Holdy Privacy Policy

Last updated: 17 September 2026

Holdy is a device-ID utility and a research collection app used to build and test per-device Castle Android 4.1.0 compatibility profiles. It has no account or ads and does not use data for advertising or marketing.

How collection starts

Collection starts from the waiting screen after a posture heuristic: pick up the phone and hold it at a normal viewing angle. There is no in-app consent dialog. The Privacy policy button opens a copy bundled with the app, so reading it does not start a report. Following its deletion link opens the public deletion page.

Data Holdy collects

• Identifiers: the displayed Castle device or installation ID, Android ID, and three Castle request tokens. The tokens encode device, security, and aggregate motion/sensor signals. The Castle ID may be a one-way hash derived from a Widevine identifier or a random installation fallback; Holdy does not upload the raw Widevine identifier.
• Name and device details: manufacturer, model, Android/build details, device name and, when readable, Bluetooth name. A user-assigned device name can contain a person's name.
• Approximate region and network data: SIM/network country, carrier/operator, locale, time zone, connection/interface and local-address information, and proxy state. Holdy does not request GPS or precise location.
• Installed-app checks: presence results for a fixed list of 48 root or modification-tool package names and Google Play services. Holdy does not upload a full installed-app inventory.
• Diagnostics: token-call results, timing and errors; process/runtime, battery including signed current, memory, storage, CPU, display and network state; build, security, root and emulator signals; system/sensor feature flags; the 15 default-sensor checks Castle 4.1.0 uses; sensor name/vendor inventory; DRM crypto-scheme support; enabled accessibility-service IDs; kernel boot ID; and library/build/native SDK outputs.

Holdy uses gravity or accelerometer readings to detect that the phone is being held. Raw posture samples are not included in the uploaded report. Aggregate sensor signals encoded by the Castle SDK are included in its request tokens.

Purpose

The operator uses the report to issue the displayed device ID, prevent duplicate submissions, study Castle Android 4.1.0 behavior across physical devices, and build and test exact per-device compatibility profiles. The report is also used for diagnostics, security-signal validation, and deletion handling.

Where the report goes

After a successful 15-second collection, Holdy automatically sends the JSON report over HTTPS to the operator's Cloudflare Worker. The Worker forwards the same document over HTTPS to an operator-controlled Telegram chat. Cloudflare and Telegram therefore receive the data described above. Castle creates the tokens on the phone; Holdy uploads the resulting tokens as part of the report.

Storage and retention

• Telegram stores the JSON report until it is deleted. There is no fixed automatic expiry.
• Cloudflare KV stores the device ID, collection name, upload time/name, and Telegram chat/message IDs for duplicate control and deletion. It does not store a second copy of the JSON report.
• Holdy writes the latest JSON report to private app storage. It remains until it is replaced, app data is cleared, or the app is uninstalled.

Deleting your data

Open the data deletion page, paste the device ID shown in Holdy, and submit. No account is required. The service tries to delete each indexed Telegram document before removing its Cloudflare KV metadata.

Telegram may reject an automatic deletion. Some older uploads also lack the message metadata needed to locate the Telegram document automatically. If the page reports an incomplete deletion, use the developer contact on the Holdy Google Play page for manual handling. Clear Holdy's app data or uninstall it to remove its private on-device copy.

Security

Data is encrypted in transit with HTTPS. Access to the operator's systems is restricted, but no storage or transmission system can be guaranteed completely secure.

Contact

Use the developer contact on the Holdy page on Google Play for privacy questions or deletion help.