Privacy Policy

Who We Are

Hongi is an identity-verification application operated by Lovit BV, Asse, Belgium. We are the controller for the processing described here. Contact us at privacy@hongi.io.

1. Overview

Hongi does not require a personal account for its core pairing and verification features. Staff of an organisation that uses Hongi can choose to sign in with a work account, described below. After pairing, personal-contact codewords can be generated on your device without an internet connection. Online features do process information on our servers and through service providers. Random identifiers and encrypted records are not the same as collecting no data.

We use this information to provide pairing and verification, deliver notifications and app updates, prevent abuse, diagnose service problems, and respond to requests. We do not sell personal information or use it for advertising or cross-app tracking.

2. Information on Your Device and Permissions

• Personal contacts and secrets: contact aliases, pairing records, and verification secrets are stored locally. Personal-contact shared secrets are derived on the paired devices and are not sent to our servers. Secret storage uses operating-system-protected storage, including iOS Keychain and Android Keystore-backed storage. Organisation pairing is different and is described below.
• Preferences and cached information: your display name, language, appearance and security preferences, organisation directory information, and local verification state are stored on the device. If notifications are enabled, the app also keeps a push token locally.
• Camera: when you choose to scan a QR code, Hongi requests camera access through the operating system. QR recognition happens on the device; this feature does not save or upload camera images. You can decline access and continue using other features. Showing your own QR code does not require camera access. Hongi does not need microphone access for scanning.
• Biometrics: optional app lock uses the operating system's authentication result. Hongi does not receive your face or fingerprint data.

Hongi does not request your phone's address book or GPS location. Network services receive your IP address when you connect to them.

3. Information Processed by Online Features

Remote personal-contact pairing. Our relay temporarily stores session identifiers, ephemeral public keys, nonces, expiry information, encrypted display names and, where used, a notification mailbox identifier. Display names are encrypted between the paired devices; the relay cannot read them or derive the personal-contact shared secret. Your pairing partner receives the name you choose to share. Separate service logs record request metadata as described below.

Verification notifications. Our push service stores a mapping between mailbox identifiers and an Expo push token associated with your app installation. Mailbox identifiers are pseudonymous routing identifiers, not a guarantee of anonymity: multiple registrations can use the same token. Delivery uses Expo Push Service and Apple Push Notification service on iOS or Google Firebase Cloud Messaging on Android. These services process routing information and notification payloads, which may include encrypted verification data, nonces and mailbox identifiers. Personal-contact verification payloads are encrypted before leaving the device.

Organisation pairing and verification. When you pair with an organisation, our services process the organisation identifier, an ephemeral public key, replay-prevention values, platform and app/device integrity evidence. We retain pairing identifiers, a Hongi ID, pairing status and timestamps, a hash derived from the pairing public key, and an encrypted copy of the organisation verification secret. The service can use that secret to support organisation verification. This is different from personal-contact pairing, where our servers do not hold the secret. Pairing, reset and other security events can be retained in audit records. An organisation you interact with may associate your Hongi ID or verification with information it already holds about you; its own privacy notice also applies to its processing.

Organisation staff sign-in. Signing in is optional and only for staff of an organisation that uses Hongi. A work account is created when your organisation invites you or, for its first administrator, when we approve the organisation's application. Sign-in happens on our sign-in service in your phone's browser, so the app never sees your password. The sign-in service holds your email address, your sign-in credentials and your role, and records your sign-in sessions. Our organisation service records your membership, role and when you were invited. The app stores on the device your email address, account identifiers, your organisation's name, short name and identifier, your role and permissions, your sign-in status, and when the account was added and last used. Sign-in tokens are kept in iOS Keychain or Android Keystore-backed storage and stay on that device. When you act for your organisation, for example by verifying a caller, our services record your account identifier with the action in audit records, and keep short-lived per-account request counters to prevent abuse. Audit records also note when you were invited, removed or changed role, including the email address you were invited with. Your organisation manages your membership; its own privacy notice for staff also applies.

App integrity. Organisation pairing uses Apple App Attest on iOS or Google Play Integrity on Android to help reject modified apps and abusive requests. Apple or Google processes integrity evidence. Our iOS service stores an App Attest key identifier, public key, counter, environment and timestamps to validate later requests. These identifiers can distinguish an app installation even when no one has signed in.

Service requests and logs. Our services and hosting infrastructure process IP addresses, request paths, timestamps, status codes, errors and request duration for security, troubleshooting and service operation. Paths and security records may include session, mailbox, pairing or organisation identifiers. We do not embed advertising or third-party behavioural analytics SDKs; operational logging still takes place.

Directory and app updates. The app downloads organisation directory information and can check for app updates automatically. Expo's update service receives network information and technical update metadata such as platform, runtime version and update channel. These connections can occur without a separate permission dialog.

Clock checks. If you request a clock-accuracy check, the app contacts WorldTimeAPI over HTTPS. That provider receives your IP address and request metadata. Hongi uses the returned time to compare it with your device clock. This is an HTTP request, not an anonymous NTP exchange.

Support and privacy requests. If you email us, we receive your email address and the information you choose to send, and use it to respond. Do not send verification secrets or live codewords.

4. Recipients and Service Providers

Information is processed by our hosting, database, logging and support providers as needed to operate the service. Specific services used by the app include Expo for push delivery and app updates, Apple for iOS notifications and integrity checks, Google for Android notifications and integrity checks, and WorldTimeAPI for requested clock checks. Your pairing partner and organisations you choose to interact with receive the information described above. If you sign in with a work account, your organisation can see the actions recorded under your account.

Providers may process information outside your country, including outside the European Economic Area. Contact us for information about the processing locations and applicable transfer safeguards for your data. We may also disclose information when legally required or necessary to protect the service against fraud and abuse.

5. Retention

• Relay sessions: expire automatically; the standard server session lifetime is 30 minutes. Expiry removes the session record, not related operational logs.
• Push registrations: can be removed by an unregister request or when the push provider reports that the device is no longer registered. A registration expires after 180 days without re-registration or a delivery lookup. Both activities restart this period, so active registrations can remain longer.
• App Attest keys: keys unused for more than 90 days become eligible for cleanup on subsequent store activity; deletion is not immediate at the 90-day boundary.
• Operational logs: our production logging configuration retains logs for 30 days. Security audit records are separate.
• Organisation records and audits: pairing records are retained to support verification, recovery and security. Audit retention defaults to 1,095 days for organisation-associated events and 2,555 days for internal events; organisation-specific retention settings can differ. Deletion takes place through scheduled retention processing. Contact us about the period applicable to your organisation pairing and deletion requests.
• Work-account sign-in: you need to sign in again after 7 days without use, and at the latest 30 days after signing in; until then the account shows as signed out on the device. Signing out, or Delete All Data, removes the account and its tokens from the device. When your organisation removes you, your membership and role end; your sign-in login (email address and credentials) stays on our sign-in service until you ask us to delete it. Audit records of your actions follow the audit retention above; request counters are cleared periodically once their time window has passed.
• Support correspondence and backups: correspondence is retained as needed to resolve your request and related disputes or obligations. Backup copies may remain until their backup retention cycle ends; deletion from an active service does not instantly remove every backup. Service providers also apply their own retention practices.
• Organisation pilot or listing requests: when an organisation asks for a pilot or a directory listing through the website, we process the name, email address, organisation name, domain and any optional message provided, including the role, products and calls selected on the form. This information is used to confirm the email address, by sending a single confirmation link, and to review the request, including comparing the email address's domain to the organisation's domain. Requests not confirmed within 7 days of the most recent confirmation email are deleted.

6. Your Choices and Deletion

You can change camera, notification and biometric permissions in your device settings. Declining camera access prevents QR scanning, and declining notifications prevents notification-based features; it does not prevent local codeword verification for existing contacts.

Deleting a personal contact removes its local contact record and secret. Settings → Danger Zone → Delete All Data removes personal contacts and their stored secrets, signs out any work accounts on the device and removes their sign-in tokens, and resets onboarding. During personal-contact deletion, the app attempts to unregister associated notification mailboxes. Network failures can prevent server unregistration even when local deletion succeeds. This action is not a request to erase organisation records, audit logs, your work account or all server data, and it does not reset every stored preference.

Uninstalling removes app storage according to your operating system's rules. iOS Keychain items can survive uninstalling, so use the in-app deletion action before uninstalling to remove personal-contact secrets and work-account tokens. Neither local deletion nor uninstalling removes your pairing partner's copy of shared information or automatically erases server records.

For server-data access or deletion, email privacy@hongi.io. Include enough context to locate the record, such as an organisation and Hongi ID, if available. We may need proportionate verification that the request relates to your data. Do not send cryptographic secrets. Some security or legal records may need to be retained; we will explain any applicable limitation. See also Delete Your Data.

7. Legal Bases and Your Rights

For EEA users, we rely on legitimate interests in operating, securing and troubleshooting Hongi and responding to requests, and on consent where applicable to optional processing. You can withdraw consent for processing based on consent without affecting its earlier lawfulness. Operating-system permission controls are described above.

Depending on applicable law, you may request access, correction, erasure, restriction or portability of personal data, and object to processing based on legitimate interests. These rights are subject to their legal conditions; having data stored locally does not automatically satisfy them. Contact privacy@hongi.io to exercise your rights. You may complain to the Belgian Data Protection Authority or your local supervisory authority.

Where California privacy law applies, you may request access, correction or deletion and exercise applicable rights without discriminatory treatment. We do not sell personal information or share it for cross-context behavioural advertising. Transfers to the service providers described above are still part of operating Hongi.

8. Children's Privacy

Hongi is not directed at children under 13, or under 16 in the EEA. If you believe a child has provided personal information to us, contact privacy@hongi.io so we can investigate and take appropriate action.

9. Changes and Contact

We will update the date above when this policy changes and provide additional notice where required. For questions or requests, contact Lovit BV, Asse, Belgium, at privacy@hongi.io.