Privacy Policy

Last updated: October 3, 2026

Who we are

Hodos ("we") is the controller of the personal data described here. Contact: hello@usehodos.com.

The free scan

npx hodos-cli scan runs entirely on your computer and sends nothing to us or anyone else, including usage statistics. We receive no data from it.

What never leaves your device

Raw conversation text stays on your computer. Before anything is uploaded, the Hodos CLI drops tool output, file contents, code, commands, tool arguments, images, attachments, thinking blocks and file paths outside the project folder name. It then masks email addresses, API keys and tokens, home-directory paths and phone numbers in the remaining text.

What we process for Pro

AccountYour email address (confirmed by Google if you sign in with Google).

GoalsThe goals and milestones you write, and corrections you make to how work was attributed.

Segment text (transient)A compacted, masked version of each closed work segment: your prompts, the assistant's replies, tool names and timestamps. It is turned into a card by an LLM and then discarded. We do not store it.

Cards and factsA ~1KB card per segment, and facts: duration, message and edit counts, whether a test or build ran after edits, project folder name, commit repository name and short hash, hashed session identifiers, and timestamps.

ReportsThe "Current position" page and the reports we generate from your cards and facts.

BillingHandled by our payment provider, which acts as merchant of record. We receive your subscription status, not your card details.

We use this data only to provide Hodos: to make cards, show your current position, send reports and service emails, and manage your subscription. We do not sell it, use it for advertising, or use it to train AI models.

Processors

OpenAI — turns segments into cards and writes reports. Its API terms exclude training on API data.
Railway (United States) — runs the Hodos server.
Neon (United States) — the database that stores accounts, goals, cards, facts and reports.
Resend — sends login links, reports and service emails.
Google — only if you choose "Continue with Google": Google confirms your email address to us. We receive nothing else from your Google account.
Lemon Squeezy (merchant of record): checkout, card processing, sales tax and invoices.

Some processors are located outside your country, including in the United States.

Retention

Segment text: discarded as soon as its card is made.
Trial not converted to a paid plan: all server data is deleted 30 days after the trial ends.
Cancelled paid plan: Pro runs to the end of the paid period; all server data is deleted 30 days after that.
Account deletion: all server data is deleted immediately.
Billing records are kept by our payment provider as tax law requires.

Your rights

You can access, correct, export and delete your data at any time from your account or by emailing hello@usehodos.com. We respond within the time limits set by applicable law.

Users in Korea

Under the Personal Information Protection Act (PIPA), you may request access to, correction or deletion of, and suspension of processing of your personal information, and withdraw consent at any time. Your data is transferred overseas to the processors listed above for the purposes listed above, and you may refuse this by not using Pro. Privacy officer: [name], hello@usehodos.com. You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118).

Children

Hodos is not for anyone under 14. We do not knowingly collect their data and will delete it if we learn we have.

This website

usehodos.com uses no tracking scripts or analytics cookies, and loads nothing from other servers: no fonts, scripts or images from third parties.

Changes

We will post changes here with a new date, and email account holders before material changes take effect.