Privacy
Hidra
This is short because there is not much to say, and there is not much to say because of how Hidra is built rather than because of a policy anybody adopted.
We do not receive your messages
There is no server. We operate no service that your messages pass through, and we hold no copy of anything you send. A "server" in Hidra is a document that every member holds on their own machine; replicas reconcile directly with each other. When you send something it goes from your computer to the computers of the people in that server.
So there is no data of yours for us to keep, lose, sell, hand over, or be breached of. Not as a promise — as a consequence. We could not produce your messages if a court asked us to.
What your own machine holds
Everything: your identity keypair, every server you have joined, all of its messages and files and history, and the same for every other member's machine. That is what being a member is.
Some consequences worth knowing, because they are unusual:
- Your machine stores and relays other people's data, using your disk, bandwidth and electricity. Joining a server is agreeing to that.
- An invite hands over a complete copy and the ability to write to it, to whoever holds the invite, permanently.
- Nothing can be un-sent. Deleting a message removes it from your replica and asks other members' software to do the same. It is a request to programs other people control, not a guarantee, and a copy somebody already saw is beyond anyone's reach.
What other people can see
The people in a server see what you write there, your display name, your picture and your presence — that is the point of it.
They can also see your endpoint identity: a public key that is stable across sessions. It does not carry your name, but it is the same key each time, so somebody who learns it once can recognise you again. This is how peer-to-peer addressing works and there is no version of Hidra without it.
Appearing offline publishes "do not show me", and ordinary clients honour it. It does not disconnect you — it cannot, or you would stop receiving anything — so somebody running modified software could still tell you are connected. The interface says so where you choose it. Do not rely on it to hide from somebody who might be motivated to look.
Networks you touch
To find peers, Hidra uses mDNS on your local network and the BitTorrent Mainline DHT beyond it. Neither is operated by us. Your computer publishes its current addresses to the DHT under its endpoint identity, so anybody who knows that identity can look them up.
Unless you change it, Hidra uses no relays. Every connection is direct, from your computer to another member's, and encrypted, so the people you connect to see your IP address as you see theirs. When two members cannot reach each other directly, what they write in a server still reaches both through members they can reach; a call or a shared screen does not.
Settings → Network has experimental switches, all off until you turn them on. The two that use a relay server use a relay you name, your own or one run by somebody you trust; neither turns on without one, and Hidra does not fall back to anybody else's. A relay sees your IP address, who you connect to, when, and how much passes, but not what you send: connections stay encrypted end to end. Hide my IP address sends every connection through that relay instead of directly, so the people you talk to see the relay's address rather than yours. Use a relay to help connect keeps direct connections and adds the relay to start them and to carry them where two networks will not allow a direct one; it hides nothing. Use a proxy sends the connection to the relay through a proxy you choose, which then sees your address instead of the relay. Stay hidden on local networks stops the mDNS announcements described above, and stops Hidra asking your router to open a port for it (UPnP, NAT-PMP, PCP). Connect through Tor also carries connections through a Tor you run yourself, to and from an onion service derived from your endpoint identity. None of them changes the DHT, which your computer still speaks to from its own address.
Check connection, beside them, looks at how your computer can be reached and, if you have named a relay, connects to it once to see that it answers. It contacts nobody else.
What we collect
Nothing automatically. No telemetry, no analytics, no crash reporting that sends itself, no check for updates that says who is checking.
Only two things ever reach us: a bug report you choose to send, and, if you buy Hidra+, what it takes to send you your licence.
Bug reports
A build that keeps a log will bundle it into one file when you ask it to. That file is written to your own machine. Nothing is uploaded; you send it, or you do not.
Before you see it, invites, friend codes and node identities are removed. A machine appears as a short tag — the same tag each time, so a fault can be followed through a session without identifying anyone.
What cannot be removed is anything that looks like ordinary words, because that is what a name or a message is. So the file is shown to you before you send it, and you are asked to read it. That request is the last real check, and it is not a formality.
Worth knowing even when no message text is present: a log shows who you talked to and when. The pattern of contact is sensitive on its own.
If you send us one, we keep it while the problem is open and delete it afterwards. We do not use it for anything else.
Buying Hidra+
If you buy Hidra+, Creem (creem.io) sells it to you on our behalf. Creem takes the payment and your name, email and billing details, and keeps them as the seller, under its own privacy policy.
To send you your licence, Creem passes us your name and email address. Our licence server, which runs on Cloudflare and keeps neither, writes them into the licence file and emails it to you through Resend (resend.com), which keeps a record of the email for 30 days. We keep a copy of that email as the record of your purchase.
The licence file itself stays on your computer: Hidra never sends it anywhere.
Children
Hidra is not directed at children, and we cannot verify anyone's age, because we never see a user at all. There is no sign-up and no account.
Changes
A future version may come with a different statement. It will not apply retrospectively to a version you already hold.
Contact
support@hidra.chat
Your rights
Australian privacy law gives you rights over personal information an organisation holds about you. Ours is an unusual position: for the content of your communications we hold none, so there is nothing to give you, correct, or delete. For anything you send us in a bug report, or the record of a purchase, write to the address above; for what Creem holds as the seller, write to Creem.