Skip to content

Security

Last changed on 10 October 2026.

This page says how Hamloy keeps your lists safe, and where that protection stops. What we keep about you, and why, is on the privacy page. If you find a weakness, write to [email protected].

On the way to us

  • Every connection to hamloy.com is encrypted with TLS 1.2 or newer. Older versions are refused, plain http is sent on to https, and browsers are told to use only https for hamloy.com.
  • Requests pass through Cloudflare, and the stretch from Cloudflare to our server is encrypted too, with a certificate Cloudflare checks.
  • Only Cloudflare can reach the server's web ports. The database can't be reached from the internet at all, and we reach the server itself only through an encrypted private tunnel.

On the server

  • Your data is kept in the EU, on a server of Hetzner Online in Germany.
  • The database, which holds every project's lists, and everything else Hamloy stores sit on an encrypted disk (LUKS).
  • The disk's key is not kept on the server. When the server restarts, the disk stays locked until we open it with the key, so a copy of the disk, or a disk that leaves the data centre, can't be read.
  • While the server runs, the disk is open, as it has to be for Hamloy to work. The encryption protects your data at rest, not against someone who breaks into the running server; the rest of this page is about keeping them out.

Passwords, codes and tokens

  • Your password is kept only as a bcrypt hash. Sign-in codes, invitation links, the tokens your assistants connect with, and the tokens you make yourself are kept only as SHA-256 hashes. We can check one you give us, but we can't read any of them back, and neither could anyone who got a copy of the database.
  • A sign-in code works for an hour at most, an invitation link for a week. An assistant you let in gets a token that works for an hour and is renewed while you use it.
  • You can sign in with a passkey instead of a password.
  • You can disconnect any assistant, and revoke any token you made, on the Connect page. It stops working at once.
  • Payments for Pro go through Creem. Your card goes to Creem, never to us.

Who can see your lists

  • You, and the people on a project you share. Each assistant you let in sees the projects you can see.
  • We can reach the server and the database. We look at your data only to keep Hamloy working, to fix a problem, or when the law requires it.
  • We never sell your lists and never train AI on them.

No end-to-end encryption

Hamloy doesn't offer end-to-end encryption. To answer your assistant and to draw your board, our server has to read your lists, and with end-to-end encryption it couldn't. So your lists are encrypted on the way to us and on our disk, but our server can read them while it works with them.

Reporting a weakness

Write to [email protected] with what you found and how to see it. We answer every report, fix what is real as fast as we can, and tell you when it is fixed. We won't take action against anyone who reports a weakness to us in good faith and doesn't harm other people's data or the service.