--- title: Privacy · Hamloy description: What Hamloy keeps about you, why, where, for how long, and what you can do about it. url: https://hamloy.com/privacy --- # Privacy Last changed on 11 October 2026. Hamloy is made in the Netherlands by Rahmakyan (rahmakyan.com, KVK number 42187864). This page says what Hamloy keeps about you, why, where, for how long, and what you can do about it. Questions go to [support@hamloy.com](mailto:support@hamloy.com). **The short version:** we keep your account, your lists and what your assistants write to them, in the EU, to run Hamloy for you. We never see your conversations with your assistants or your code, we use no outside trackers, we never sell your data and never train AI on it. You can export or delete everything yourself, at any time. ## What we keep - **Your account** : your email address, your name if you give one, and how you sign in: a password (only a scrambled form of it), passkeys, or the account at Google, GitHub or Apple you chose. From those we receive your email address and an id for your account there, nothing else. - **Your sessions** : for each place you are signed in, when it started, its IP address and which browser it is, to keep your account safe. - **Your projects and lists** : what you and your assistants write to them: tasks, requests, questions, answers, notes, fields, views, and the history of every change, with who made it. - **Your connected assistants** : which apps you let in, the tokens you made, and for each assistant's session the app's name and version and when it last called. We keep which tools it called on your lists, as the history above. Where Hamloy's program is set up, we also keep where each assistant works: the computer's name, the folder, the repo, the branch, and the names of the files it edits. We never see the conversation you have with your assistant, and never your code or what is in your files. The one exception is yours to turn on: with `hamloy config prompts on`, the program sends the first line of each prompt you give an agent in a linked folder, cut to 120 characters, so the board shows what each agent was asked. We keep only the latest one for each session, replaced by the next, and it goes when the project is deleted. It is off until you turn it on; `hamloy config prompts off` turns it off. - **Your plan** : Free or Pro, monthly or yearly, and until when it is paid, with the ids Creem gives your customer account and subscription, so the two stay in step. The payment, the receipt and the invoice are kept by Creem. - **Emails we send you** : sign-in codes and invitations, sent through Lettermint. A sign-in code is kept only in scrambled form and works for an hour at most. - **Server logs** : each request to hamloy.com, with its IP address, to keep the service running and safe. Old log entries are deleted as new ones come in. We use no advertising and no outside trackers or analytics: we count visits to hamloy.com ourselves, on our own server, without cookies. For a visit we keep the page, the site that sent you, roughly where you are (the country, sometimes the city), and your browser, system and kind of device, never your IP address. On a board we leave out which project, list and item it was, so what you write never reaches the counts. We never sell your data and never train AI on your lists. ## Why we keep it To give you the service you signed up for (the contract with you), and to keep it secure and working (our legitimate interest). We email you only about your account and your projects: sign-in codes, invitations, and changes to these terms. ## Cookies Hamloy sets three cookies, all needed for the site to work: one that keeps you signed in, one that carries a sign-in or sign-up from one page to the next (and the short messages a page shows after you save), and one with your time zone, so "due today" means your today. Light or dark mode is remembered in your browser and never sent to us. No other cookies, so there is nothing to agree to. ## Where it is kept, and who helps Your data is kept in the EU, in a database on a server of Hetzner Online in Germany. These companies handle some of it for us, each only for its part: | Company | What it does for Hamloy | Where | | --- | --- | --- | | **Hetzner Online** | The server, the database, and the encrypted backups. | Germany | | **Cloudflare** | Every request to hamloy.com passes through it, to protect the site and make it fast. | United States, with servers around the world | | **Lettermint** | Sends the emails: sign-in codes and invitations. | The Netherlands | | **Creem** (Armitage Labs OÜ) | Takes the payments for Pro, as merchant of record. It gets your email address and what you pay for, and keeps your card and billing address itself; we never see your card. | Estonia | | **mailbox.org** | Our email, when you write to [support@hamloy.com](mailto:support@hamloy.com). | Germany | | **Google, GitHub and Apple** | Only if you sign in with them, to tell us who you are. | United States | The same list, on its own page: [subprocessors](https://hamloy.com/subprocessors). ## Outside the EU Cloudflare, Google, GitHub and Apple are companies in the United States. What of your data reaches them is protected under the EU–US Data Privacy Framework or the EU's standard contractual clauses. ## Sign-in with Google If you sign in with Google, we receive only your email address, and use it only to sign you in to your Hamloy account. Hamloy's use of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We never share it, never use it for ads, and never use it to train AI. ## People you share a project with On a project that is shared, everyone on it sees its lists and what each person and assistant wrote, with their name, and the email addresses of the people on it. ## How long we keep it As long as you have your account. Deleting your account removes it at once, with every project you own and everything in them: 1. Delete it yourself under Account › Delete your account. It is deleted at once and for good. 2. If you can't sign in, first try "Forgot password?". If that fails, write to [support@hamloy.com](mailto:support@hamloy.com) from the account's own address, and we delete it by hand within 30 days. 3. Backups that still hold deleted data are gone within 30 days. 4. What you wrote in a project someone else owns stays in that project's lists, as part of their work. More on its own page: [data deletion](https://hamloy.com/data-deletion). A session is deleted when you sign out of it. ## Your rights You can see, correct, export and delete your data. Most of it you can do yourself: your lists on the board, an export of any project as plain Markdown, and deleting your account. For anything else, such as a copy of everything we keep about you, write to [support@hamloy.com](mailto:support@hamloy.com) and we answer within 30 days. You may also object to how we use your data, or ask us to limit it. If you think we handle your data wrongly, tell us first; you can always complain to the Dutch data protection authority, the [Autoriteit Persoonsgegevens](https://www.autoriteitpersoonsgegevens.nl). ## Children Hamloy is not meant for children. You need to be 16 or older to make an account, and we don't knowingly keep anything about anyone younger. If you think a child has made an account, write to [support@hamloy.com](mailto:support@hamloy.com) and we delete it. ## Changes When this page changes in a way that matters, we email you before it takes effect. The date at the top says when it last changed.