Featured Post

Running four AI models fully offline on a Nextion ONX3248G035

Image
A while back I unboxed a Nextion touchscreen dev board and vibe-coded a WiFi auditor onto it . That board has been sitting on my desk ever since, and one question kept nagging: this thing has 8 MB of PSRAM and a dual-core ESP32-S3. Could it run an actual language model? Not talk to one over WiFi — run one. Turns out: yes. Four of them, in fact. No internet, no server, no phone, no PC. Everything in this video is generated by the chip on the board. All four models, on the board, offline. Loading a model from the SD card, then generating. What is actually running The board boots into a menu. Tap a model, it loads and starts generating. All of these were trained from scratch on an M2 Max in well under an hour. Malayalam English Arithmetic Icons Parameters 7.6M 7.6M 1.0M 577K Flash 3.95 MB 3.95 MB 0.41 MB 0.58 MB Speed 13.0 tok/s 14.9 tok/s 20.7 tok/s 3.4 s/image First things first: this is not a Nextion HMI The ONX3248G035 is sold under Nextion branding, and the name is...
2 comments

Dhara — Privacy Policy

Effective date: 2026-06-25 — Last updated: 2026-06-26

This Privacy Policy describes how the Dhara app ("Dhara", "the app", "we") handles information when you use it on iOS or Android.

Plain English summary

  • Dhara runs a local HTTP server on your phone so other devices on your local network can download or upload files to a folder you choose.
  • All file transfers happen directly between your phone and the other devices on your local network. Nothing goes to our servers because we don't have any.
  • We do not collect your personal data, files, contacts, or location.
  • If you enable ads (free tier), Google AdMob receives your advertising identifier and minimal device info to serve ads.
  • If you purchase Pro features, Apple or Google handles the payment — we receive only your purchase entitlement, not your payment details.

1. Who runs Dhara

Dhara is published by h4hacks.

Contact: admin@h4hacks.com

2. What Dhara does and does not collect

Data Dhara collects on its own

None of its own. Dhara has no backend server, no analytics service, and no telemetry. The app does integrate Google Firebase Crashlytics for crash diagnostics — see below.

Crash diagnostics (Firebase Crashlytics)

If the app crashes, it sends a crash report to Google Firebase Crashlytics so we can fix bugs. Each report includes:

  • Stack trace and exception type for the crash
  • App version, OS version, and device model
  • A randomly generated Crashlytics installation ID (not your Apple ID, not your phone number, not your IDFA, not your email)
  • Timestamp of the crash and approximate country (from your IP, which Google then discards)

Crash reports do not include your file contents, file names, server URLs, passwords, contacts, or any other personal data. We use them only to triage and fix bugs. Reports are stored in our Firebase project and retained per Google's Firebase data processing terms.

Data that stays only on your device

  • The folder path you choose to share
  • Your server settings (port, password hash, allow-uploads / allow-downloads toggles, theme)
  • A short rolling log of recent file transfers for the in-app history view
  • A short rolling log of recently connected clients for the in-app clients view

All of the above lives only in the app's local storage on your device. It is never transmitted to us or to any third party. Uninstalling the app removes it.

Data shared with file transfer counterparties

  • When you serve a folder, anyone on your local network who knows the URL can read the names, sizes, and contents of the files in that folder.
  • If you enable uploads, they can also send files to your phone.
  • Setting an optional password requires anyone connecting to provide it.
  • Dhara does not encrypt traffic on your local network. We strongly recommend you do not run Dhara on public or untrusted networks.

Data shared with Apple or Google (only on purchase)

If you purchase Dhara Pro or Dhara Pro · No Ads, Apple's App Store or Google's Play Store processes your payment. We receive only a purchase confirmation token (no name, no email, no card details).

Data shared with Google AdMob (free tier only)

  • AdMob receives your device's advertising identifier (IDFA on iOS, AAID on Android), approximate location at the country level, device model and OS version, and the ad slots Dhara requests.
  • On iOS 14.5+, Dhara asks you for permission via the ATT prompt before sharing your IDFA. If you decline, AdMob still serves non-personalized ads.
  • See Google's privacy policy at https://policies.google.com/privacy.
  • If you purchase Dhara Pro · No Ads ($9.99), ads stop loading and AdMob receives nothing further.

Data Dhara does not collect

  • Your name, email, phone number, or any account credentials (Dhara has no accounts)
  • The contents of files you share
  • Your contacts, calendar, photos library, microphone, or camera
  • Your precise location
  • Analytics events (Dhara has no analytics SDK — crash diagnostics via Firebase Crashlytics are disclosed above)

3. Permissions Dhara requests

iOS

  • Local Network access (for the HTTP server)
  • Photos library (only if you share a photo via the share extension)
  • Tracking (only if you're on the free tier with ads enabled — you can decline)

Android

  • Internet access (for the HTTP server)
  • Foreground service (keeps the server running with a persistent notification)
  • Storage (only if you choose a folder outside the app's own directory)
  • Post notifications (for the foreground-service notification)

4. Children's privacy

Dhara is not directed at children under 13. We do not knowingly collect personal data from children.

5. Your rights

Since Dhara stores nothing about you on our servers, there's nothing for us to delete on your behalf. You can:

  • Delete all in-app data by uninstalling the app
  • Reset your ad ID via your device's system settings
  • Opt out of ad personalization by declining the iOS ATT prompt
  • Stop sharing your folder by tapping Stop
  • Toggle "Allow uploads" off in Settings

Questions: admin@h4hacks.com

6. Third-party services we use

  • Google AdMob — serves ads (free / $2.99 tiers only).
  • Apple App Store / StoreKit — processes purchases on iOS.
  • Google Play Billing — processes purchases on Android.

7. Changes to this policy

If we change anything material, we'll post a new version here with a new "Last updated" date.

8. Contact

admin@h4hacks.com

This policy applies to Dhara on iOS and Android, version 1.0.0 and later, distributed via the Apple App Store and Google Play Store.

Comments

Post a Comment

Popular posts from this blog

Qualys SSL labs API - A MultiThreaded python script to scan large number of servers and produce neat results

Hi Security enthusiast, So if you were following closely on recent developments regarding SSL/TLS security, you might have heard that Qualys SSL labs released an API to automate the testing of internet hosted applications with their awesome hosted testing solution. If you have not heard about it here is the location to their server testing page -  https://www.ssllabs.com/ssltest/ And their API documentation here -  https://github.com/ssllabs/ssllabs-scan/blob/master/ssllabs-api-docs.md So now that the API is released you can automate testing of any number of servers with any language that is able to talk with qualys server via HTTP protocol. My company wanted to test all of our servers with SSL labs, so i thought why can't i automate it with python or something. So here it is, i made a multithreaded python script to test a large number of servers in one go and get results in neat format that my management wanted :-) The script is intended for python 2.7 Yo...
Read more

Re-Post : How I managed to gain access to The Indian Digital treasure – 3 Billion documents on Digilocker

Image
 Hi Guys, This is a repost of the blog that was written on  https://yetanothersec.com/blog/2020/06/03/digilocker-disclosure/  as the yas portal is facing technical issues everynow and then. Also apologies for the bad quality of screen shots, i will find old files and update it later. D uring the beginning of May 2020, there was a large commotion about the arogyasetu app and its security after a so called “hack” by infamous political hacker named Elliot Alderson. In light of all this, we at the YAS (Yet Another Security) community, had some talks in our WhatsApp group. So, it turned out to be a discussion on techniques used for bypassing SSL pinning on the mobile apps. This whole discussion made be curious about other apps from India government and since I have worked on similar projects outside of India, digilocker caught my attention. Hence, I downloaded the app and installed on my test devices and fired up my favorite toolset burpsuite + Frida. I used my homebrewed pinn...
Read more

Fixing VMWARE tools on kali linux to enable copy paste properly - especially when you are doing OSCP

Hi Folks, So if you are playing around with kali linux on a VM you might have faced the issue of getting the vmware tools work properly. Especially when you want to copy paste files and clipboard contents between guest and host. This is very annoying thing and took lot of my precious time when i was doing OSCP course. Here is how i fixed it. My Setup I run a kali linux distro on vmware player which is recommended for doing the OSCP course. By default it has GNOME as the default GUI. I kind of hate it as it uses lot of resources and has all those stupid animations and stuff. I want something clean and precise when i am working, i am not into looks and too many features, just the bare minimum responsive system is always my favourite. So I installed LXDE which is light weight GUI for linux. you can install it with following command apt-get install lxde-core lxde kali-defaults kali-root-login desktop-base This will not make LXDE you default GUI, so if you reboot, you will n...
Read more