1. The short version
HoloTech is self-hosted software. The vendor does not run a service that sees your files, your file names, or your passphrase. Every byte you upload is encrypted on your device before it leaves it, and the operator who hosts your installation only ever sees ciphertext.
2. What is collected on your installation
The HoloTech server stores only what your installation is configured to keep. By default this includes:
- Your encrypted vault (ciphertext only) and the metadata strictly required to address it.
- The encrypted blobs of any file versions kept by your version history setting.
- An audit log of administrative actions (sign-in attempts, configuration changes, operator commands).
Your passphrase, your encryption keys, and the plaintext content of your files are never stored on the server.
3. What the vendor collects
The vendor of HoloTech does not run a cloud service and does not receive telemetry from your installation. Download pages on the vendor site may record standard HTTP request metadata (IP address, user-agent, referrer) for the purpose of operating the website. You can opt out of those cookies through your browser.
4. Cookies set by HoloTech
HoloTech sets two narrow cookies, both first-party:
- csrf / __Host-csrf — a random token that the sign-in form reads and echoes back as a request header, so the server can tell a genuine form submission from a cross-site forgery. It is deliberately readable by the page's own script, scoped to this site, and a fresh value is minted on every visit to the sign-in page.
- session / __Host-session — a random opaque identifier that ties your browser to your authenticated vault. It is HttpOnly, so no script can read it; it expires when you sign out and is discarded when the browser closes.
No third-party cookies are set by HoloTech, and no analytics scripts are loaded by the bundled frontend.
5. Sharing and access control
Sharing is explicit. A shared link carries its own scope (folder, expiry, password), and only people with the link and any required password can read the ciphertext. Revoking a shared link rotates the wrapping key and renders the previously distributed copy unreadable.
6. Your rights
Because HoloTech is self-hosted, the operator of your installation is the data controller. The vendor cannot read, export, or delete your data on your behalf — only your operator can. To exercise rights such as access, correction, or erasure, contact the administrator of the installation you use.
7. Changes to this policy
Material changes to this policy will be reflected in the dated update notice above and announced through the release notes for the bundled frontend. Continuing to use the product after a material change constitutes acceptance of the revised policy.