Nightly early access. Nightly builds only for now.
Hexbot

Legal ยท Hexbot

Privacy Policy

Hexbot is built so that your data stays on your hardware. This policy explains the small amount that this website and Hex Connect handle, and the much larger amount they never see.

Effective
25 September 2026
Last updated
25 September 2026

The short version

  • Your conversations, bot memory, files, and provider keys live on the machine that runs your daemon. Neither this website nor Connect can read them.
  • This website and Connect measure how they are used with PostHog, only after you press Accept in the cookie notice.
  • Connect stores your sign-in identity, the daemons you register, and the devices and browsers you sign in with. It uses them only to run the service.
  • We do not sell personal data, show advertising, or use anything of yours to train models.
  • You can delete your Connect account and everything tied to it by emailing us.

Who is responsible

The Hexbot team, reachable at lumora.studio@hotmail.com, is the controller of the personal data described in this policy. If you run your own Connect instance or your own daemon for other people, you are the controller of what those systems hold, and this policy does not cover them.

This website

hexbot.app uses PostHog to count visitors and downloads, to see how people use the site, and to notice when pages are slow or break. PostHog loads only if you choose Accept in the cookie notice. If you do, it keeps a random ID in a first-party cookie and your browser's local storage and records:

  • the pages you view, the links and buttons you click, and which build you download;
  • your browser, operating system, screen size, and the site that referred you;
  • your approximate location, derived from your IP address, which PostHog then discards;
  • page load timings (Core Web Vitals) and any script error on the page;
  • a recording of your visit, with anything you type into a field hidden before it leaves your browser.

The legal basis is your consent. If you decline, nothing loads and nothing is sent; your browser keeps only a note of your choice so the notice does not ask again. You can change your answer with Cookies at the foot of any page. The pairing page loads no analytics at all, because its address carries a pairing code; browsers do not send the part after # to any server, and the page does not store it.

The contact form is hosted by Youform. What you enter there, including any file you attach, goes to Youform, which stores it for us. We use it only to reply to you and improve Hexbot.

The site is hosted by Vercel, which keeps short-lived request logs (IP address, user agent, URL) to run and protect its network.

Hex Connect

Connect, the optional service at connect.hexbot.app, brokers your identity and a hostname so that your own devices can reach your own daemon from outside its network. To do that it stores:

Your sign-in identity
Sign-in is handled by Clerk, which holds your email address, your name if you give one, and any sign-in method you choose (a password, a passkey, or a Google or GitHub account). Connect keeps only the Clerk user ID that links your account to your daemons.
Registered daemons
The name you gave each daemon, its assigned hostname, its Cloudflare tunnel ID, the port it reports, a hash of its service token, and when it was created, last seen, and revoked. A daemon checks in every five minutes so Connect can show whether it is online.
Apps that signed in
The device name each Hexbot app reported when it signed in with your account, a hash of its session token, and when it was created, last used, and revoked.
Browser sign-ins
When you open a daemon in a browser, Connect records a short-lived, single-use sign-in code together with a device label made from your browser and operating system, such as "Safari on iPhone". The code expires within five minutes. The label is passed to your daemon, which lists it under Devices so you can revoke it there.
Pending registrations
The short-lived codes shown by hexbot connect while you approve a daemon. They expire within ten minutes.

Connect uses these records to list your daemons, show whether they are online, issue login grants, and let you revoke access. It does not use them for advertising or profiling, and it does not sell or share them.

Connect measures its own use with PostHog under the same consent rule as this website: nothing loads until you press Accept. With your consent it records page views, clicks, page timings, script errors, session recordings with inputs hidden, and a handful of product events (a daemon approved, an app authorised, a daemon opened in a browser, a daemon or device revoked), tied to your Connect account ID so we can see how the service is used per account. Decline, and Connect works exactly the same without any of it.

Connect runs on Vercel, which keeps short-lived request logs to operate its network. Requests that Hexbot daemons and apps make to the Connect API carry a bearer token; Connect stores only a hash of every token, never the token itself.

What Connect never receives

Connect never receives your conversations, bot memory, provider keys, files, tool results, or the long-lived device tokens your daemon issues. Chat traffic travels from your device through Cloudflare's edge and the tunnel process on your daemon host. The Connect service is not in that path and cannot read it. Cloudflare decrypts the traffic at its edge to route it through the tunnel, so Cloudflare can see it, and applies its own privacy policy to what it sees. LAN pairing and Tailscale do not pass through Cloudflare.

The app and the daemon

The Hexbot app talks only to the daemon you pair with, to your chosen model providers, and to Connect if you sign in to it. What a bot sends to a model provider is governed by that provider's terms and privacy policy, as with any AI application.

Crash reporting is off by default. If you turn it on in Settings, Electron may upload a crash report when the desktop process crashes, as described in Updates. Update checks fetch a small manifest from updates.hexbot.app and send nothing about you. The app and the daemon send nothing to PostHog.

Service providers

These companies process data on our behalf, under their own data processing terms, and see only what is listed:

  • Clerk (sign-in): your email address, name, sign-in methods, and sign-in activity.
  • Cloudflare (tunnels and DNS): hostnames, tunnel identifiers, and the traffic passing through your daemon's tunnel, which Cloudflare decrypts at its edge.
  • Neon (database): the Connect records described above.
  • Vercel (hosting): request logs for this website and Connect.
  • PostHog (analytics): the usage data described above, only with your consent.
  • Youform (contact form): what you send us through the form.
  • GitHub (source code and downloads): standard access logs when you visit our repository or download a release from it.

We do not share personal data with anyone else, except when the law requires it or to protect the services and their users.

Why we may process your data

Where data protection law asks for a legal basis, ours are: performing our agreement with you for the Connect account and records that make the service work; your consent for analytics, which you can withdraw at any time; and our legitimate interests in keeping the services secure, answering your messages, and defending legal claims, which we balance against your rights.

Where your data is stored

Connect's database and PostHog's servers are in the United States, and Clerk, Cloudflare, and Vercel operate worldwide. If you are in the European Economic Area, the United Kingdom, or another place with data transfer rules, your data is transferred under those providers' data processing agreements, which include the EU Standard Contractual Clauses or an equivalent approved mechanism.

How long we keep things

  • Daemon and device records stay while they are registered. Revoking a daemon or device marks it revoked and deletes its tunnel; the record is deleted within 90 days after that.
  • Pending registration codes and browser sign-in codes are deleted within a day of expiring.
  • PostHog keeps events for up to a year and session recordings for up to 30 days.
  • Hosting request logs are kept by Vercel for a short period set by Vercel.
  • Emails and contact form messages are kept for as long as needed to help you and for up to two years after.

Your rights and choices

Depending on where you live you may have the right to access the personal data we hold about you, to have it corrected or deleted, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent. To use any of these rights, email lumora.studio@hotmail.com from the address you signed in with. We answer within 30 days.

To delete your Connect account and every record tied to it, revoke your daemons at connect.hexbot.app or run hexbot connect disconnect on each, then email us; we remove the account from Clerk and our database within 30 days. Analytics consent is withdrawn with the Cookies link at the foot of any page. If you think we have handled your data wrongly, you can complain to the data protection authority where you live; we would appreciate the chance to fix it first.

Children

Connect is not for anyone under 16, or under the age of digital consent where they live if that is higher. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.

Security

Tokens are stored only as hashes. Login grants are short-lived and single-use, browser sign-ins use proof-key exchange between your daemon and Connect, and every connection uses TLS. The Security Policy describes the design and how to report a vulnerability.

Changes

We may update this policy. The dates at the top tell you when, and material changes will be announced on this site before they take effect.

Contact

Send questions to lumora.studio@hotmail.com or use the contact form.