Privacy
Hidra
This is short because there is not much to say, and there is not much to say because of how Hidra is built rather than because of a policy anybody adopted.
We do not receive your messages
There is no server. We operate no service that your messages pass through, and we hold no copy of anything you send. A "server" in Hidra is a document that every member holds on their own machine; replicas reconcile directly with each other. When you send something it goes from your computer to the computers of the people in that server.
So there is no data of yours for us to keep, lose, sell, hand over, or be breached of. Not as a promise — as a consequence. We could not produce your messages if a court asked us to.
What your own machine holds
Everything: your identity keypair, every server you have joined, all of its messages and files and history, and the same for every other member's machine. That is what being a member is.
Some consequences worth knowing, because they are unusual:
- Your machine stores and relays other people's data, using your disk, bandwidth and electricity. Joining a server is agreeing to that.
- An invite hands over a complete copy and the ability to write to it, to whoever holds the invite, permanently.
- Nothing can be un-sent. Deleting a message removes it from your replica and asks other members' software to do the same. It is a request to programs other people control, not a guarantee, and a copy somebody already saw is beyond anyone's reach.
What other people can see
The people in a server see what you write there, your display name, your picture and your presence — that is the point of it.
They can also see your endpoint identity: a public key that is stable across sessions. It does not carry your name, but it is the same key each time, so somebody who learns it once can recognise you again. This is how peer-to-peer addressing works and there is no version of Hidra without it.
Appearing offline publishes "do not show me", and ordinary clients honour it. It does not disconnect you — it cannot, or you would stop receiving anything — so somebody running modified software could still tell you are connected. The interface says so where you choose it. Do not rely on it to hide from somebody who might be motivated to look.
Networks you touch
To find peers and be found, Hidra uses four networks, none of them operated by us.
Tor, which Hidra has built in and uses from the start. Your computer connects to the Tor network, which volunteers run, and publishes an onion service whose address is your endpoint identity written another way, so anybody who knows that identity can reach you through it. Your internet provider can see that you use Tor, though not what for. A connection through Tor shows neither side's IP address to the other.
Yggdrasil, which Hidra also has built in and uses from the start. Your computer links to two of the public Yggdrasil nodes that volunteers run -- the two that answer it quickest, from a list built into Hidra -- and is a node on that network whose address is your endpoint identity. Anybody who knows that identity can reach you through it, and the other nodes on the network can see that the address is in use. The public nodes you link to see your IP address; the people you talk to through Yggdrasil do not. Everything sent through it is encrypted end to end.
The BitTorrent Mainline DHT. Your computer publishes its current addresses to it under your endpoint identity, so anybody who knows that identity can look them up, and learns from it the public address the rest of the internet sees. mDNS announces you to people on the same local network.
Where it can, Hidra then connects directly, from your computer to another member's, and a direct connection shows each side the other's IP address. Two copies that met through Tor try a direct connection too, and move to it when it works. Every connection is encrypted end to end, whichever way it goes.
Hidra uses no relay of ours. When a member of a server runs a relay for it (Relay for my servers, below), a call or a screen share in that server goes through it when that is faster than Tor. That member sees your IP address, who in the server you call, when, and how much passes, but not what is said. A screen shared in a call that member is in goes to them once, and their copy passes it on to the others in the call, who would see it anyway. What people write in a server reaches everybody through the members they can reach.
When a member runs a Yggdrasil node (Run a Yggdrasil node, below), your copy links to it by itself, beside the public ones, and that member sees your IP address as the operator of a public node does; neither sees what is said.
Settings → Network has experimental settings. Use Tor is on unless you turn it off. Hide my IP address leaves Tor only: no direct connections, no Yggdrasil, nothing published to the DHT, no mDNS announcements, no request to your router to open a port, and no relay or node for others, so the people you talk to never see your IP address. A member's relay you use for a call still does, unless you turn Use members' relays and nodes off. Use Yggdrasil and Also use the DHT are on unless you turn them off, and off while your address is hidden. Relay for my servers is off unless you turn it on; your computer then carries calls and screen shares for the people in your servers, and offers your public IP address, or an address you type, to everybody in them. They see your address and you see theirs; nobody sees what is said. Run a Yggdrasil node is off unless you turn it on; your computer then lets anybody on Yggdrasil link through it, asks your router to open its port, and offers your public IP address, or an address you type, to everybody in your servers, whose copies link to it. Whoever links sees your address; nobody sees what is sent. Stay hidden on local networks stops the mDNS announcements and stops Hidra asking your router to open a port for it (UPnP, NAT-PMP, PCP).
Check connection, beside them, looks at how your computer can be reached and, for a relay or a node you run, reaches it from outside through Tor to see that the people it is for can. It contacts nobody else.
What we collect
Nothing automatically. No telemetry, no analytics, no crash reporting that sends itself, no check for updates that says who is checking.
Only two things ever reach us: a bug report you choose to send, and, if you buy Hidra+, what it takes to send you your licence.
Bug reports
A build that keeps a log will bundle it into one file when you ask it to. That file is written to your own machine. Nothing is uploaded; you send it, or you do not.
Before you see it, invites, friend codes and node identities are removed. A machine appears as a short tag — the same tag each time, so a fault can be followed through a session without identifying anyone.
What cannot be removed is anything that looks like ordinary words, because that is what a name or a message is. So the file is shown to you before you send it, and you are asked to read it. That request is the last real check, and it is not a formality.
Worth knowing even when no message text is present: a log shows who you talked to and when. The pattern of contact is sensitive on its own.
If you send us one, we keep it while the problem is open and delete it afterwards. We do not use it for anything else.
Buying Hidra+
If you buy Hidra+, Creem (creem.io) sells it to you on our behalf. Creem takes the payment and your name, email and billing details, and keeps them as the seller, under its own privacy policy.
To send you your licence, Creem passes us your name and email address. Our licence server, which runs on Cloudflare and keeps neither, writes them into the licence file and emails it to you through Resend (resend.com), which keeps a record of the email for 30 days. We keep a copy of that email as the record of your purchase.
The licence file itself stays on your computer: Hidra never sends it anywhere.
Children
Hidra is not directed at children, and we cannot verify anyone's age, because we never see a user at all. There is no sign-up and no account.
Changes
A future version may come with a different statement. It will not apply retrospectively to a version you already hold.
Contact
support@hidra.chat
Your rights
Australian privacy law gives you rights over personal information an organisation holds about you. Ours is an unusual position: for the content of your communications we hold none, so there is nothing to give you, correct, or delete. For anything you send us in a bug report, or the record of a purchase, write to the address above; for what Creem holds as the seller, write to Creem.