01Who is responsible for your data
Hokki is the data controller for the information described here. When you give us your information, that is because you are using the Hokki chat application.
We are based in the European Union. The law that applies to this policy is the GDPR and, where it gives you more protection, the law of your own country.
Anything about your data goes to legal@hokki.app, including a request to see it or to delete it.
02What we collect
Only what the application needs to work.
- Account details. When you sign in through Shard ID we receive your account identifier, email address, username and profile picture. We never see your Google or Discord password.
- Your conversations. The messages you send, the replies you get, the title a chat is given, and the files and workspace you build up in it. We encrypt message and document content before it is written to disk.
- What you ask the assistant to remember. If you tell it to remember something, that is stored separately from the conversation, and you can read, edit or delete it from the settings at any time.
- Files you upload and files the assistant generates for you, including images, documents and music.
- Usage and billing data. Which model you used, how many tokens it consumed and what it cost. This is what the usage and activity screens show you, and it is how allowances are measured.
- Technical data. Your IP address is used to enforce rate limits and to sign in. We keep it in our server logs.
- Settings you change. Your language, your theme, your model preferences, your custom instructions and the rest of the preferences you set.
03Why we use it
To run the service: to show you your conversations, to remember what you asked us to remember, to let the assistant act on your files, to measure your allowance and to bill you correctly. Without this the application does not work.
To keep the service safe and available: to rate-limit abuse, to diagnose faults and to keep the accounts secure.
To comply with the law and to enforce our terms.
04Who else sees it
Your conversations are passed to the model provider of the model you selected, because that is how the model answers you. Depending on the model, that is one of: OpenAI, Anthropic, Google, xAI, Mistral, Moonshot AI, Xiaomi, Tencent, Alibaba Cloud, Zhipu AI, MiniMax, Meta, DeepSeek, OpenRouter or OpenCode Zen. Which provider serves a given model is listed on the models page.
Each of those companies has its own privacy policy and its own rules about what it does with the prompts it receives. We do not send them your email address or your account identifier, only the content of your conversation and the instructions the assistant is working from.
When you use a tool, the tool may contact somebody else: a search engine, a page you ask it to read, a stock-photo service, a video service, the sandbox where code runs, or the service that makes images and music. What leaves our servers in those cases is the tool's own request, not your account.
We do not sell your data. We do not use your conversations to train our models.
05Where it is stored
Our own servers are in the European Union, and so is the database that holds your conversations.
Some of the services we rely on are outside the EU — the model providers among them. Where that is the case, the transfer is covered by the European Commission's standard contractual clauses.
The application is served by Vercel and error monitoring is done by Sentry. Both process technical data such as IP addresses and request metadata in order to deliver and debug the service.
06How long we keep it
Your conversations, files and memories are kept until you delete them or close your account. Deleting a chat deletes its messages, its files and its title. Deleting a memory removes it straight away.
Sign-in sessions expire on their own. An access token lasts fifteen minutes and a refresh token lasts seven days.
Usage and billing records are kept for as long as the account exists and for the period afterwards that tax and accounting law requires.
Server logs are rotated. IP addresses in them are kept for a short period and then dropped.
08Your rights
You can do most of this yourself, straight away, from the settings: read and export your conversations, edit or delete a memory, delete a chat, delete a file, and close your account.
Where you would rather ask us, write to legal@hokki.app. You have the right to:
- see what we hold about you and get a copy of it;
- have anything wrong corrected;
- have your data deleted;
- restrict or object to how we use it;
- port it to another provider;
- complain to your data protection authority, which in Spain is the Agencia Española de Protección de Datos.
- We answer within a month. If you ask us to delete your data, we do it and confirm it to you.
09Children
The service is not for children under 13, and we do not knowingly collect their information. If you believe a child has given us information, write to legal@hokki.app and we will delete it.
Between 13 and 16, you need a parent or guardian to agree to the terms with us and to supervise your use.
10How we protect it
Conversation content, document content, chat titles and memories are encrypted with AES-256-GCM before they are stored, so a copy of the database on its own does not reveal what you wrote. The server has to be able to read it, to send it to the model for you, so this is encryption at rest and not end-to-end encryption.
Sign-in tokens are stored hashed. Traffic is encrypted in transit. Access to production systems is restricted to the people who need it.
No system is perfect. If a breach affects your data we will tell you and the relevant authority without undue delay.
11If this policy changes
We change this policy when what we do changes. The date at the bottom always says which version you are reading, and if a change affects you materially we will tell you in the application before it takes effect.
Last updated: 19 October 2026