Privacy Policy
1. Who operates this service
This instance of Hydra is operated by [OWNER TO COMPLETE] ("we", "the operator"). Hydra is open-source software; each deployment is run by its own operator, who is the data controller for the personal data processed on it. Contact: [OWNER TO COMPLETE].
2. Effective date and version history
Version 1.0 (draft) — 9 October 2026 — first version, written for Hydra v29. Version 1.1 (draft) — 16 October 2026 — corrected for Hydra v39: Mission Control data, published sites, what the audit trail records about accounts, how long temporary chats and rate-limit counters can be kept, when DuckDuckGo is used. Changes to this policy are listed here and in the site's CHANGELOG.md.
3. What we collect
Information you give us
- Account: email address, display name, a salted password hash (scrypt). Never your plain password.
- Subscription: if you subscribe, your Stripe customer and subscription identifiers, the subscription's status and the end of the paid period. Card details are entered on Stripe's own page and never reach Hydra.
- Settings: custom instructions, memory entries you allow the assistant to keep, privacy choices (blocked providers, memory on/off), connected apps and custom API tools, and — only if you add them — your own AI provider API keys and connector tokens, stored encrypted (AES-256-GCM) with a server-side secret.
- Conversations: messages, uploaded files (images, PDFs, text, spreadsheets), generated images/videos (as links), built websites, project and agent definitions, scheduled tasks — for signed-in accounts these are stored so they sync between devices. Guests' chats stay in their own browser.
- Missions (Mission Control): the objective you give, the plan, your steering notes, every step's output, the deliverable files and the activity log.
Information collected automatically
- Technical: IP address (used for rate limiting and abuse prevention, kept in short-lived counters; for the free preview, a count of previews per network per day keyed by a one-way hash of the address, kept 2 days), request logs held by the hosting platform (Netlify) under its own retention, browser type as sent in requests.
- Usage records: estimated spend and request counts per account per day/month — totals only, no message content.
- Audit trail: administrative actions (who paused the site, changed a budget, suspended an account) with the acting admin's email and IP, and these events on your own account with your email and IP address: sign-up, password change, password reset, "sign out everywhere" and account deletion.
We do not use advertising trackers or third-party analytics. See the Cookie Policy.
4. Why we process it (purposes)
- To provide the service: your messages must be sent to an AI model to be answered.
- To keep your account secure and sync your data between devices.
- To protect the operator from abuse and runaway cost: rate limits, spend budgets, sign-up rules, emergency pause.
- To honour your choices: memory, blocked providers, temporary chats, deletion.
5. Legal bases (UK GDPR / EU GDPR)
[OWNER TO COMPLETE] — typically: performance of a contract (providing the service you signed up for), legitimate interests (security, abuse prevention, cost control), and consent (optional memory, optional connectors). The operator must confirm these with legal advice.
6. AI providers and international transfers
To answer you, Hydra sends the content of the conversation (your messages, attachments you included, relevant memories and custom instructions) to the AI provider you or the operator selected: Anthropic, OpenAI, Google, xAI, DeepSeek, Mistral, Perplexity, Groq, Together AI, OpenRouter (which routes to further providers), any OpenAI-compatible server configured by the operator, Higgsfield (images/video), and OpenAI (read-aloud speech). When the site uses the Netlify AI Gateway, requests to Anthropic, OpenAI, Google and OpenRouter pass through Netlify's gateway. Web search uses DuckDuckGo, or Brave Search / Tavily if the operator configured them. Pages the assistant opens are fetched by the server. Connected apps (MCP connectors, custom APIs) receive only what the assistant sends them when you use that tool. A site you publish from Build is uploaded to Netlify (with your own Netlify token, or the operator's if one is configured) and is public at its address until it is deleted there.
Each provider processes your content under its own terms and may be located outside the UK/EEA. We do not claim that providers retain nothing or never train on inputs; their current API terms govern. Operators should link the terms they rely on here: [OWNER TO COMPLETE]. You can block any provider for your account under Settings → Account & privacy; a blocked provider receives nothing from you.
7. Training
Hydra itself does not train any model and does not use your conversations for training, analytics or advertising. Whether a third-party provider uses API inputs for training depends on that provider's terms and the operator's account settings there — see section 6.
8. Retention
| Data | Kept |
|---|---|
| Account record | Until you delete the account |
| Conversations, projects, agents, tasks, settings, memories | Until you delete them or the account |
| Temporary chats | Never saved to your account, history or memory; the browser discards them when closed (the AI provider still processed the messages). If a temporary chat uses a long-running mode, its answer is kept on the server like any background answer (next row) |
| Background answers (Deep Think, Fusion, Compare and Think) | Up to 24 hours, so a closed tab can collect the result |
| Missions | Until you delete them or the account |
| Shared links | Until you remove them (Settings → Account & privacy) or delete the account |
| Rate-limit counters | Minutes to 2 days |
| Spending records | Daily and monthly totals, indefinitely (no content) |
| Audit trail (admin actions, and the account events listed in section 3 with email and IP) | Indefinitely, including after the account is deleted [OWNER TO COMPLETE] confirm or set a retention period |
| Hosting-platform logs and backups (Netlify) | Per Netlify's retention — [OWNER TO COMPLETE] confirm current period |
9. Your controls
Memory on/off, review, edit and delete; temporary chats; blocked providers; shared-link management; export of all chats (JSON); deletion of individual chats, everything on a device, or the whole account — all in the app. Details on the Data Controls page.
10. Access, export and deletion
Export: Settings → Data → "Export all chats". Deletion: Settings → Account & privacy → "Delete my account" removes the account, chats, projects, agents, missions, scheduled tasks, settings (including stored keys), memories, background answers and shared links immediately from active storage (spending totals and audit entries are kept, see section 8; published sites stay on Netlify until deleted there). Copies may persist in the hosting platform's backups for its retention period. You can also write to [OWNER TO COMPLETE].
11. Security
Transport encryption (HTTPS) everywhere; passwords hashed with scrypt; stored API keys and connector tokens encrypted at rest; signed, expiring, HttpOnly session cookies that can be revoked; server-side authorisation for every action; rate limits and spend budgets; an audited admin role. The server must decrypt your messages to send them to AI providers, so this is not end-to-end encryption. No system is perfectly secure; see the Security Overview for what is and isn't in place.
12. Service providers (subprocessors)
- Netlify (hosting, serverless functions, blob storage, optional AI Gateway) — [OWNER TO COMPLETE] region/plan
- AI providers listed in section 6, as used
- Search: Brave Search or Tavily when the operator configured them; DuckDuckGo otherwise, and when the paid search budget is used up
- Pyodide (Python in the browser) loaded from the jsDelivr CDN by the browser, only when you run Python code
- Stripe (payments for the subscription: checkout, billing, the customer portal), only if you subscribe — see stripe.com/privacy
13. Cookies
One strictly necessary session cookie; preferences in browser storage. No tracking cookies. See the Cookie Policy.
14. Children
The service is not intended for anyone under [OWNER TO COMPLETE] (at least 13; 16 or 18 in some jurisdictions). We do not knowingly collect children's data; contact us to remove it.
15. Security incidents
If we become aware of a breach affecting your personal data we will notify affected users and, where required, the regulator, within the legally required period. [OWNER TO COMPLETE] describe the notification channel.
16. Legal requests
We disclose data to authorities only when legally compelled, and will tell you unless prohibited. [OWNER TO COMPLETE]
17. Your rights
Under UK GDPR / EU GDPR you may have rights of access, rectification, erasure, restriction, portability, objection, and to withdraw consent, and to complain to a regulator (UK: the Information Commissioner's Office, ico.org.uk; EU: your national authority). To exercise them, use the in-app controls or contact [OWNER TO COMPLETE].
18. Changes
Material changes will be announced in the app and recorded in the version history above.