: 3 November 2026
In short
SirdasApp stores your passwords only on your phone, encrypted. The app has no internet permission; the app doesn't send any data on its own to the developer, a server or any third party. Transfers you start yourself are described below. You don't need to create an account.
What data is processed and where it stays
| Data | Purpose | Where |
|---|---|---|
| Account names, usernames, passwords, notes, recovery codes | Saving to your vault | Only on your phone, encrypted with AES-256-GCM using an Android Keystore key |
| Photos you take with the camera | Reading a password from a screen or paper (text recognition runs on the phone) | Only on your phone, encrypted |
| PIN and pattern | Unlocking the vault | Only their hashes (PBKDF2) are stored; the PIN and pattern themselves are not |
| Answers to knowledge questions (optional recovery, off by default) | Verifying it's you when you forget your PIN | Compared on the phone with the record in the vault; not stored, never sent anywhere |
| Fingerprint / face | Unlocking the vault | Verified by the Android system; biometric data never reaches the app |
| Card, IBAN, ID, vehicle, address, health, insurance and bill details | Saving to your vault | Only on your phone, encrypted |
| Location — the app has NO location permission | YOU paste a map point into an address record (copied from Google Maps) | If saved, encrypted in the vault; if you share it, it goes only through the app and to the person YOU choose |
| Contact photos ("Whose?" picker) | Showing whose record it is by their face | Only on your phone, encrypted |
Sharing
Data is never shared with anyone and never sold. The app contains no advertising or analytics tools.
Some features use Google Play services on your phone: the QR code and document scanner, text recognition (ML Kit, runs on the phone), the watch connection (Wear OS Data Layer) and app updates. Google Play verifies with a license check that the app was installed from Play; this check is done by the Play Store app, SirdasApp itself never goes online. These libraries bring their own infrastructure; since SirdasApp has no internet permission, the app cannot send data through them, but the behaviour of Google Play services itself is subject to Google's policy.
Premium and purchases
Premium plans are sold through Google Play. Payment, your card details and your Google account are handled by Google Play; the developer doesn't see them.
SirdasApp asks the Play Store app on your phone about your purchase; the Play Store makes that request, and SirdasApp still has no internet permission.
Only the product ID, purchase time and end date are kept on your phone. Purchase tokens, order numbers and account details aren't stored; this record isn't tied to your vault and isn't part of device backups.
Google gives the developer its own order records for sales (such as order number, product, amount and country); these are used only for accounting, tax and refunds. How Google handles data is covered by its own privacy policy.
Transfers you start
- Backup: You create the backup file and choose where it is saved (phone, Google Drive, email attachment…). The file is written encrypted; on another device only your recovery key opens it (during setup you send the key to your own email — not to the developer).
- Emergency PDF: if you wish (after verifying your identity) you can export the details you choose as an unencrypted PDF. This file is unprotected; you decide where you save it and who you share it with.
- Also keep on watch (Wear OS): in Settings › Watch, the records you choose (name, type and the password / two-step code / QR code you choose) are sent to your watch through the Google Play services watch connection. This connection normally uses Bluetooth; when Bluetooth isn't available, Google's documentation says the data may pass through Google servers, end-to-end encrypted so those servers can't read it. On the watch, the records are stored encrypted with a key tied to the watch's screen lock. By default no record is sent.
- Import from Google Password Manager: Android's credential transfer system or a CSV file you choose is used; the data comes straight into the vault on your phone.
- Add to calendar (Reminders): only when you tap it, the record's name and date are passed to the calendar app on your phone; passwords, numbers or plates are not passed.
- Emergency card on the lock screen (off by default): if you turn it on, the health details and emergency contact you choose are visible while the phone is locked, without a PIN; this card isn't separately encrypted. Passwords, ID numbers, IBANs and addresses never go on it.
- Family package: you send the records you choose as a single encrypted file; the recipient can't open it without the code, and the package is valid for 24 hours.
- Sync: between your own devices, through an encrypted file in a folder you choose; neither the developer nor any SirdasApp server is involved.
- Digital legacy: your recovery key is split into parts, and you decide who gets them. One part alone opens nothing.
- Asset map PDF: lists what is where, contains no passwords and is not encrypted; you decide where it's saved.
- Autofill: if you choose SirdasApp as the password provider in Android, it fills sign-in screens only with your approval.
Crash reports and feedback
If the app closes unexpectedly, the location of the error (code lines), the app version and the phone model are written only to your phone.
On the next launch you are asked; if you tap "Send", it goes to the developer through your own email app, and you can see its contents before sending.
The report contains no passwords, cards, people or vault data; numbers and text in error messages are masked. There is NO automatic sending.
Emails you write with "Contact us" likewise carry only the content you send.
Logos
No company or institution logos are distributed inside SirdasApp; services are shown with generic line icons. If you want to add a real logo
to a record, you bring it yourself: from the icon of the relevant app on your phone or from your gallery. This logo is stored only
on your device, encrypted inside the vault; it is never sent anywhere. Logos belong to their owners.
Deletion
When you uninstall the app or reset the vault in Settings, all data on the phone is deleted. The developer holds no copy to delete.
Copies you sent to your watch are not deleted by removing the app from your phone: first use Settings › Watch › "Delete from watch", or uninstall the app on the watch.
Data controller and your rights
The developer (HD Innovation Labs, Harun Doğan, Türkiye) does not collect or receive any vault data, so there is no personal data held by the developer to access, correct, export or delete.
The only personal data the developer may receive is what you send yourself by email (a crash report or a message, together with your email address). It is used only to answer you and fix the problem, and is not shared with anyone.
You can ask for these emails to be deleted at any time by writing to hdinnovationlabs@gmail.com. Depending on where you live (for example under the EU/UK GDPR or Türkiye's KVKK), you also have the right to complain to your data protection authority.
Children
The app is not directed at children under 13 and does not knowingly collect data from them.
Changes
If this policy changes, the current version is published at this address and the effective date is updated.
The Turkish version of this policy is at https://sirdasapp.com/gizlilik/. If the two differ, the Turkish version prevails.