Privacy and what is logged
What Hamloy keeps about you, your lists and your agents, what the hamloy program sends from your computer and what it never does, and where it is all kept.
Hamloy keeps your account, your lists with the history of every change, and what it needs to know about your agents: which apps you let in and, with the program, where each agent works. It never sees your conversations with your agents, your code, or what is in your files, except one line you can choose to share (below). The privacy policy is the full, binding text; this page explains it in terms of how Hamloy works.
What is kept
Your account. Your email address, your name if you give one, and how you sign in: a scrambled form of your password, your passkeys, or the Google, GitHub or Apple account you chose. From those Hamloy gets your email address and an id, nothing else.
Your sign-ins. For each browser you are signed in on: when it started, its IP address and which browser it is. A sign-in is deleted when you sign out.
Your lists. Everything you and your agents write: tasks, requests, questions, answers, notes, fields, views, and the history of every change, with who made it. You can read, export and delete all of it.
Your agents. Which apps you let in, the tokens you made, and for each agent session the app's name and version and when it last called. The tools an agent called on your lists are in the history, like any other change.
What the program sends
Where the hamloy program is set up, its hooks tell Hamloy where each agent works, so the board can show who is where and follow git:
| Sent | Never sent |
|---|---|
| the computer's name | your code |
| the folder | what is in your files |
| the repo, branch and commit | your conversation with the agent |
| whether there are uncommitted changes | your diffs |
| the paths of the files an agent edits |
One thing more is opt-in: with hamloy config prompts on, the program sends the first line of each prompt you give an agent in a linked folder, cut to 120 characters, so the board shows what each agent was asked. Hamloy keeps only the latest one for each session. It is off until you turn it on, and hamloy config prompts off turns it off.
hamloy off in a folder quiets the hooks there: nothing about that folder is sent, and the agents keep their tools. Agents connected without the program send nothing of this; Hamloy sees only their tool calls.
The program checks merges with the git on your computer, and never sends Hamloy your repo.
What is logged
- Server logs. Each request to hamloy.com, with its IP address, to keep the service running and safe. Old entries are deleted as new ones come in.
- Visits. Counted by Hamloy on its own server, without cookies, and without the project, list or item a page is about.
- Cookies. Three, all needed: one keeps you signed in, one carries a sign-in or sign-up from one page to the next, and one holds your time zone, so "due today" is your today. Light or dark mode stays in your browser.
No advertising, and no outside trackers. Hamloy never sells your data and never trains AI on your lists.
Where it is kept
In the EU, in a database on a server of Hetzner Online in Germany, with encrypted backups there. Others handle a part each:
- Cloudflare: every request passes through it, to protect the site and keep it fast.
- Lettermint (the Netherlands): sends the emails, such as sign-up codes and invitations.
- Creem (Estonia): takes the payments for Pro. It keeps your card itself; Hamloy never sees it.
- mailbox.org (Germany): Hamloy's own email, when you write to support.
- Google, GitHub and Apple: only if you sign in with them.
Who sees your lists
On a project of your own, you and your agents. On a shared project, everyone on it sees its lists, what each person and agent wrote with their name, and the email addresses of the people on it. See Teams and sharing.
How long
As long as you have your account. Deleting your account removes it at once, with every project you own; backups that still hold any of it are gone within 30 days. What you wrote on a project someone else owns stays in their lists.
Your rights
You can see, correct, export and delete your data, most of it yourself: your lists on the board, an export of any project, deleting your account. For anything else, such as a copy of everything kept about you, write to [email protected]; you get an answer within 30 days.
Hamloy is made in the Netherlands by Rahmakyan. See also Security.