Guide
Privacy Policy
Draft under legal review
This text is not in force yet and may still change. Highlighted brackets mark points that are still open.
- Version: 0.1 (draft)
- Date: 2026-10-14
- Applies from: [[PLACEHOLDER: effective date]]
1. Who is responsible
[[PLACEHOLDER: legal entity name, address]] ("hyad", "we") is the controller for the personal
data described here: your hyad account and everything needed to sign you in, to the platform
and to apps hosted on it. Contact: support@hyad.app. We have not appointed a data protection officer, because Art. 37
GDPR does not require one for our processing.
What this policy does not cover: the data that belongs to an app hosted on hyad. That includes who may use the app (its access list, roles and invitations, also an email address an owner enters before that person has an account) and whatever the app stores or processes (for example what you type into someone's app, or what it keeps in its database or files). The owner of that app is responsible for it, and hyad only processes it on the owner's behalf under our DPA. Ask the app's owner about it.
2. What we collect, why, and on what legal basis
| Data | Where it comes from | Why | Legal basis (GDPR Art. 6(1)) |
|---|---|---|---|
| Account: name, email address and whether it is confirmed; profile picture link (Google or GitHub sign-in); password (stored only as a salted scrypt hash); the GitHub or Google account id you signed in with. We do not keep the access or refresh tokens GitHub or Google return at sign-in: we use them once to read your profile | You; Google or GitHub when you choose them | Creating and running your account, signing you in | (b) contract |
| Passkeys: public key, credential id, name you gave it, device type, whether it is synced, authenticator model id (AAGUID), date added | Your device | Passkey sign-in and admin confirmation | (b) contract |
| Sessions: session ids, start and expiry, the IP address and browser (user agent) of each sign-in; sign-ins of AI tools you connect (MCP clients, their consents and tokens) | Your browser or tool | Keeping you signed in, letting you see and end sessions and connected tools, security | (b) contract; (f) security |
| Security and abuse prevention: IP addresses in short-lived rate-limit counters; a keyed hash of your IP address and your email domain in daily sign-up counters; a Cloudflare Turnstile check on sign-up and password reset; a check of new passwords against known breached passwords (only the first 5 characters of a hash of the password leave our servers); a check against a list of disposable email domains | Your request | Preventing fake accounts, spam, password attacks and abuse of the free plan | (f) legitimate interest in a safe service |
| Your apps: app names, settings, versions, environment variables (encrypted), custom domains, source code | You and your AI tools | Hosting your apps | (b) contract |
| Audit log: who (user id) did what (for example deploy, delete, change access, add a passkey, admin actions) to what, and when | Generated by hyad | Security, investigating abuse, resolving disputes | (f) legitimate interest |
| Usage metering: counts per account and app per hour (requests, server CPU time, database writes, AI tool calls, storage) | Generated by hyad | Enforcing plan limits, billing, showing you your usage | (b) contract |
| Billing: Stripe customer id, currency, credit purchases and their payment ids, credit balance and history, refunds and disputes (amount, reason, status). Stripe collects your card details, billing address and VAT id; we do not receive full card numbers | You, via Stripe | Selling credits, tax and accounting | (b) contract; (c) legal obligation (tax records) |
| Emails we send: confirm your address, reset your password, security alerts (for example a passkey added), notices about limits, holds, expiry of promotional credits, payments and custom domains; delivery status | Generated by hyad | Running your account | (b) contract; (f) security alerts |
| Support and feedback: what you or your AI tool send us (feedback messages with your email address and the tool's name; emails to support) | You | Answering you, improving hyad | (f) legitimate interest |
| Abuse reports: what you write in a report, and your name and email address if you give them | You | Handling the report and telling you the outcome | (c) legal obligation (DSA Art. 16); (f) a safe service |
| Preferences: how you want your AI assistant to talk to you (developer or beginner mode) | You | Personalising the service as you asked | (b) contract |
| Server logs: technical logs of our own platform services (for example request time, address, status, errors) [[CHECK: whether Cloudflare Workers Logs record the client IP and headers]] | Your request | Running and fixing the service | (f) legitimate interest |
You must give us your email address and a sign-in method to have an account. Everything else you can choose not to give, with the effect that the related feature does not work.
No advertising, no tracking. hyad has no analytics or advertising cookies, does not sell personal data, and does not build profiles for marketing. Our anonymous usage statistics (Cloudflare Analytics Engine) contain only app name, request type, outcome, status and size: no IP addresses, paths or user ids.
Automated decisions. Sign-ups from disposable email domains, or above the per-network or
per-domain daily limits, are refused automatically; plan limits pause apps automatically. If
such a decision affects you, write to support@hyad.app: a person will review
it, you can give your view, and you can contest the decision.
3. Signing in to apps on hyad
hyad uses one account for the platform and for the apps it hosts. When you sign in to an app, we give that app's owner (and the app's code) your hyad user id, your email address and your role in that app, and we keep a session cookie on that app's address. The app's sign-in screen tells you this before you continue. We do this to provide the sign-in you asked for (Art. 6(1)(b) GDPR). From that point, the app owner decides what happens with your data in their app.
Who may use an app (its access list, roles and invitations) is decided by the app's owner; hyad keeps that list for the owner as a processor (section 1).
Push notifications. If you allow an app on hyad to send you notifications, we store, for that app's owner and as their processor (section 1), your browser's push subscription (the address of your browser's push service and the keys to encrypt messages to it), your hyad user id, the page address you subscribed on, the topics you chose and your browser's time zone, and when a notification last reached you. Notifications an app schedules (their text, link, data, time and recipients) are stored until they are sent or cancelled; a repeating one as long as it repeats. To deliver a notification we send it, encrypted, to your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser). We keep no history of the messages sent. Your subscriptions are deleted when you unsubscribe or sign out in that app, when the push service says the subscription has ended, when the app or your account is deleted, and in any case after 90 days in which no notification reached you. An app's data export lists your subscriptions without their push address and keys.
4. Who receives your data
We use these service providers (processors), bound by data processing terms:
| Provider | What for | Location and safeguard |
|---|---|---|
| Cloudflare, Inc. | Hosting of all of hyad: servers, databases, file storage, sending email, Turnstile, logs, DNS | App databases, files and account data are stored at rest in Cloudflare data centres in the EU; requests are handled worldwide at Cloudflare's network edge [[CHECK: lawyer: exact location wording]]. US company: EU-US Data Privacy Framework [[CHECK]] and Standard Contractual Clauses |
| Stripe ([[CHECK: Stripe Payments Europe Ltd., Ireland]]) | Payments, tax calculation, receipts | EU, and US for some processing (DPF / SCCs) [[CHECK]]. Stripe is also a controller for its own fraud prevention and legal duties (Stripe privacy policy) |
| Google ([[CHECK: Google Ireland Ltd. / Google LLC]]) | Sign in with Google; our support inbox (emails to support@hyad.app are forwarded to a Google mailbox) |
DPF / SCCs [[CHECK]] |
| GitHub, Inc. | Sign in with GitHub; hosting each app's private source repository | US: DPF / SCCs [[CHECK]] |
| [[CHECK: Have I Been Pwned (Pwned Passwords API)]] | Breached-password check; receives only a 5-character hash prefix, which is not personal data | — |
We also share data when the law requires it (for example with tax authorities or on a valid order), and with the owner of an app you sign in to (section 3).
5. How long we keep data
| Data | Kept |
|---|---|
| Account, passkeys, preferences | Until you close your account: deleted 30 days after you ask (you can cancel until then) |
| The record that an account was closed (account id, dates, what was deleted as counts, a refund owed) | 2 years after the deletion, like the audit log |
| Sessions (with IP address and browser) | 30 days from the last refresh; deleted 7 days after they expire |
| Rate-limit and sign-up counters | Minutes to one day |
| Apps, their files and databases | Until you delete the app or close your account. Backup copies of files: 30 days after a file is changed or deleted (also when the app is deleted). Database recovery points: 30 days [[CHECK: whether Cloudflare's point-in-time recovery keeps data after a database is wiped]] |
| App source repositories | Archived for 30 days after the app is deleted, so an accidental deletion can be undone; then permanently deleted |
| Audit log | 2 years; entries about payments, refunds and disputes 7 years |
| Billing records: credit purchases, refunds, invoices, and the usage metering that backs credit deductions | 7 years (Dutch tax law, Art. 52 AWR) [[CHECK]] |
| Other usage metering (that backs no credit deduction, for example on Free) | 1 year |
| Notices we emailed, feedback, support emails, abuse reports | 1 year (abuse reports: 1 year after the decision) [[CHECK: support emails live in the support mailbox (Gmail) and are deleted by hand]] |
| Push notification subscriptions of apps (section 3) | Until you unsubscribe or the app or your account is deleted; at most 90 days after the last notification that reached you (or after subscribing, if none did) |
| Scheduled push notifications of apps | Until sent or cancelled (a repeating one: as long as it repeats). No history of sent messages is kept |
| Appeals against our moderation decisions (what you wrote, the decision you appealed, our outcome and reasons) | 1 year after we decided on the appeal; an appeal we have not decided yet is kept until we have |
| Platform logs at Cloudflare | [[CHECK: Workers Logs retention, e.g. 7 days]] |
6. Your rights
You can ask us for access to your data, a copy in a portable format, correction, deletion,
restriction, and you can object to processing based on legitimate interest. Write to
support@hyad.app. We answer within one month. We may ask you to confirm your
identity, for example by writing from your account's email address.
To delete your account and its data (erasure), you do not need to write: in the portal, open Settings, "Delete account". We confirm by email. Your account is locked at once and deleted, with its apps and their data, 30 days later; until then you can cancel with the link in that email or by signing in. What we keep after that, and why, is in section 5 (for example invoices and payment records, which the law requires).
You can also complain to a data protection authority, in particular in the EU country where you live or work. Ours is [[PLACEHOLDER: lead supervisory authority, e.g. Autoriteit Persoonsgegevens, the Netherlands]].
7. Security
Among other measures: all traffic over HTTPS; passwords hashed; environment variables encrypted at rest; sign-in cookies limited to their own host; rate limits on sign-in; admin changes require a passkey confirmation and are audited.
8. Cookies and similar technologies
hyad uses only cookies and similar technologies (browser storage, and Cloudflare Turnstile's bot check on the sign-up and password reset pages) that are needed to sign you in and keep hyad secure. The Cookie Notice lists each of them.
9. Children
hyad is not meant for children under 16.
10. Changes
We announce material changes by email before they take effect. The date at the top shows the current version.