Two things to know
Privacy
This website collects nothing and the app has nowhere to send your data. Sync is local, encrypted and only between the devices you pair.
This website
- No cookies, no trackers, no analytics, no advertising.
- No third-party resources: fonts, icons and scripts are hosted here.
- No forms: there is nothing to fill in and no data to send.
- The only saved preferences are the theme, the language and whether Bastet is visible, in
localStorage: they stay on your device and are never sent anywhere. - Any technical server logs (for example the IP address) depend on the hosting provider and are not used by Thot.
If access statistics were ever needed, we would only use aggregated, cookie-free solutions, and we would declare them on this page before enabling them.
The app
- No account, no login, no Thot server: everything happens on your devices.
- No telemetry: the app does not send data outside the devices you use.
- Your data are open files (
.md,CSV, attachments) in a folder you choose. Check it yourself: open the folder with any program.
Sync
ThotSync uses the local network: the same Wi-Fi or the phone's hotspot. Two devices pair with a temporary code and a J-PAKE exchange; files travel in a channel encrypted with X25519 and AES-256-GCM. There is no Thot server and no data goes over the internet. Paired devices are listed in the app data folder, not inside the vault.
PIN and biometrics
The optional PIN is an access lock for the interface: it is stored only as a PBKDF2-HMAC-SHA256 hash with a random salt, never in clear text. It does not encrypt the files: anyone who can access the vault folder can read them. On Android 9+ biometric unlock uses the system BiometricPrompt: the app stores neither a clear-text PIN nor biometric credentials. There is no automatic PIN recovery.
Leaving Thot
No export is needed: close the app and use your files with any other program. To delete everything, delete the vault folder (and uninstall the app, if you like). Nothing is kept anywhere else.
The PIN does not encrypt files and sync is not a backup: keep a copy of the vault on a medium you control.