Privacy Policy
Effective 6 October 2026 · applies to Hashiya for iPhone, iPad and Android
Hashiya has no account, no ads and no tracking. Your library, notes and PDFs stay on your device. We don't run a server. What can reach us is a crash report and usage statistics, which aren't linked to your name or account and never contain anything you wrote or read — and you can turn either off in Settings.
What stays on your device
- The papers you save, their reading status (To read, Reading, Read), your notes, your collections and your library searches.
- PDFs you download or attach.
- Your settings, including an OpenAlex API key if you enter one. On iPhone and iPad the key is kept in the Keychain; on Android it is kept in the app's private storage.
Your phone's own backup (iCloud or Google) may include this data in your personal backup, under your account and that service's terms. We can't access it. PDFs downloaded from a paper's open-access link are left out of those backups, because they can be downloaded again.
When you export a backup from Settings, Hashiya makes a file of your library (and, if you choose, your PDFs) and saves or sends it only where you pick. Restoring a backup reads the file you choose on your device.
What the app sends, and to whom
To find papers, Hashiya sends requests straight from your device to two public research catalogs:
- OpenAlex (api.openalex.org), operated by OurResearch (Impactstory, Inc.): your search words and filters, and any DOI you look up.
- arXiv (export.arxiv.org), operated by Cornell University: an arXiv ID you look up, when OpenAlex doesn't have that paper.
These requests don't include your name, your library or any identifier we create. Like any website, these services see your IP address and may keep logs under their own privacy policies: OpenAlex and arXiv.
When you download a paper's PDF, Hashiya fetches it from the open-access address OpenAlex lists for that paper — usually the publisher's site or a repository such as arXiv. That site sees your IP address, like any download.
Each time it opens, Hashiya also checks whether your version is still supported by downloading a small public file from GitHub Pages (fadyfouad.github.io), operated by GitHub. That request contains nothing about you; like any website, GitHub sees your IP address.
Crash reports
To find and fix bugs, Hashiya sends a report to Firebase Crashlytics, a Google service, when it crashes, freezes or hits certain errors (for example a failed restore). A report contains:
- the technical details of the error (the type of error and where in the app's code it happened);
- the app version, your device model and operating system, and the device's state at the time (such as free memory and storage, and screen orientation);
- the app's language, the screen that was open, a rough library size (for example "51–500 papers") and whether a backup was running;
- a random installation identifier created by Firebase, which isn't linked to your name or account.
A report never contains your papers, notes, searches, collection names, files or API key. Google processes these reports for us under Firebase's privacy terms; we use them only to keep the app working.
Crash reports are on by default. Turn them off in Settings → Privacy → Send crash reports; reports not yet sent are then deleted and nothing more is sent.
Usage statistics
To learn which features help and what to improve, Hashiya sends usage statistics to Firebase Analytics (Google Analytics for Firebase), a Google service. They are tied to a random Firebase identifier, not to your name or account. They contain:
- what you do in the app, counted: searches (whether it was a keyword search or a DOI, arXiv or link lookup, whether filters were on, roughly how many results, and whether the search used Hashiya's shared allowance, your own key, no key, or results already kept on your device), loading more results (which page), reaching the daily search limit or the page limit, papers saved (from search results or a lookup) or removed, notes edited, collections created and papers added to them, exports (BibTeX or backup, with or without PDFs), restores and PDF downloads (and whether they worked), PDFs opened (downloaded or attached), and which screens you open;
- for keyword searches, a broad research area such as "artificial intelligence" or "computer networks", worked out on your device from the OpenAlex topics of the results — your search words are never sent;
- when the app is first opened, opened and updated, and how long it's in use, which Firebase records automatically;
- the app's language, a rough library size (for example "51–500 papers"), whether you use your own OpenAlex key, and the app version, device model and operating system;
- your approximate location (such as country and city), which Google works out from your IP address; Google doesn't keep the IP address itself;
- a random app-instance identifier created by Firebase, which isn't an advertising identifier and isn't linked to your name or account.
They never contain your name, email address, search words, papers, titles, DOIs, notes, collection names, files or API key. Advertising features are off: no advertising identifier is collected, and nothing is used for ads or shared with advertisers. Google processes this data for us under Firebase's privacy terms. It keeps the detailed, per-installation data for 2 months; after that only overall totals remain.
Usage statistics are on by default. Turn them off in Settings → Privacy → Share usage statistics; the app then stops sending them and deletes its analytics identifier and anything not yet sent. What was already sent is deleted after 2 months, apart from overall totals.
Sharing to Hashiya
When you share a page or text to Hashiya from another app, it reads only what you shared, to find the paper's DOI, arXiv ID or title.
Links you open
Opening a paper's DOI page or PDF hands the link to your browser. What happens there is covered by the website you visit.
Deleting your data
Swipe a paper to remove it, or delete the app to remove your whole library and settings. Clearing the API key in Settings removes it from your device. Crash reports are tied only to a random Firebase identifier, not to your name or account, so we can't single out yours; Crashlytics deletes every report automatically after 90 days. To stop sending them, turn crash reports off in Settings. Usage statistics are likewise tied only to a random identifier; Google deletes the detailed data after 2 months and keeps only overall totals. To stop sending them, turn them off in Settings.
Children
Hashiya is made for university students and researchers. It isn't directed at children, and it doesn't ask for or collect names, email addresses or other details that identify anyone; crash reports and usage statistics contain none.
Changes
If this policy changes, we'll update this page and its effective date. If the app starts collecting anything new, we'll say so here before that version is released.
Contact and support
Questions, bug reports or feature requests: