Privacy Policy

How Hive handles your data

Hive is a private messenger. We do not sell your data, we do not operate any advertising tracking and we do not train AI models on your chats. We process personal data only insofar as this is necessary for the operation of the service — revenue comes from storage & computing power, not from you.

1. Controller

Typhora Group LLC
Limited Liability Company (LLC), incorporated in Wyoming, USA
33 N Gould St, Sheridan, WY 82801, USA
E-Mail: hey@typhora.group

Note: Typhora Group LLC is operated from within the European Union; the email address stated above is the responsible point of contact for all data protection matters.

2. Which Data We Process

a) Account & Profile

An email address is required in order to use the service. Optionally, you may provide: display name, username (handle), location, website, short description (bio) and a profile picture. Some of this information is visible to other members (public profile).

b) Sign-in & Security

For login purposes we generate short-lived one-time codes or sign-in links (magic links). If you optionally set a password, we store only a cryptographic hash (scrypt), never the password itself. An active login is maintained by means of a technically necessary session cookie (see section 5).

c) Messages, Media & Calls

The contents of your chats (text, images, files, PDFs, voice messages, location) are processed for the purpose of delivery and stored on our systems until they are deleted or a configured expiry period (disappearing messages) elapses. In the case of end-to-end encrypted “Secret Chats” (see section 7), the server sees only unreadable ciphertext. Audio and video calls run directly between the devices (peer-to-peer); the contents of calls are not recorded by us.

d) Contacts & Conversations

Whom you add as a contact, which groups you belong to, as well as delivery and read status (insofar as released by you).

e) Technical Data

IP address (for the prevention of abuse and attacks as well as for rate limiting), timestamps, and — if you activate push notifications — a push token of your device.

3. Purposes & Legal Bases

• Provision of the messenger (account, messages, media, contacts): Art. 6 (1) (b) GDPR (contract/user relationship).
• Security, prevention of abuse and spam, rate limiting, stability: Art. 6 (1) (f) GDPR (legitimate interest in a secure, functioning service).
• AI features (e.g. summarising, translating, transcribing, reading aloud, image/video generation) and push notifications: only upon your active initiation or consent — Art. 6 (1) (a) or (b) GDPR.

4. No Sale, No Ad Tracking, No Training

We do not use any advertising or analytics trackers, we do not pass on your data for advertising purposes and we do not use your messages to train AI models.

5. Cookies

We use a single, technically necessary cookie (henny_session) to maintain your login via the shared sign-in of Henny OS / the Typhora ID. It does not serve tracking purposes. As only essential cookies are set, no separate consent is required. Your local display setting (e.g. light/dark) is stored in the browser storage of your device, not on the server.

6. Retention Period

• Messages & media: until you delete them or until a configured expiry period elapses; we are designed for minimal retention. Orphaned media files are automatically cleaned up on a regular basis.
• Account & profile: until your account is deleted.
• Sign-in codes/links: a few minutes; invalid thereafter.
• Server logs / IP: only for a short time for security purposes, then deleted or anonymised.

7. End-to-End Encryption (Secret Chats)

You can end-to-end encrypt individual chats as a Secret Chat. Contents are then encrypted and decrypted exclusively on the devices of the participants; our server stores only unreadable ciphertext and cannot read the contents. An optional key backup is stored only in encrypted form (with a recovery code known only to you) — we cannot decrypt this backup either.

8. Recipients & Processors

We engage carefully selected service providers as processors (Art. 28 GDPR) and transmit only the data required in each case:

• Hosting & data storage: Hetzner Online GmbH (data centre in Germany). For media files, the storage region can be selected per chat: Germany (Hetzner) or USA (Cloudflare R2).
• Email delivery: Resend (delivery of sign-in and notification emails).
• AI processing — only if you actively use the respective feature: Anthropic (text summarisation/assistance), OpenAI (speech transcription), fal.ai (image/video generation), ElevenLabs (speech output/reading aloud). In each case, only the content necessary for the feature is transmitted.

9. Transfers to Third Countries

Some of the service providers named process data in the USA. Such transfers take place on the basis of appropriate safeguards (standard contractual clauses of the EU Commission, Art. 46 GDPR) or your explicit consent (Art. 49 GDPR), insofar as you use the relevant feature. If you select the storage region Germany for a chat and do not use any AI features, no transfer to the USA takes place in that respect.

10. Push Notifications

If you activate push notifications, an anonymous endpoint is registered via the push service of your browser/device (e.g. Apple, Google, Mozilla), to which we send notices about new messages. You can deactivate this at any time in the settings or in your system.

11. Security

We protect transmission by means of TLS encryption, store passwords only as a hash, check uploaded files on the basis of their actual content and limit access (rate limiting). No system is absolutely secure; we work continuously on improvements — Hive is in a pre-alpha phase.

12. Your Rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may request the deletion of your account together with the associated data at any time. An informal message to hey@typhora.group is sufficient.

13. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your place of residence, your place of work or the place of the alleged infringement.

14. Last Updated

July 2026. This privacy policy will be updated as Hive continues to be developed.

Hive is in pre-alpha. Features and the processing operations associated with them may change; we will announce material changes.