hide.st is designed to know as little about you as possible. This policy explains what we store, what we don’t, who else handles your data, and the choices you have.
- You sign in with an account key. We never ask for your name, email, phone number or ID.
- You pay on a payment processor's checkout. From us it gets only the amount and a random deposit id.
- Prompts reach the AI provider from our servers, without your IP address or account details.
- Proxy traffic and servers run at partners that get no account details from us.
- We keep only what billing needs. No IP addresses, no prompt logs, and your chats stay in your browser.
No personal details needed
Your account is created the first time you use the service. It’s identified by a random account id and an account key. We don’t ask for your name, email address, phone number or any identity document.
What we store
Your account
A random account id, a support key you can share with us, your settings, and scrambled (hashed) versions of your account key and API keys. We never store the keys themselves. For API keys, we also keep the name you give each key and its first and last few characters, so you can tell them apart.
Email and password, if you add them
If you add an email address, we store it with a hashed password so you can sign in with them, and we may use the email to contact you about your account. We don’t send marketing email.
Passkeys, if you add them
For each passkey we store its public key, a name such as “Apple Passwords”, and when you added it and last used it. Your fingerprint, face or device PIN never leaves your device, and we don’t ask for the make or model of your device.
Servers, if you rent them
For each server: its size, location and operating system, the name you give it, its IP addresses, its status and billing dates, and any abuse reports about it. The server runs at one of our hosting providers, which sees the server and its traffic but gets nothing about who you are. An SSH key you add is passed to the provider to set up the server and removed from the provider’s panel a few minutes later. We don’t store root passwords: on custom-size servers a new one is shown to you once, and on plan servers the provider keeps it so the server’s page can show it to you again. Deleting your account deletes your servers too.
Balance and payments
Your balance, and a record of every top-up, charge, adjustment and refund. For each top-up we keep the amount, the payment processor, the coin and network when we know them, any payment address we showed you, the status, and the payment details the processor sends us. Card details go to the card provider on the processor’s checkout, never to us. Crypto transactions are also recorded on public blockchains, which neither we nor you can change.
Request records
For each request: the model, token counts, cost, timestamps, status, any error code, how long it took, and whether it came from the web chat or an API key (and which one). This is what your Usage page shows. It doesn’t include what you asked or what the model answered.
Sessions, not IP addresses
We don’t store IP addresses. They are used only in memory, for a short time, to enforce rate limits and stop abuse. Each signed-in browser has a session record showing when it was used and what kind of browser and operating system it is (for example “Firefox on macOS”), which you can review and end in Settings.
Messages you send us
If you message us or send feedback, we keep your message and any contact details you include. Feedback sent while you’re signed in is linked to your account.
What we don’t store
Your chats. Conversations, and the images, video and audio you create in the web app, are saved in your browser’s storage (IndexedDB) on your device, not on our servers. If you clear your browser data they’re gone, unless you’ve exported them in Settings.
Your prompts and files. What you send passes through our servers to the AI model provider that produces the response. We don’t log prompts, files or responses.
There are three exceptions:
- When a generated file is delivered as a download link, as with videos, 3D models and API requests that ask for a link, we keep the file until Studio has saved it on your device, and never more than a day.
- Files you add to a video or 3D job (a source video, a voice track, a reference image, a 3D model) are rebuilt to remove hidden data, kept until the job ends, and deleted. We never keep them more than 6 hours.
- Video and 3D generation run in the background, so we keep each job’s model and settings, but not your prompt or files, to track and bill it.
AI model providers
To generate a response, your prompts and files are sent to a third-party AI model provider, sometimes through an aggregator that routes requests to them. Requests reach them from our servers: they don’t get your IP address, account details or payment information from us.
Providers handle what you send under their own privacy policies. Some keep data for a period, for example to monitor abuse, and some may use it to improve their models. Where we know a model’s provider keeps data, the model’s description on the Models page says so. Avoid sending sensitive personal information unless you’re comfortable with how the provider handles it.
How long we keep data
- Account, balance and request records: while your account exists.
- IP addresses: not stored.
- Generated files delivered as download links: until saved on your device, at most a day.
- Files you add to video and 3D jobs: until the job ends, at most 6 hours.
- Sessions: until you sign out or the session expires.
- Feedback and emails: as long as we need them to deal with your message.
When you delete your account, we delete it along with its keys and sessions, and request records stay in our accounting without any link to you. If the account has payment history, we have to keep its payment and balance records, so instead we remove your email address, password and settings, and disable the account.
Your choices and rights
- Your chats are on your device, so you control them. Export or delete them at any time in Settings.
- See and download your request history on the Usage page.
- Delete your account in Settings, or message us on Session with your support key and we’ll do it for you.
- Your chats are saved in your browser, not on our servers. Export them whenever you like.
- The Usage page lists every request: where it came from, its tokens and its cost. Download it as a CSV.
- See every device that's signed in, and sign the others out.
- Delete your account at any time. Its API keys are revoked and every device is signed out.
- For anything else, message us with your support key. It finds your account but can't sign in to it.
Depending on where you live, you may also have the right to access, correct, delete or export your personal data, or to object to how we use it. To make a request, message us on Session with your support key. We may ask you to show the account is yours, for example by signing in.
Security
Account keys, API keys and passwords are stored only as hashes, and connections to hide.st are encrypted. No system is perfectly secure, so keep your account key and API keys private. If you think one has been exposed, generate a new account key in Settings or revoke the API key in Developers.
Children
hide.st is only for adults: you must be 18 or older to use it. We don’t knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we’ll close it.
Changes to this policy
If we change this policy, we’ll update the date at the top of this page. For significant changes, we’ll also let you know in the app before they take effect.
Contact
For privacy questions or requests, message us on Session or see Help & contact.