Privacy Policy
- Data goes only to Cloudflare.
- There is no operator server, and the operator does not receive your data.
- No analytics, ads or tracking.
01Operator and scope
This policy applies to the following, operated by Hagakun (developer name hg.dev on Google Play and Hagakun on the App Store):
- Haltkey, the Android and iOS app (
com.iruyo.haltkey), and its widgets - This site (haltkey.iru-yo.com)
Haltkey has no app account. You never register with the operator's servers.
02Data the app handles
Haltkey handles four kinds of data. None of it reaches the operator.
| Data | Where it is kept |
|---|---|
| Your Cloudflare tokens (from signing in, or API tokens you enter) | Only in the device Keychain (iOS) or Keystore (Android), as "this device only". Not included in backups or device transfers. The home-screen widgets get them through keychain sharing on the same device. |
| The cache fetched from Cloudflare (domains, DNS records, analytics figures, the state of Workers and Pages and so on) | Only on the device. |
| What you write to Cloudflare (DNS records, KV values, cache purges, setting toggles and so on) | Sent to Cloudflare when you act. |
| Files you save from R2 | In the location on the device that you choose. |
03Where data goes
Data goes only to the Cloudflare API (api.cloudflare.com) and the Cloudflare sign-in pages (dash.cloudflare.com), directly from your device.
- There is no operator server. The operator does not receive your data.
- Cloudflare handles the data you send under the Cloudflare terms and the Cloudflare Privacy Policy.
- No analytics, ads or tracking, and no SDKs for them.
- To return to the app after sign-in, the relay page on this site (
/oauth/callback) may be used. It only hands what it receives to the app; it sends nothing anywhere and stores nothing.
04Retention and deletion
- Data on the device: signing out revokes that sign-in's token at Cloudflare and deletes the token and cache from the device. Deleting the app deletes all of Haltkey's data on the device.
- Data on Cloudflare: what you wrote to Cloudflare stays on Cloudflare. Delete it on Cloudflare.
- App access: revoke it at any time under "Manage OAuth authorizations" in the Cloudflare dashboard. If you used an API token, delete it on the API Tokens page of the dashboard (dash.cloudflare.com/profile/api-tokens).
05Security
- All communication with Cloudflare is encrypted with HTTPS.
- Your tokens are kept in the OS secure storage (Keychain or Keystore) and are never shown on screen or written to logs.
06Crash information
There is no crash-reporting SDK. App crashes are seen only in the aggregated reports of Google Play Console and App Store Connect, which Apple and Google collect when you allow sharing in your device settings.
07Purchases
Haltkey Pro is bought through the App Store or Google Play. Apple and Google handle payment information; the operator does not receive it. Purchase status is checked only on the device.
08Relationship with Cloudflare
Haltkey is an unofficial app by an independent developer. It is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare, the Cloudflare logo, and Cloudflare Workers are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions.
09Contact
Operator: Hagakun
Email: haltkey@iru-yo.com
The app's source is not public, so issue trackers are not a contact channel.
10Change history
When this policy changes, the date at the top is updated and the change is listed below.
- October 21, 2026: first version