Privacy Policies

 

 

Effective Date: October 31, 2026

Last Updated: October 31, 2026

 

This Privacy Policy describes how CyberKhan8 Consulting LLC ("we," "us," or "our") governs data collection, storage, and processing across our mobile applications, HashNotes and VirtualShell (collectively, the "Applications"), and our website located at CyberKhan8.com (the "Website").

 

Both Applications are engineered with an offline-first, local-storage architecture. We do not operate remote user profiling databases, sell user data, or transmit your personal notes or terminal activities to private external servers. By downloading, accessing, or using either Application, you agree to the practices outlined in this policy.

 

1. Core Architecture & Account Philosophy

Neither HashNotes nor VirtualShell requires user registration, profile creation, or account credentials.

No User Accounts: We do not implement account authentication systems (Firebase Authentication, Google Sign-In, or custom email/password mechanisms are unused).

 

Anonymous Identifiers: VirtualShell uses a customizable local display username (defaulting to "user") stored strictly in your device's local application preferences (SharedPreferences). It is never transmitted across the network or linked to your real-world identity.

Offline-First Principle: All primary productivity functions, note indexing, command-line simulations, and educational challenge evaluations operate locally on your device.

 

2. Information Handled by Each Application

A. HashNotes

HashNotes is a hashtag-driven personal productivity and note-taking tool.

User Notes & Content: Your note titles, text bodies, custom hashtags, inline tags, and reminder timestamps are stored locally using the Android Room database (NoteDatabase) and physical text files managed on-device by NoteStorageManager.

Export Functions:

Local Export: Notes exported to .txt or .pdf formats are saved strictly to the directories you designate on your device's local file system.

Google Drive Export: When you manually initiate a cloud backup, data is transmitted directly between your device and your personal Google Drive account via the Google Drive API. We do not broker, intercept, or inspect these files.

Task Reminders: Scheduled alerts (#RemindMe, #NotifyMe) are evaluated and scheduled locally using the device’s internal alarm and notification managers.

 

B. VirtualShell

VirtualShell is an interactive Linux terminal simulator and command-line educational trainer.

Simulation & Lab Progress: Completed educational labs, challenge flags, and curriculum milestones are stored strictly within an on-device Android Room SQLite database (terminal_trainer_database).

Virtual File System (VFS): The emulated Linux file system environment, generated test files, and directory trees are serialized locally to an internal JSON file (vfs_state.json) stored exclusively in the application's private internal storage directory (filesDir).

Preferences & History: Terminal visual preferences and shell history buffers are stored locally on the device in SharedPreferences (virtual_shell_prefs).

No Remote Telemetry of Commands: All simulated terminal commands, manual page lookups (man), shell autocompletions, and verification routines run entirely inside on-device logic (VirtualFileSystem, ProcessScheduler, Curriculum). Your command inputs and terminal sessions are never transmitted to any external server.

 

3. Artificial Intelligence (AI) Disclosures

We maintain strict transparency regarding on-device and cloud-based machine learning capabilities:

 

HashNotes: Contains zero artificial intelligence integrations, large language models (LLMs), or connections to Google AI Studio or Gemini APIs. All hashtag classification, parsing, and dual-tag indexing are driven by deterministic local algorithms.

 

VirtualShell: While the underlying build dependencies package the firebase-ai library client framework, no active remote AI calls, Gemini API requests, or Google AI Studio integrations are executed in the runtime code. All terminal simulations, lab validations, syntax suggestions, and command outputs are generated 100% locally on-device. No user terminal inputs, prompts, or code snippets are ever transmitted to any generative AI service or server.

 

4. Device Permissions

Our Applications only request permissions strictly required to execute core user-requested functions:

Application

Permission

Purpose

 

HashNotes

POST_NOTIFICATIONS

Delivers local task reminders triggered by #RemindMe and #NotifyMe tags.

 

HashNotes

INTERNET

Facilitates user-initiated backups to Google Drive, handles in-app billing, and performs integrity checks.

 

HashNotes

Local Storage Access

Saves user-requested .txt and .pdf file exports to your device.

 

VirtualShell

INTERNET

Facilitates Google Play digital billing purchases and App Check integrity validation.

 

VirtualShell does not request access to device hardware, your physical device's root file system, location sensors, contacts, camera, or external storage.

 

5. Third-Party Libraries & Data Sharing

We do not sell, rent, or monetize your data. The Applications integrate only with essential infrastructure SDKs:

Provider / Library

Purpose

Applications Involved

Data Handled / Policy Link

Google Play Billing

Processes digital in-app purchases (HashNotes Theme Pack, VirtualShell Expert Tier)

HashNotes, VirtualShell

Purchase tokens and transaction status via Google Play. Financial and payment card information is processed solely by Google. Google Privacy Policy

Firebase App Check (via reCAPTCHA)

Verifies application integrity and protects against automated abuse

HashNotes, VirtualShell

Device signals, hardware fingerprints, and attestation tokens. Firebase Privacy Documentation

Google Drive API

Facilitates direct, user-initiated cloud backups of user notes

HashNotes (optional)

Transmits encrypted note backups to your personal Google account storage. Google API Services User Data Policy

 

Note on Inactive SDKs: Neither Application uses advertising SDKs (e.g., Google AdMob), behavioral user trackers, Firebase Crashlytics, or Firebase Analytics.

 

6. Data Retention, Management, and Deletion

Because our Applications store information locally on your device rather than on centralized cloud databases, you retain unilateral control over your records:

In-App Data Reset and Removal

HashNotes: You may delete individual notes or hashtags directly inside the note editor at any time. When task reminders are dismissed, trigger hashtags and scheduling alarms are automatically cleared.

VirtualShell: You can wipe your entire training footprint at any point by navigating to Settings / Options > Reset Trainer Progress. Triggering resetAll() permanently purges all completed lab records from the Room database, wipes preferences back to factory defaults, cleans the terminal session logs, and re-initializes the virtual file system (vfs_state.json).

Total Data Erasure

To permanently delete all application data from your device:

Open Android Settings > Apps (or Application Manager).

Select HashNotes or VirtualShell.

Tap Storage & Cache > Clear Storage (or Clear Data).

Alternatively, uninstalling the Application instantly removes all local databases, preferences, and internal sandbox files.

Cloud backups previously exported from HashNotes to your personal Google Drive remain under your direct management and can be removed directly via your Google Drive interface.

 

7. Data Security

Because your data resides on your device, it is secured by Android's application sandboxing architecture, which restricts other applications from reading the internal databases and files belonging to HashNotes or VirtualShell. All network communications involving Google Play Billing, App Check verification, or Google Drive exports are secured using modern Transport Layer Security protocols (TLS/HTTPS).

 

8. Children’s Privacy

The Applications are general-audience tools intended for developers, students, cybersecurity enthusiasts, and productivity users. Neither Application is directed to children under the age of 13 (or under 16 in the EEA), and neither collects personally identifiable information. If you believe an unauthorized minor has transmitted personal data through external support channels, contact us so we can immediately purge those records.

 

9. Rights Under Global Regulations (GDPR, CCPA/CPRA)

Under privacy frameworks such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA), users possess rights regarding access, deletion, and portability of their personal data.

Because we do not collect personal identifiers, maintain central user databases, or monitor your activity across the internet, we hold no personal data to retrieve, modify, or export on our end. All statutory rights of deletion and access can be exercised directly by managing, exporting, or clearing the data stored locally on your device as detailed in Section 6.

 

10. Modifications to This Policy

We may update this Privacy Policy periodically to reflect enhancements, new features, or statutory regulatory adjustments. Whenever updates occur, the updated text will be published directly on this web page with a revised "Last Updated" date at the top.

 

11. Developer Contact Information

If you have questions, inquiries, or feedback regarding this Privacy Policy or the technical architecture of our Applications, please reach out to:

 

Developer / Publisher: CyberKhan8 Consulting LLC

Website: CyberKhan8.com

Email Support: developer@cyberkhan8.com