Privacy policy — Tiho Docs

Separate from the one for Tiho Mail, because the two apps do different things. Where something costs you privacy, it says so in the same size type as everything else.

Last updated 24 September 2026

The short version

Tiho Docs is two things, and they are kept apart on purpose.

The editor needs no account and no network. A document you open from your disk is edited on your device and written back to your disk. We never see it.

The Tiho cloud is optional and paid. If you sign in to it, we keep your email address and the documents you put there, so that you can open them on your other devices and share them. Nobody else sees them unless you share them. Deleting your account in the app erases all of it within minutes.

Apart from that, the apps send a count of launches and sessions, which you can switch off, and which never includes a document, a file name or a path. And when you put a time seal on a document, its fingerprint, never the document, goes to a public timestamp authority, as described below.

The editor: what stays on your device

Everything you work on outside the cloud. Documents are opened from your disk and written back to it; the file on disk is the document. Nothing is uploaded, mirrored or backed up by us.

On the Mac and the iPhone the app runs in Apple's sandbox and may only read the files you choose yourself, through the standard Open dialog, the Files app, or by dropping them on the window. It has no access to the rest of your disk.

On the web page at docs.tiho.one, your browser keeps a few things for you, only in that browser and never sent to us: the last eight files you opened there, exactly as you brought them (a password-protected file stays locked), so that you can open them again from the first screen; your sign-in, until you close the tab or, if you ask it to, until you sign out; and small settings such as your language, spell checking and the name you put on comments. Clear the list on the first screen removes the files; clearing this site's data in your browser removes all of it.

The Tiho cloud: what we keep, and why

Only if you create an account and sign in. Without that, none of this exists.

• Your email address — to sign you in, to send you sign-in and password-reset codes, and to let other people share documents with you. An address that is never confirmed is removed after three days.
• Your password — only as an Argon2id hash. We cannot read it and cannot send it to you.
• The documents you put in the cloud, with their names, folders, the stars you give them, the documents in your trash (kept 30 days after you delete them) and up to 20 earlier versions of each document (kept 30 days).
• Who you share with — the email address of each person you give access to, and whether they may only view or also edit. When you share, we send that person one email saying so. The links you hand out, with how often each was used and until when it works (at most 30 days).
• Your signed-in devices — the name of each device (for example, “iPhone”), when it signed in and when it was last used, so that you can see them and sign any of them out. A device that is not used for 90 days is signed out.
• Your subscription — which Tiho Plus plan you have, until when, and the purchase number from the App Store or Google Play that proves it. Apple and Google tell us nothing else about you.

We do not read your documents, index them, show them to anyone or use them for anything except storing them and giving them back to you and to the people you share them with.

If your subscription ends, you can still open and download everything you stored; you just cannot add more.

Time seals and PDF signatures

Neither sends your document anywhere. Only fingerprints leave your device: 32 bytes each (a SHA-256 hash), from which the document cannot be rebuilt.

A time seal proves that a file existed exactly as it is at a given time. You can put one on any document or spreadsheet. In the apps on the Mac, the iPhone and Android it needs no account. The fingerprint of the file goes straight from your device to a public timestamp authority, without passing through us: first to Sectigo over HTTPS, and only if Sectigo gives no seal, to DigiCert over plain HTTP. The authority sees the fingerprint and, like any server your device connects to, your IP address, but not your name, your account or the document. Plain HTTP is not encrypted, so when the app falls back to DigiCert, someone watching your network could see the fingerprint too; they still cannot rebuild the file from it.

The web page cannot reach these authorities itself, so there the fingerprint goes to our server instead, over HTTPS, and you need to be signed in. Our server passes it on the same way as the apps: first to Sectigo over HTTPS, and only if Sectigo gives no seal, to DigiCert over plain HTTP, so on that fallback someone watching the network between our server and DigiCert could see the fingerprint. Before sending a seal back, our server checks the authority's signature on it, so a seal altered on the way is refused rather than passed on. The authority sees our server's address, not yours. Our server sends the seal back and neither keeps nor logs the fingerprint.

Signing a PDF is part of Tiho Plus and needs you signed in. The app sends our server a fingerprint worked out from the PDF and the time of signing. Our server signs it with our key, sends back the signature and our certificate, and keeps no copy of the fingerprint. In the apps on the Mac, the iPhone and Android, the signature then gets a time seal the same way as above: a fingerprint of the signature goes from your device to Sectigo or DigiCert.

Where it is kept

The cloud runs on a server we rent from OVHcloud in Canada. Canada is recognised by the European Commission as giving personal data adequate protection. Traffic between your device and the server is encrypted (HTTPS).

Our web server records the IP address of each request and what kind of request it was, to fight abuse; those records are deleted after 14 days. Our services keep their own logs for 30 days. Since 23 September 2026 neither log records document names or email addresses; older records that did are gone by 23 October 2026.

Who else handles it

• OVHcloud — rents us the server. They do not look inside it.
• Resend — delivers our emails: sign-in codes, password resets and share notices. They see the recipient's address and the email itself.
• Apple — sells the subscription through the App Store, on Apple's terms.
• Google — sells the subscription through Google Play on Android, on Google's terms.
• Google Firebase — counts launches (below).
• Sectigo and DigiCert — public timestamp authorities. When you put a time seal on a document, or sign a PDF in the apps, they receive a fingerprint as described above, with the IP address it comes from.

Sectigo and DigiCert answer anyone who asks, on their own terms. None of the others may use your data for their own purposes. Nothing is sold, and nothing is used for advertising.

Launch counts, and what they cost

This is the part most policies bury, so it stays near the top.

On the Mac, the iPhone and Android, Tiho Docs uses Google Firebase Analytics to count launches and sessions. We use it to know whether the app is being used at all and on which system versions, so that we know what to keep working. What it sends:

• that the app was launched, and that a session started and ended;
• the app version, the system version, the device model and the language;
• a random identifier for the installation, generated on your device by Firebase, not tied to you, your Tiho account, your Apple Account or any other app.

What it never sends: the content of a document, the name of a file, the path to it, the text you type, your email address, who you share with, or anything else the app reads. Those are never given to Firebase in the first place. The app does not use the advertising identifier.

This data goes to Google, acting as our processor. It is not sold, and it is not used for advertising or cross-app tracking. Firebase keeps it for at most 14 months. The Tiho Docs web page counts nothing.

Turning it off

Settings ▸ Send anonymous launch counts, on every device. Switch it off and nothing is sent from that moment on; every feature keeps working.

Deleting your account

In the app: on the Mac, Tiho Docs ▸ Delete the account…; on the iPhone, Settings ▸ Tiho cloud ▸ Delete account…; on Android, the Tiho cloud screen ▸ ⋮ ▸ Space ▸ Delete the account…. Or from any computer, signed in on the web page at docs.tiho.one. We ask for your password once more, because this cannot be undone.

Your account, email address, password hash, devices and subscription record are erased at once. Your documents, their earlier versions, your trash, your links and your shares are erased within minutes after that. We keep no backups of them. Documents on your own disk are not touched.

Deleting the account does not cancel a subscription; cancel it in your Apple Account settings or in Google Play ▸ Subscriptions, or the store will keep charging you.

What we do not do

• No advertising, no advertising identifiers, no third-party trackers in the apps or on the web page.
• No crash reporter of ours. If your system asks you to send a crash report, that goes to Apple or Google, on their terms, and only if you agree.
• No profiling and no automated decisions about you.
• No reading of your documents, by people or by machines.

Children

The app is rated 4+. The editor collects nothing that identifies anyone, of any age. The cloud needs an email address; if a child has used it, a parent can delete the account from the app or by writing to us.

Your rights

You can see and change what we keep in the app and on the web page: your documents, your shares, your links and your password, and download any document you stored. You can delete your account at any time, as described above.

For anything else — a copy of the data we hold about you, a correction, or a question — write to us and we will answer within 30 days. You may also complain to your data protection authority.

The controller is Ziewnull, reachable at the address below.

Changes

If this policy changes in a way that affects what is kept or sent, the app's release notes will say so plainly, in the same words as here.

Contact

Questions about any of this: hello@tiho.one.

This text is written in English, and the English wording is the one that governs. If you need help understanding any part of it in your own language, write to hello@tiho.one and a person will explain.