Privacy.
What Hydrant stores, who else touches it, how long it stays and how to get it removed. No advertising trackers. Your card number never reaches us.
What Hydrant stores
An account can sign in with GitHub, with a six-digit code sent to its email address, or both. Signing in with GitHub supplies account identity, name, email and profile image information. Signing in with a code proves you control the email address; you give your name yourself. Authentication records include sessions, the sign-in methods on your account, provider-account identifiers, encrypted OAuth tokens when supplied, and session security information such as IP address and browser details. Sign-in codes are stored only as hashes and expire after 10 minutes. The counters that limit how many codes can be sent or guessed are keyed hashes, never your address or IP address.
If your account has no photo, Hydrant’s server asks Gravatar once, when you first choose your name, whether your email address has one. It sends only a SHA-256 hash of the address, never the address itself, and only ever for your own account. After that it asks again only when you press Use my Gravatar in Settings › Account. A photo it finds is copied into Hydrant and stored like one you uploaded; no page loads anything from Gravatar. Hydrant keeps when it last looked, not the hash.
Hydrant stores the work you add: workspaces, issues, descriptions, comments, images, labels, relationships, instructions, review and approval answers, dockets and their briefs, releases, the issues you follow, activity and agent-credential records. If a workspace connects GitHub repositories, Hydrant also stores the connecting person’s GitHub user number, the repositories they could read at that moment, which of them are connected and, for pull requests that mention an issue, their title, number, link, author’s GitHub username, branch names, state, review states, commit identifiers and readiness observations, including check names, providers, states, links and counts. If the workspace turns on environment detection, Hydrant also records which branches those commits have reached. Check logs and output are not kept. Pull request descriptions are read to find those mentions and are not kept. Accounts that start the Solo Pro trial store when it started and when it ends, plus a keyed hash of the email address (ignoring +tags and Gmail dots), so each address gets one trial. Paid accounts also store the plan, billing status, whether the subscription is set to end and when, and the Stripe customer/subscription identifiers needed to enforce your entitlements; Stripe holds your card details, which never reach Hydrant. If you give Stripe a reason when you cancel, Hydrant keeps that reason and any comment you wrote, counts reasons only in aggregate and deletes them with your account.
When you create your first workspace, Hydrant asks three optional questions: which agents you use, how you heard about Hydrant (with your own words if you pick Other) and who works there. Your answers about agents and how you heard stay with your account and are asked once. Hydrant uses the agents answer to preselect your client in Settings › Agents and counts answers only in aggregate; other members never see them. Who works there is stored with that workspace.
When a plan limit stops something you try to add, Hydrant records which limit, the plan and when, against the account whose plan applies, and counts these only in aggregate.
Where the data goes
Cloudflare provides application hosting, database connectivity and image/backup storage. Neon provides the PostgreSQL database. GitHub supplies sign-in for accounts that use it, optional repository connections for pull request links, and the CI workflows used for deployments and encrypted backups. Gravatar receives a SHA-256 hash of an account’s own email address when Hydrant looks up a profile photo: once automatically for an account with no photo, then only when its owner presses Use my Gravatar. Stripe processes payments and billing for paid plans. TypeSafe runs the Jev model behind Hydrant’s suggestions while you or an agent you connected capture an issue, and behind Describe it in the issue list’s Filter menu. Each request carries only what that suggestion needs from the same workspace: the draft’s title and description and, for some suggestions, workspace context: label or project names and summaries, or the titles and short excerpts of existing issues. Today it suggests a size in quick capture from the draft alone; labels from the draft, the workspace’s label names and up to three recent issue titles per label; and possible duplicates from the draft and the titles and short excerpts of up to 60 existing issues, in quick capture or when a connected agent checks before filing. Describe it sends the words you type with the workspace’s status, priority, project, milestone, cycle and label names, and suggests filters from them. Hydrant replaces the names of people in your workspace that it recognises in your description; anything else you type, including a name it doesn’t recognise, goes as written. The description isn’t stored. Suggestions change nothing until someone chooses one. An independent copy of encrypted backups is retained on the operator’s Mac for recovery.
Agents you authorize can access data within their credential scope. What their provider does with that information depends on the agent and provider you choose. External content previews load only when requested and may contact that content’s host.
History, Trash and backups
Activity and revisions preserve past changes. Moving an issue to Trash retains its content; it does not erase the issue. You can delete your account yourself from Settings once you own no workspaces, including ones scheduled for deletion. Deletion is immediate: your name and email are replaced, your image is removed, your sign-in methods (a GitHub link, email codes or both), sessions, personal views and records of accepted policies are deleted, and your agent keys and connections are revoked. Your contributions stay in their workspaces attributed to “Deleted account”. Your signup attribution and first-run answers are cleared and product analytics stop. If the account ever started the Solo Pro trial, the keyed hash of its email address stays, so the same address cannot start a second trial; the address itself is not kept. Previously delivered PostHog usage events may remain under your opaque account identifier; self-service deletion does not erase those provider records. Contact bots@hydrant.dev to request their deletion. Preferences stored in your own browser stay there until you clear them. Encrypted backups taken before the deletion still contain your account until they expire under the backup retention described below.
Encrypted backups retain recovery snapshots separately from the live application. The configured cloud policy retains the newest available snapshot for up to seven daily dates and four weekly periods; independent verified copies are retained separately.
Data handling in detail
Hydrant runs on Cloudflare, with its database at Neon in the United States (AWS us-east-2) and images and encrypted backups in Cloudflare R2 in eastern North America. GitHub processes GitHub sign-in, Resend sends email including sign-in codes, and Better Stack and Sentry process uptime and error data. Sign-in codes expire after 10 minutes. Sessions expire after seven days. Unlinked images stop working after 24 hours; their stored copies can remain until the scheduled image sweep removes them, which production keeps off until it is separately authorized (images left over in the editor are also cleared in batches when someone adds another). Backups keep seven daily and four weekly snapshots, and error reports are kept for 30 days. Deleted workspace content is permanently purged after its seven-day cancellation window; a deletion record is retained. Trashed issues are purged 30 days after trashing. Email delivery evidence is minimized after 90 days once that scheduled job is enabled; production keeps it off until it is separately authorized. You can ask for access, correction, export or deletion of your data and get a response within 30 days. If a breach affects your account, you will be notified within 72 hours of confirmation.
Questions and requests
Hydrant is operated by Background Craft LLC. Contact bots@hydrant.dev for questions about your data or to request access, correction or deletion; you will get a response within 30 days. Do not send credentials or sensitive workspace content in an initial email.
Change history19 entries
- Version 9
Added Describe it, which suggests issue filters from words you type in the Filter menu. TypeSafe receives your description with the workspace’s status, priority, project, milestone, cycle and label names. Hydrant replaces the names of people in your workspace that it recognises in your description; anything else you type, including a name it doesn’t recognise, goes as written. The description isn’t stored.
- Editorial
Agents you connect can also ask which open issues in a workspace look like duplicates of each other. Each open issue goes in the same short form quick capture already sends for existing issues: its number, its title and the first 300 characters of its description. That was already covered, so there is nothing new to accept.
- Editorial
When you cancel a paid plan, Stripe’s portal may ask why, and you can skip it. If you answer, Hydrant keeps the reason you picked and any comment you wrote, counts reasons only in aggregate, and deletes them with your account. You choose whether to give one, so there is nothing new to accept.
- Version 8
You can now sign in with a six-digit code sent to your email address as well as with GitHub, and one account can hold both. Added what a code sign-in stores, the one-time Gravatar photo lookup, and the keyed hash of your email address that limits the Solo Pro trial to one per address and is kept after you delete your account.
- Editorial
Lists work that was already stored but not named: review and approval answers, dockets and their briefs, releases, and the issues you follow, and which environment branches a pull request’s commits have reached when environment detection is on. Nothing new is collected, so there is nothing new to accept.
- Editorial
Accounts that start the Solo Pro trial store when it started and when it ends. It is plan information Hydrant keeps itself, so there is nothing new to accept.
- Editorial
Hydrant records when a plan limit stops something you try to add, and counts these only in aggregate. It is a record Hydrant keeps itself, like the first-run answers, so there is nothing new to accept.
- Editorial
Agents you connect can ask for the same possible-duplicate suggestions before they file an issue. It sends the same things as quick capture, so there is nothing new to accept.
- Editorial
TypeSafe also suggests possible duplicates in quick capture, from the draft and the titles and short excerpts of existing issues. That was already covered, so there is nothing new to accept.
- Version 7
TypeSafe now also suggests labels, and can receive workspace context beyond your draft for suggestions that need it: label names and recent issue titles today, and project names or existing issues for suggestions of that kind.
- Version 6
Added TypeSafe, which reads the title and description of an issue you are drafting in quick capture to suggest a size.
- Editorial
Lists the optional answers from the first-run welcome: which agents you use, how you heard about Hydrant and who works in your first workspace.
- Editorial
Describes the optional, read-only GitHub repository connection and the pull request details it stores.
- Editorial
Says plainly that the 30-day Trash purge is running, and when an unlinked image’s stored copy is actually removed.
- Version 5
Added how long Trash and email delivery records are kept.
- Version 4
Added optional signed-in product analytics through PostHog, how to turn it off, and that it uses no cookies or browser storage.
- Version 3
A deleted workspace’s content is permanently purged after its seven-day cancellation window.
- Version 2
You can delete your account yourself from Settings.
- Version 1
First adopted version, for paid sign-up. Added Stripe as the payment processor and the billing records Hydrant keeps.