Privacy Policy

Effective: November 3, 2026 · Published by KLKR Studio

The short version

Hillside is a home screen (launcher) for Android that looks and works like a desktop computer of the early 2000s: icons, folders and text documents on a desktop, a taskbar with a Start menu, and windows. It has no ads, no analytics, no tracking and no crash reporting, and it needs no account.

Hillside comes in two builds, and this one policy covers both:

The Google Play build has no internet permission at all, so it cannot send anything anywhere — not a report, not a statistic, not a single request.
The Solana dApp Store build reaches the network for two things only, and only when you use them: the optional Premium purchase (and restoring it), and the Chat window. Everything else works without the network and sends nothing. Nothing is sent when Hillside starts.

Neither build ever sees your private keys or your seed phrase.

What you write in Chat is public: it is stored on our chat server and anyone can read it. Everything else you create in Hillside — your desktop, folders, documents, settings — stays on your phone.

What Hillside sends, and when

The Google Play build

Nothing, ever. The INTERNET permission is not declared in this build, and an app without it cannot make a network request even if its code tried to — which is a claim you can check for yourself in the app’s permission list, rather than one you have to take on trust. This build has no Chat and no wallet features.

The Solana dApp Store build: Premium

Buying Premium. When you press the button to buy:

Hillside opens your own wallet app on the phone through Mobile Wallet Adapter, the standard way Solana apps talk to a wallet. The wallet asks you to connect and tells Hillside your public wallet address. Your private keys and seed phrase stay inside the wallet; Hillside never sees them and has no way to ask for them.
To prepare the payment, Hillside asks the public Solana network endpoint https://api.mainnet-beta.solana.com for: the SKR balance of your SKR token account (derived from your public address), your SOL balance (to check you can pay the network fee), whether our receiving account exists, and a recent block reference. These are the same public lookups any Solana app or block explorer makes.
Hillside builds an unsigned transfer of 1,000 SKR from your wallet to our receiving address, with the public note (memo) “Hillside premium”, and hands it to your wallet. Your wallet shows it to you, and only if you approve it there does the wallet sign it and send it to the network. If you decline, nothing is paid.
Hillside then asks the same endpoint whether that transaction was confirmed, and unlocks Premium when it was.

Restoring Premium (after a reinstall or on a new phone). Hillside connects to your wallet to learn your public address and asks the wallet to sign a line of text — “confirm this wallet is yours to restore Premium”, with a random code. This is not a transaction: nothing is sent and no money moves; the signature only proves the wallet is yours, and it is checked on the phone. Hillside then asks the same public endpoint for the transaction history of your SKR account and of our receiving account, to find an earlier Premium payment made from your address.

What this means for your privacy:

The operator of api.mainnet-beta.solana.com receives those requests, and with them your IP address and the addresses involved, as any web server does. Its own privacy policy applies. We do not operate it and receive nothing from it.
A Solana payment is public and permanent. Once made, anyone can see on the blockchain that your wallet address sent 1,000 SKR to Hillside’s receiving address with the note “Hillside premium”. That is how the network works, and neither we nor anyone else can remove it.
We see the payment on the blockchain, as anyone could. We do not receive your name, e-mail, phone number or anything else about you, and we keep no list of buyers.

The Solana dApp Store build: Chat

Chat is one room shared by everyone who uses Hillside’s dApp Store build. It runs on our own server (a Cloudflare Worker with Cloudflare’s storage), at hillside-chat.studioklkr.com.

Reading. While the Chat window is open, Hillside asks the server for the latest messages every few seconds. With each request it sends a random code that the app makes up each time it starts — it says nothing about you or your phone and is used only to count how many Chat windows are open (the “N online” line). The server keeps it in memory for about fifteen seconds and does not store it. When the window is closed, nothing is asked. You can read Chat without signing in.

Signing in to write. To write, you connect a Solana wallet:

Hillside asks our server for a sign-in line, and your wallet asks you to sign it (“Hillside chat sign-in. This only proves the wallet is yours. No payment.”). This is not a transaction and costs nothing.
Hillside asks the public Solana endpoint https://api.mainnet-beta.solana.com which .skr name accounts your address owns, so that your .skr name can be shown instead of your address.
Hillside sends our server your public wallet address, the signature, and those name accounts. The server checks the signature, and checks on the public Solana network (through the public endpoint https://solana-rpc.publicnode.com) that your address really owns the .skr name. It then gives the app a sign-in token valid for 30 days, kept on your phone.

What our server stores:

Your messages — the text, the time, your wallet address and the name shown (your .skr name, or a shortened address). Messages are up to 500 characters. Hillside shows the latest 100; the server keeps the latest 500 messages in the room and deletes older ones automatically.
Your account record — your wallet address, your .skr name if you have one, the time you last signed in, and a picture number given to each account in order of first sign-in, so that every writer has their own picture. This record is kept for as long as Chat runs, unless you ask us to delete it.
A list of blocked wallet addresses, if a moderator blocks one.

Who can see it. Messages, with the name and address of who wrote them, are public: anyone who opens Chat can read them, and the server gives the message list to anyone who asks for it without signing in. Do not post anything you would not post on a public notice board.

Moderation. Moderators can delete a message (its text is erased) and block a wallet address from writing.

Minefield results. With Premium, you can send the result of a Minefield game to Chat. It is posted as an ordinary message from you: the level, your time or how much of the field you cleared, and the numbers needed to replay the same field.

IP addresses. Our chat server’s code does not record IP addresses. Cloudflare, which runs the server for us, handles the connections and with them your IP address, under its own privacy policy.

Signing out (File → Sign out in the Chat window) deletes the sign-in token from your phone.

No crash reports

There are no crash reports in either build. Hillside sends nothing about its own failures anywhere.

There is nothing else

Hillside contains no advertising, no analytics SDK, no attribution or install-tracking SDK and no social login. It does not collect usage statistics of any kind.

What stays on your phone

To be a home screen at all, Hillside reads and keeps things that never leave the device:

The list of apps installed on your phone (Android permission QUERY_ALL_PACKAGES) — needed to show them on the desktop, in the Start menu, in All apps, Run and Search. It is never transmitted.
Your desktop — the icons, shortcuts and folders on each of your desktops and where they stand, your text documents written in Notepad, the Trash, Quick Launch, the size and place of windows, the colour scheme, the wallpaper choice and the Fine Tuning options. Kept in the app’s private storage.
Restore points (Premium) — up to twelve earlier copies of your desktop, made by System Restore, including your documents. Kept in the app’s private storage.
Settings and the All apps arrangement — folders and order in All apps, the colour scheme and other settings, and the list of apps you put in the hidden space.
Private choices (Premium) — which apps are locked, which apps wear a disguise (another name and icon), and which icon pack is used. Kept in a separate file that is never included in any backup and never written to a layout file.
Whether Premium was bought on this phone — a single yes/no. In the dApp Store build, also a payment that was sent and not yet confirmed (its transaction signature and your public address), until the network confirms it. Not included in any backup.
Chat sign-in (dApp Store build) — your public address, your .skr name, your picture number and the sign-in token. Not included in any backup.
Your wallet choice (dApp Store build) — which wallet app the desktop’s Wallet icon opens.
Minefield scores and game settings.
A layout file (Premium), only if you choose to save one — All apps with its folders, and the settings; not your desktop icons, documents, hidden apps, locks or disguises. It is written to the place you pick, and read back only when you choose to restore from it. Anyone who can open that place can read it.

When you choose your own picture as the wallpaper, Hillside asks Android to set it as the phone’s wallpaper; the picture is read from where you picked it and goes nowhere else.

Hidden space, private space and app lock

Hidden space (Premium) keeps chosen apps out of the desktop, Start, All apps, folders and search. Opening it asks for the phone’s own fingerprint or screen lock.
Private space is Android’s own separate, locked profile for apps, on phones that have it. Hillside only shows its door and its apps once Android has unlocked it; what is inside belongs to Android, not to Hillside.
App lock (Premium) asks for the phone’s fingerprint or screen lock before a chosen app opens from Hillside. Android checks the fingerprint or code; Hillside never receives it, only a yes or no.

None of this leaves the phone.

Backup and moving to a new phone

If you have Android backup or phone-to-phone transfer switched on, two of Hillside’s files are included: the All apps arrangement and the settings — and the settings include the list of apps in your hidden space. Nothing else is included: not your desktop, your documents, your restore points, your locked apps or disguises, your Premium status or your Chat sign-in. Your documents exist only on your phone: uninstalling Hillside deletes them.

That backup belongs to you and your device maker’s backup service (for example Google). It goes to your account, not to us. We have no access to it and never receive it.

Permissions, and why each one exists

Both builds:

Permission	Why
`QUERY_ALL_PACKAGES`	To see which apps are installed, so they can be shown. A home screen cannot work without it.
`SET_WALLPAPER`, `SET_WALLPAPER_HINTS`	To set a picture you choose as the phone’s wallpaper, and to tell Android the size of the home screen so the wallpaper is not blurred.
`ACCESS_HIDDEN_PROFILES`	To show Android’s private space, if you have one, and the apps in it once Android has unlocked it.
`REQUEST_DELETE_PACKAGES`	To let you choose Uninstall for an app. This only asks Android to show its own confirmation; Hillside cannot remove anything itself.
`EXPAND_STATUS_BAR`	To pull down the notification shade when you swipe down on the home screen. Hillside reads no notifications.
`USE_BIOMETRIC`, `USE_FINGERPRINT`	Added by Android’s biometric library, to ask Android’s own fingerprint or screen-lock prompt before opening a locked app or the hidden space. Hillside never receives your fingerprint or code.
`DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION`	Added by Android’s support library so that Hillside’s internal messages cannot be read by other apps. It grants nothing.

The Solana dApp Store build only:

Permission	Why
`INTERNET`	For Premium (buying and restoring) and for Chat, as described above. Nothing else.
`ACCESS_NETWORK_STATE`	Added by the wallet connection library (Mobile Wallet Adapter). It only tells whether the phone is online.

The dApp Store build also asks Android which apps on the phone are Solana wallets, so that it can offer to connect one. That is a question to Android, not a permission, and nothing is sent.

Hillside requests no permission for location, contacts, phone calls, messages, storage, camera or microphone, and cannot read any of them.

Opening other apps

Tapping an icon starts that app. The Control panel opens the matching pages of your phone’s own settings; Search, Trash and Quick Launch can open your phone’s contacts, gallery, files, phone, messages and browser apps; Help opens Hillside’s website in your browser; links to stores open your app store (Google Play or the Solana dApp Store, depending on the build); the Wallet icon and Premium open your wallet app. From that moment the other app’s own privacy policy applies. Hillside does not report what you opened or searched for to anyone.

Children

Hillside is not directed at children. Chat is open to people of at least 13 years of age, or the older minimum age for such services in their country. We do not knowingly keep Chat data of younger children; if you believe a child has used Chat, write to us and we will delete it.

Your choices and your rights

Stop all transmission: in the Google Play build there is nothing to stop — it cannot reach the network at all. In the dApp Store build, do not buy or restore Premium and do not open Chat: nothing else ever reaches the network.
Delete what is on the phone: uninstalling Hillside removes everything it stored on the phone. Any backup copy is removed through your backup provider’s own controls.
Delete what is on our server: write to us with your wallet address, and we will delete your Chat messages and your account record. A payment made on the Solana blockchain is public and cannot be deleted by anyone.
Your rights: where data-protection law gives you rights — to know what we hold about you, to have it corrected or deleted, to object — write to us. The only data about you we can hold is your Chat data described above.

Changes

If this policy changes, the new version is published at this address with a new date above. If Hillside starts sending anything that is not described here, this policy is changed first.

Contact

Our publisher page, KLKR Studio, lists how to reach us.