Where the water goes.

Who processes your data and where

Cloudflare hosts the application on its global network and stores images and encrypted backups in R2 in its eastern North America region. Neon runs the PostgreSQL database in the United States (AWS us-east-2). GitHub provides sign-in for accounts that use it, optional repository connections for pull request links, deployment and the scheduled backup jobs. Resend sends email such as sign-in codes, invitations, notification digests and weekly recaps. Gravatar receives a SHA-256 hash of an account’s own email address when Hydrant looks up a profile photo: once automatically for an account with no photo, then only when its owner presses Use my Gravatar. Hydrant copies any photo it finds; no browser loads anything from Gravatar. Better Stack runs uptime checks and the public status page and sees only probe results. Sentry receives error reports that are scrubbed of personal data before they leave the app.

Stripe processes Solo Pro payments, subscriptions and tax through its checkout and customer portal. Card details go to Stripe directly and never reach Hydrant; Hydrant keeps the Stripe customer and subscription identifiers and the billing status needed to apply your plan.

PostHog processes limited signed-in usage events in its US region when analytics is enabled: page categories and workspace or issue creation, without issue content, names, email addresses or private URLs. PostHog processes the connection IP to receive events; IP storage and geographic enrichment are disabled. There are no data residency options.

TypeSafe runs the Jev model behind Hydrant’s capture suggestions and Describe it. A capture request carries the draft’s title and description as written and, only when a suggestion needs it, context from the same workspace: label or project names and summaries, or titles and short excerpts of existing issues. No account details such as names or email addresses are added. What ships today: a size in quick capture, from the draft alone, in workspaces that use sizing; labels in quick capture, from the draft, the label names and up to three recent untrashed issue titles per label; and possible duplicates, in quick capture or when a connected agent asks before filing an issue, from the draft (description cut at 1,500 characters) and up to 60 untrashed issues, each sent as its number, title and the first 300 characters of its description: those whose titles share the draft’s words, then the most recently updated open ones. Describe it, in the issue list’s Filter menu, sends the description, up to 300 characters, with the workspace’s status, priority, project, milestone, cycle and label names. Hydrant replaces the names of people in your workspace that it recognises in your description; anything else you type, including a name it doesn’t recognise, goes as written. The description isn’t stored, and each person can ask 60 times an hour. Answers come back as scores, and nothing changes until you click. TypeSafe states it does not train on customer requests or responses. It keeps request data as long as necessary, offers zero retention only to enterprise customers and does not state where requests are processed.

What is stored

Account records: your sign-in methods (a GitHub identity, email-code sign-in or both), name, email and profile image (uploaded, from GitHub or copied once from Gravatar), when Hydrant last looked up a Gravatar, sessions with IP address and browser details, and encrypted provider tokens. Sign-in codes: hashed, under a keyed hash of the address, until used or 10 minutes pass. Workspace content: issues, comments, activity, revisions, relationships, labels, views, projects, cycles, library and playbook documents, environments and promotions, approval and review answers, dockets and their briefs, releases and their notes, issue follows, and uploaded images. For connected GitHub repositories: pull request details, readiness observations and which branches their commits have reached. Credentials: hashed agent keys, hashed MCP tokens and the consents you grant. Billing records: plan, subscription status, whether the subscription is set to end and when, Stripe identifiers, the cancellation reason and any comment an owner gave Stripe while canceling, Solo Pro trial dates or a marker that the account predates the trial, and a keyed hash of each trial’s email address (ignoring +tags and Gmail dots). Operational records: email delivery status without message content, rate-limit counters (sign-in code counters are keyed hashes, never an address or IP address) and backup completion records.

When a plan limit stops something you try to add, Hydrant records which limit, the plan and when, against the account whose plan applies, and counts these only in aggregate.

Never stored: passwords for your account, card details, raw sign-in codes, raw agent keys or raw MCP tokens.

How long it is kept

Trashed issues: purged 30 days after trashing by a daily job. Activity and revisions: for the life of the workspace. Sessions: seven days, refreshed while you keep using Hydrant. Records of which Terms and Privacy versions you accepted: for the life of your account. Plan limit records: 13 months, and deleted with your account. Cancellation reasons and comments: for the life of your account, and deleted with it. Solo Pro trial records: for the life of your account. Trial-address hashes: kept after the account is deleted, because they are how one trial per email address is enforced. Sign-in codes: until used or 10 minutes pass; sign-in code counters: about a day, then a daily job deletes them. Deleted accounts: removed immediately when you delete your account, keeping an anonymous deletion record, your contributions under “Deleted account”, the trial-address hash if the account ever started the trial, and workspace records such as invitations that were sent to your email address. Unlinked uploaded images: unusable after 24 hours; the stored copy can remain until the scheduled image sweep removes it, which production keeps off until separately authorized. Images left over in the editor are also cleared in batches when someone adds another. Deleted workspaces: a seven-day cancellation window, then permanent purge of live workspace content; a deletion record is retained. Workspace exports: downloadable for seven days. Encrypted backups: the newest snapshot for each of the last seven days and four weeks, plus the operator’s independently verified copy. Email delivery records: minimized after 90 days when the scheduled retention job is enabled; production keeps it off until separately authorized. Error reports at Sentry: 30 days. Previously delivered PostHog usage events may remain under an opaque account identifier after account deletion; contact bots@hydrant.dev to request deletion of those provider records.

Your requests

You can ask for access to, correction of, export of or deletion of your data. Identity is verified by signing in to the account concerned with any of its sign-in methods; an email to us on its own is not proof. You will get a response within 30 days. You can delete your account yourself from Settings, and an Owner or Admin can export a whole workspace from Settings → General. The operator handles every other request by hand. Send requests to bots@hydrant.dev.

If something goes wrong

On a confirmed breach the operator preserves the evidence, contains it by rotating secrets and revoking affected credentials, notifies affected accounts within 72 hours of confirmation, notifies the relevant authority where EU or UK residents are affected, and records what happened.

Operator access

Production access is limited to the operator’s own accounts. No contractor or third party has access. Backup decryption keys are held outside the application and the cloud providers.