Privacy policy
StegPony has no network access, no accounts, no analytics and no tracking. Nothing you hide, reveal or store leaves your phone unless you send it yourself.
What the app collects
Nothing. The Android app has no internet permission, so it cannot contact any server, including ours. There is no account, no telemetry, no crash reporting and no advertising identifier.
What stays on your phone
- Your keys and contacts. Encrypted with a key held in Android's Keystore, and left out of backups and phone transfers.
- Cover fingerprints. If the reuse warning is on, StegPony keeps fingerprints of the photos you have hidden in, encrypted, so it can warn before one is used again. Turning the warning off forgets them.
- Settings. App lock, screenshot blocking, launcher disguise and similar choices.
Passphrases are never stored. Images, text and files you hide or reveal are saved or shared only when you choose to. A copy prepared for sharing stays in the app's private storage until the next share or the next app start. Uninstalling the app removes everything it stored.
Permissions
- Camera: asked for only when you take a cover photo in the app or scan a QR code. Photos taken in the app are not saved to your gallery.
- NFC: used only to talk to an OpenPGP hardware key when you add one or reveal with one. USB keys are allowed per device when you plug one in.
Clipboard
When you copy a revealed message or hidden text, StegPony marks it as sensitive and clears it from the clipboard after a minute.
This website
stegpony.app sets no cookies and loads no analytics, fonts or scripts from anywhere else. The web server keeps standard access logs (IP address, time and the page requested) for running the site and fixing problems. Downloads of release candidates are plain file downloads with no tracking.
Changes
If this policy changes, the date at the top changes with it.