Hotei privacy policy

Effective 10 November 2026

Who this covers

This policy covers Hotei, the Android app with the ID uk.co.hotei. Hotei is made by Dmytro Bohovyi. You can reach the developer at bynarcodemaster@gmail.com.

Hotei has no server of its own and no account. The developer doesn't receive anything you save in the app, and there's nothing the app sends to the developer.

What the app stores and where

Everything you save stays in the app's own storage on your phone. Each item is a plain Markdown file in a folder called Items, and a picture you save is copied into a folder called Files next to it. Other apps on the phone can't read this storage.

An item file can hold:

• its title, and the address of the link if it is one;
• your note and your tags;
• the text that came with it when you shared it;
• the description, picture address and text the app read from the link's page;
• a short summary, a category and suggested tags, if you used AI; they stay in the item file on the phone and go with the item if you sync;
• when it was saved and changed, and when you asked to be reminded.

If you connect an AI server, the app keeps the server address, the model name and your key in Android's encrypted storage on the phone, separate from your items.

If you import from Telegram, the app reads the result.json file you choose on the phone and turns its links and text into items tagged telegram. Pictures and files in the export are skipped. The file itself is not sent anywhere.

Reminders are notifications scheduled on the phone. The app reads the phone's time zone on the phone so they arrive at the right local time.

What leaves the phone, when and to whom

Three things make the app use the network. None goes through a server run by the developer.

Link pages. When you save a new link, the app downloads that page from your phone to read its title, description, picture address and text. The request goes to the website in the link, and to any address that website redirects to. It carries no cookies and no login, and identifies itself as an ordinary mobile browser. Like any visit, it shows that website your phone's internet address and the page you asked for. Links brought in by a Telegram import are not downloaded.

Your AI server, only if you connect one. In Settings, under AI, you can enter the address of an AI server, a model name and a key from the provider you use. Nothing is sent until you do. After that, when you save a new item, the app sends that server the item's title, the site name of its link (not the full address), your note, and up to 6,000 characters of the page description and saved text, with a request for a short summary, a category and up to two suggested tags. An item with only a title is sent with its title alone, for a category and tags. Pictures themselves are sent only if you turn on Send pictures to my AI server, under your connection in Settings, AI; it is off until you turn it on. With it on, the app sends each picture you save, made smaller first (at most 1,024 pixels on its longest side), so the AI can describe what it shows. If a picture can't be read, or your server refuses it, the item is sent without the picture only when it has your note, a title you typed or saved text; a shared picture with only its default title is then not sent at all. With it off, a shared picture with only its default title is not sent; a picture with your note or a title you typed is sent with those, without the picture. It also sends up to 12 of your most-used tag names, so the AI can reuse them. Reminder times are not sent. Items you saved before are now sorted into categories too, one by one, in the background, and each is sent the same way. The app still never downloads the pages of old links. Test connection sends a short test message to the same server. When you tap Translate on an item's summary, the app sends that server the summary text and the name of your phone's language, with a request to translate it. The translation is shown on screen and is not saved. The built-in AI and the model on this phone translate on the phone and send nothing new.

The app sends your key only to the server address you entered, with each of those requests. Once you connect a provider, that provider's own privacy terms apply to what it receives, including whether it keeps it or uses it to improve its products. When you pick the Gemini address, the app shows a note that free Gemini keys let Google use what you send to improve its products. When you save or test a connection, internet server addresses must start with https://, which encrypts the request. Plain http:// is allowed only for a server on your own network, where the text travels without encryption within that network. The app recognises local servers by their address or host name; it does not check how your network routes the request. Previously saved connections keep working until you change or remove them.

The model on this phone, only if you ask for it. In Settings, under AI, you can choose Model on this phone and download it. The app then downloads one model file, about 2.6 GB, from huggingface.co. It does this once, over Wi-Fi unless you confirm mobile data, and it runs the model on the phone afterwards. The request sends no item, note, tag, key or other data of yours. Like any download, it shows Hugging Face your phone's internet address and the file you asked for. After the download, summaries, categories and tags made with this model never leave the phone, including those it makes by looking at your pictures on the phone, and the model sends nothing anywhere. Delete model removes the file.

The built-in AI, only if you choose it. In Settings, under AI, you can choose Built-in AI, which runs Gemini Nano on the phone through Google's ML Kit. When the built-in AI on your phone can read pictures, the app also gives it the picture you saved. Google's ML Kit terms say the processing of the input text and images fully happens on the phone and that ML Kit does not send that input or its results to Google servers. Google's ML Kit data disclosure says ML Kit does report some data to Google over HTTPS, for diagnostics and usage analytics: device information, the app's package name and version, per-installation identifiers that are not meant to identify you or your phone, user, device or other identifiers for its generative AI features, performance metrics, error codes and the languages configured. It says it does not pass this data to third parties. The developer receives none of it. The model you download under Model on this phone is a separate engine and does not use ML Kit.

When you tap Open original, the link opens in your browser or in the app that handles it, and that app's own terms apply.

What the app does not do

• It has no account and nothing to sign up for.
• It contains no analytics and no crash reporting of its own. If you choose the built-in AI, Google's ML Kit reports the diagnostics described above to Google.
• It shows no ads.
• It doesn't track you across apps or websites.
• It doesn't sell your data. The developer never receives it.
• It doesn't ask for your location, contacts, camera, microphone or photo library.

Permissions and why each is needed

• Internet: to download the pages of links you save, and to reach your AI server if you connect one.
• Notifications: to show the reminders you set, and the progress of the model download if you start one. On Android 13 and later, the app asks for it when you set a reminder or start the download, and you can say no. Without it, Android may stop a long download while the app is in the background.
• Run at startup: to put your reminders back after the phone restarts or the app is updated.
• Vibration: so a reminder notification can vibrate.
• Foreground service for data transfer and network state: to keep the model download running with a progress notification while the app is closed, and to tell Wi-Fi from mobile data before it starts. Used only for that download.
• A permission named after the app itself, ending in DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION, which Android's own libraries add. It keeps the app's internal messages private to the app and gives it no access to anything else.

Sharing a picture or text to Hotei goes through Android's share menu, and choosing a Telegram export goes through Android's file picker. Neither needs a permission, and the app sees only what you hand it.

Backups

If Android backup is turned on for your phone, Android can include your item files and pictures in your Google account backup and when you move to a new phone. That backup is run by Google under Google's terms, and the developer can't see it. The AI connection, including your key, is left out of both, so after a restore you enter the key again.

Deleting your data

• To delete one item, open it and choose Delete. Its file, its picture and its reminder are removed from the phone.
• To clear the AI connection, go to Settings, then AI, and choose Remove. The server address, model name and key are deleted from the phone.
• To delete the downloaded model, go to Settings, then AI, and choose Delete model under Model on this phone. The file is removed from the phone.
• To delete everything, uninstall Hotei. Android removes all of the app's data from the phone.

Copies in your Google account backup follow your Google backup settings. Text already sent to an AI provider is held by that provider, so ask them to delete it. The developer holds none of your data, so there is nothing for the developer to delete.

Children

Hotei is not directed at children.

Changes to this policy

If the app starts handling data differently, this page will be updated and the effective date above will change. Because there is no account, the developer has no way to tell you directly, so check this page when you update the app.

Contact

Questions about this policy: Dmytro Bohovyi, bynarcodemaster@gmail.com.